The Risk Management Failure That Most Companies Share
The most common corporate risk management failure: the risk register that lists every conceivable risk, assigns a probability and impact score to each, and is then filed and never referenced until something goes wrong. This compliance-oriented risk management produces documentation without capability — the organisation that has identified ‘cyber breach’ as a high-impact risk but hasn’t invested in the specific controls and response capabilities that would detect and limit a breach hasn’t managed the risk; it’s simply recorded it.
The risk management that produces genuine organisational resilience is fundamentally different: it connects risk identification to specific mitigation investments, tests mitigation measures before they’re needed, ensures decision-makers understand the risk exposure in real time, and updates the risk picture continuously as the environment changes. This is risk management as a management discipline rather than as a compliance activity — the difference between an organisation that knows what risks it faces and one that actually does something about them.
Risk Identification: The Process of Finding What Could Go Wrong
The risk identification methodologies that produce the most complete picture: scenario planning (imagining specific scenarios — recession, competitor disruption, key customer loss, regulatory change, natural disaster — and working through their implications for the business), horizon scanning (systematic monitoring of trends and developments in the external environment that could produce future risks), and bottoms-up input from the people closest to specific risk areas (the operations team that knows the equipment failure modes, the sales team that knows the customer concentration risks, the IT team that knows the technology vulnerabilities).
The risk identification blind spot that most organisations share: risks that emerge from the interactions between systems rather than from single sources. The supply chain disruption that becomes a financial crisis because inventory financing covenants require maintaining inventory levels, which can’t be maintained during the disruption, which triggers a technical default — each element of this chain might be identified separately without the interaction being mapped. The scenario planning that models multi-factor events (combinations of things going wrong simultaneously) produces the most realistic picture of material risk.
Risk Assessment: Prioritising What to Act On
Risk assessment — the process of evaluating identified risks to determine which are most important to address — requires evaluating both probability (how likely is this risk to materialise?) and impact (if it materialises, how significant would the consequences be?). The risk that’s highly probable but low-impact is annoying but manageable; the risk that’s low-probability but catastrophic deserves more attention than its probability alone suggests because the catastrophic outcome can be existential.
The risk assessment dimension that most organisations underweight: velocity — how quickly can a risk materialise and cause damage? The cyberattack that can exfiltrate all customer data in hours is a higher-velocity risk than the competitive disruption that plays out over years, and the velocity difference affects the appropriate mitigation approach. High-velocity risks need detection and response capabilities; lower-velocity risks allow more time for adaptation. The risk map that includes velocity alongside probability and impact produces more actionable risk prioritisation than one that considers only the first two dimensions.
Risk Mitigation: The Strategies Available for Each Risk Type
The risk mitigation strategies available for any identified risk: risk avoidance (don’t engage in the activity that produces the risk — decline the large customer who represents too high a revenue concentration, or exit the market where the regulatory risk is unacceptable), risk reduction (take actions that reduce either the probability or the impact of the risk materialising — implement cybersecurity controls to reduce breach probability, maintain business continuity plans to reduce the impact when a disruption occurs), risk transfer (purchase insurance or use contractual provisions to transfer financial consequences of the risk to another party), and risk acceptance (consciously decide to accept the risk without mitigation because the cost of mitigation exceeds the expected cost of the risk materialising).
The risk mitigation investment decision: compare the cost of mitigation against the expected cost of the risk (probability times impact) adjusted for the risk’s time horizon and the organisation’s ability to absorb the potential loss. The cybersecurity control that costs $100,000 per year and reduces the probability of a $5M breach from 15% to 3% per year produces $60,000 per year in expected loss reduction ($150,000 minus $90,000 in reduced expected cost) — a positive investment at those parameters. The mitigation that costs more than the expected loss reduction it produces is over-hedging; the one that costs less is under-invested.
Business Continuity Planning: Preparing to Operate When Things Go Wrong
Business continuity planning (BCP) is the preparation that allows an organisation to continue critical operations during and after a disruption — whether a natural disaster, a technology failure, a pandemic, or any other event that disrupts normal operations. The BCP that most effectively enables continuity: specific plans for the specific disruption scenarios most likely to affect the business, tested through tabletop exercises or partial simulations before they’re needed in earnest, with clear ownership of response activities and regularly updated contact information for key personnel and vendors.
The BCP element that most organisations get wrong: treating the plan as a document to be created and filed rather than a capability to be developed and maintained. The business continuity plan that was written three years ago has outdated contact lists (people have changed jobs and phone numbers), superseded technology references (the backup system described in the plan has been replaced), and untested recovery time assumptions (the IT recovery time was estimated, not measured, and is probably wrong). The annual BCP review and tabletop exercise that tests whether the plan’s assumptions hold and updates what’s changed is the maintenance investment that converts a document into a capability.