Risk Management Simplified: Rain is Not a Risk When its Raining
A few weeks ago an old colleague called me to discuss a risk management issue. For reasons of confidentiality I won’t go into the details of his problem, but he outlined for me the following situation.
The particular market served by his firm was shrinking. More accurately it was dying. The particular demographic his firm served was shrinking as it aged and it was not coming back.
My colleague wanted to discuss the risk of the loss of this market; specifically how to quantify the risk of market loss, set risk thresholds, key risk indicators etc.
I wasn’t getting paid for this consultation, so I felt free to shoot from the hip a little. My answer was this: when its raining the risk is not rain, the risk is flooding, or, if you are in the umbrella business, the risk might be sunshine. If you are running a golf tournament, the risk might be business interruption.
My colleague was in a monsoon. He didn’t need to measure the likelihood of rain; rain was under falling in sheets. He needed to measure the amount of rainfall and estimate when the rivers and lakes would overflow. He was facing the risk of flooding, unless he took some action. Rain was not a risk; rain was his reality.
The lesson here is a simple one but it has significant ramifications. Those of us in the risk management business need to understand that every risk event has at least one cause, and probably has multiple consequences.
In my experience, I see very little attempt to distinguish between risk cause, risk events and risk consequence. Yet if we are truly interested in the ability of the risk management profession to contribute to business performance and to prevent, or at least predict unpleasant surprises, we need to parse this information carefully.
For risk managers, understanding all the bad things that can happen is important but insufficient. Understanding the relationships between risk causes, risk events and the multiple, sequential consequences that result are critical.
If an event is occurring, or is certain to occur within a time frame, it is not a risk, it is an issue; the cause or possible cause of a risk. That quadrant on the infamous heat maps where events are approaching certainty? Managing those events is issue management, not risk management.
One example I use in training exercises is called “the broken shoelace syndrome”.
The message is this: risk management must concerned with the “trips and falls” in our lives. Knowing that broken shoelaces are a root cause of trips and falls is useful, but insufficient. Understanding the entire relationship between the trip and fall, all of its causes, all of the resultant injury or downstream impacts including the medical bills are what risk management is all about. Without connecting all the dots, risk management serves little value.
