Practically speaking, the business of life is all about managing risk. Whether managing a home, a multinational corporation, a small nonprofit, or the big business of government, managing risk effectively is the difference between success and colossal failure. Therefore, it stands to reason that a primary role of leadership is effective risk management.
Enterprise Risk Management (ERM) has become somewhat of a buzz word these days, but don’t let that intimidate you. ERM is simply a systematic process of identifying risks and recording your approach to managing them. A risk is nothing more than an event which could alter your ability to achieve your plans and is typically evaluated against your strategic objectives (such as your mission, vision, values, or goals). The term risk can carry a negative connotation, but in fact, many risks are positive. For example, the risk of the product launch being much more successful than we anticipate, causing inventory depletion. While somewhat subjective, a risk – or more specifically a risk score – is calculated as the product of the likelihood of an event happening and the level of impact of the event, should it occur. We each do this analysis routinely in our heads every day, at home and at work, Enterprise Risk Management is just the process of writing it down and tracking the risks over time.
The key to effectively managing risk and opportunity is to know your risk tolerance. In other words, what is the right level of risk for the organization? Some degree of risk is healthy, spurring growth and continuous improvement. I would call that Enough Risk, the right amount of risk to maintain a healthy balance within the organization. Too much risk is a drain on resources and could put the entire enterprise in jeopardy. Too little risk causes stagnation and stunts innovation. You need some risk, enough risk. Therefore, I prefer to call this process Enough Risk Management.
To find your Enough Risk Management point, follow these steps:
- Brainstorm your risks and write them down.
- Write out a brief definition of the risk.
- Develop an evaluation scale, with brief definitions for each number on the scale. (I like a whole number scale of 1-10 for both probability and impact.)
- Score each risk for both its probability of occurring and the impact it would have should it occur. (You would want to include key leaders and stakeholders in at least this part of the process, preferably the whole process.)
- Calculate the risk score by multiplying the probability score by the impact score.
- Determine your Risk Management Strategy for each risk. (See the Key Strategies below for more information.)
- Identify a Risk Steward for each risk.
There are basically four Key Strategies, or options, for managing risks:
- Reduce it – Is there a reasonable way we could buy this risk down or minimize its impact? (An example is taking out insurance on your home or vehicle.)
- Reassign it – Is there another person or entity who would better manage this risk?
- Retire it – Is there a way to eliminate the risk altogether by rethinking the current state?
- Reward it – Make a decision to accept the risk and reward those who steward it well.
Whether personal or corporate, identifying and managing risks are a part of everyday life. So, take time this week to start making a list of the risks in your personal life and organization. To help you take the next step, download the free Enough Risk Management Tool on the Resources page.
