Defining and Evaluating Risks

Defining and evaluating risks is key to effective risk management. But why? And how do you do it?

The Problem: businesses face uncertainty, particularly at times of economic difficulty. These can be especially problematic for small businesses that have limited resources to react to challenges, which distract them from their business operations and reduce their competitiveness.

The Solution: Defining and evaluating risks more than pays for itself. By horizon scanning, identifying threats and opportunities, and making decisions about where to focus their time and resources, businesses can become more resilience and out-perform their competitors. They can also increase the confidence of key stakeholders such as investors and suppliers.

In this guide we will:

• explain more about the benefits of risk management;

• discuss the key steps in identifying and evaluation risks;

• introduce ways of managing risks and ensuring your risk management approach is working

Effective risk management provides enormous benefits for businesses when it comes to removing uncertainty. Some of these benefits include:

________________________________________________________________________________________________

________________________________________________________________________________________________

Minimising financial losses

By identifying and evaluating risks, businesses can take steps to minimize potential financial losses. This can involve implementing risk mitigation strategies, such as diversifying investments or obtaining insurance coverage, that can help to protect the business from unexpected events that could impact its financial stability.

Improving decision-making

Effective risk management can also help businesses make more informed decisions. By understanding the potential risks associated with different courses of action, businesses can weigh the potential costs and benefits more accurately, and make more strategic decisions that are better aligned with their goals.

Enhancing reputation

A business that effectively manages risks is generally viewed as more reliable and trustworthy by customers, investors, and other stakeholders. This can enhance the business’s reputation and help to attract and retain customers and investors over the long term.

Increasing resilience

Effective risk management can also help businesses become more resilient in the face of unexpected events or crises. By anticipating and preparing for potential risks, businesses can respond more quickly and effectively when these risks do materialize, minimizing the impact of these events on the business’s operations and financial performance.

Ensuring compliance

Many businesses are subject to various regulatory requirements, and effective risk management can help to ensure that these requirements are met. By identifying potential compliance risks and implementing strategies to mitigate them, businesses can avoid fines, penalties, and other legal issues that could impact their operations and reputation.

 Overall, effective risk management is essential for businesses looking to remove uncertainty and operate in a stable and predictable environment. By identifying and mitigating potential risks, businesses can enhance their financial performance, reputation, and resilience over the long term.

Introduction to Defining Risk

Before you think about describing your risks you need to work out what they are. There are a number of techniques you can use. We have published articles about two methods you can apply for risk analysis and risk identification:

• SWOT analysis – looking at your strenths, weaknesses, opportunities and threats

• PESTLE analysis – exploring external political, economic, social and other factors to identify risks

How to Describe a Risk

Once you have identified your risks, you need to set them out in a consistent way. It is important to remember a risk is an uncertain event – something that could happen, not something that has happened. If you have a gap in performance data relating to, for example, customer relationship management, you can work out how severe it is by thinking about the risks it poses.

Try to describe your risk in terms of cause, event, and effect.

For example:

“if our CRM does not capture the contact emails of people who abandon carts before purchasing online, we may miss an opportunity to re-engage with people who are interesting in buying our products, resulting in lost sales.”

Once you have described your risk you are ready to score it. That means you need some form of risk assessment process.

How to Evaluate A Risk

Risk scores have two elements: likelihood (the probability or chance of a problem occurring) and consequence/severity (how bad would it be if it did?). For ease we recommend scoring each element on a scale of 1 to 5, 5 being worst.

Severity or consequence

 Obviously what is important to your business is up to you. However, the consequence rating will depend on the harm the risk could do over the time horizon you are looking at.

Likelihood

The exact threshold of possibility or probability between categories 1, 2, 3 etc. will be up to you but your likelihood structure will probably be set out something like this.

1: very unlikely

2: unlikely

3: 50:50 chance

4: likely

5: highly likely

Multiply the two factors together and you get your risk score – the higher the risk score the greater the priority it has for action.

Using the risk scoring system introduced above your lowest possible risk is 1 (1 x 1) and your highest possible risk is 25 (5 x 5).

You can map your risks onto a chart like this, to give you a visual representation of where your risks lie:

One axis represents likelihood, the other consequence – it doesn’t matter which way round you do it so long as you are consistent.

This tool is useful because it gives you a great picture of where your risks lie. Are they concentrated in the red area? Do risks relating to a particular activity or type of data tend to be higher than others? Straight away you can tell where your priorities lie.

________________________________________________________________________________________________

________________________________________________________________________________________________

Determine Your Risk Appetite

A useful way of thinking about where to focus your action is to determine your risk appetite. That means deciding at what point on the range of risk scores from 1 to 25 you risks are too high and you have to take action; and what point on the range of score you decide you can comfortably live with the risk.

• You can learn more about risk appetite and tolerance here.

Taking Action On Risks

Now you have scored your risks and prioritised them for action the next step is to do something to reduce the risk score. In essence you want to find a way to reduce either the likelihood or the consequence (or both) so your risk score falls below your appetite threshold.

There are four main approaches you can take:

1. Mitigate – implement actions to reduce the risk score (e.g. implement tighter security)

2. Share – work with partners to spread the risk (e.g. take out insurance)

3. Avoid – stop the activity that is causing the risk in the first place

4. Accept – in some cases there may be nothing you can do and you just have to carry on. So long as you can demonstrate that this is the most appropriate thing to do, this can be an acceptable approach.

• We have produced guidance on risk management approaches that you can read here.

Once you have identified your approach, think about the action you need to take to manage and ideally reduce the risk going forward.

Re-score Your Risk

Once you have identified your actions you can evaluate what effect they will have. For example, not using certain types of data any more might reduce the consequence of a data breach. Improving training might reduce the likelihood of a failure to meet customer expectations. Think about by how much, and re-map your risks to give you a before-and-after picture.

So, in summary you should end up with pre- and post- action risk charts that look like this:

Keep Your Risks Under Review

You may need several attempts to effectively reduce your risks scores, and risk scores can increase due to events out of your control. New risks will crop up from time to time. It is important to keep your risks under regular review to ensure you are keeping on top of them.

It is crucial that your risk evaluation and risk review is not a one-off exercise.

Risk Management Top Tips

• Use tools like a SWOT or PESTLE analysis to help with defining and evaluating risks

• For your highest rated risks ensure your senior leadership team is involved in the management process.

• Let subject matter experts and front line staff determine what is reasonable and appropriate in terms of risk management approaches, rather than taking a top down approach

• Speak to all of your stakeholders to see what their views and expectations are. This will help you both score your risks and determine your risk appetite.

• Risk management is a tool to help you prioritise time and resources in your professional context. There is no objective right and wrong, so remember the best person to decide what is right for you is you – only you truly understand your business priorities and the challenges and opportunities in your market.

________________________________________________________________________________________________

________________________________________________________________________________________________