Risk identification and risk evaluation – a fresh perspective

Know what you know. And also what you don’t…

The US Secretary of Defence at the time of the Iraq War post 9/11, Donald Rumsfeld, famously fumbled through the concept of known knowns, and known unknowns. Without getting into the detail of the model within which these concepts live, business leaders must recognise that, regardless of experience, the biggest mistake anyone can make is complacency. Particularly when it comes to business and risk. Proactive risk identification and risk evaluation is, without question, critical for success.  

The world is in a constant state of change. Every year, a slew of businesses are lost, many with long distinct histories of success and market power. New disrupters with fresh ideas, mindsets, technology and innovation, make the shiny and new more appealing to a vibrant generation who are increasingly making the decisions. Indeed, ‘the establishment’ is looking and feeling distinctly dated.

So the question is: “How can we know what’s coming to bite us next, and where should we focus?”  In the first of this mini blog series ‘Why risk management is important for your business’, we spoke about the number one risk an organisation faces: Whether its business is still relevant and sustainable.

Let’s say you’re fortunate enough to be in an expanding market and your business is growing share. Then congratulations, the chances are your business is relevant. But clearly you’re not out of the woods (there are examples abound of IPO flops, founders shamed, shareholder revolt etc.).  So how do you think through what risks you face? How do you get to know some of these unknowns?

Start with what you know 

As an expert in your own business, the starting point is to look at what you do know. What are the key risks that could stop you from delivering on your objectives, or being successful? Some businesses may not have defined or even agreed objectives, but even those will know the bigger mission, vision or ‘reason for being’. 

Try to think beyond yourself and solicit inputs from others within the team and wider business, including diverse perspectives from different disciplines and departments. You’ll find this approach will yield surprisingly comprehensive results.  

Fresh perspectives – a simple model to gain a holistic view

Risks can come from anywhere, so it’s critical to think broadly and holistically. One of the most simple but useful models is the ‘STO’ (Strategic, Tactical and Operational) framework which helps ensure thinking from these different perspectives. CEOs and Boards are often focused on strategic risks, but forget that day to day operational risks can derail a whole company too.

Similarly, those in operations might not think about some bigger strategic issues, such as risks to the business model itself.  Finally, those with financial backgrounds might struggle to see past these and other tactical risks. 

This simple model can help shape your thinking through these different lenses and perspectives to gain a more holistic picture. 

A risk universe for the unknowns

Conceptually, the ‘risk universe’ represents all the risks your business could possibly face. This is a big statement in the context of unknown-unknowns. It’s not a crystal ball, and no model can possibly see the future, but it works by setting out categories of risks, to prompt thinking in the same way the STO model above does.

Let’s say you’re a hotel company. You might have initially missed the significant threat of ‘sharing economy’ disrupters entering the market such as Airbnb. Had you been prompted to think about business model or technology change, you might have been more likely to make the connection. 

Similarly, Brexit or Covid weren’t specifically set out in any risk universe. But you might see broader terms like macro-economics, geo-politics, health & safety or pandemics facilitating the risk identification and evaluation process.

There are some very comprehensive risk universe models,. We have synthesised and reconciled these into a shorter (and we believe more useful) set of 26 risks. We’ve built these into GOAT Risk – an easy to use, low cost, risk management software platform. Depending on the type of organisation you have, the system even proposes risks it thinks are relevant to your business.

Whilst this is a useful shortcut to risk assessment, there’s still the need to think about categories, and describe risks and their impacts in much greater detail. Only then, will they be viewed as a meaningful and action orientated problem set.

Know what you know and also what you don’t. Then do something about it.

If knowing your risks is step one, not doing anything about them is the same as not knowing at all.  

This is the 2nd of a 4 part series helping you to think broadly about the risks you face. If your plate is already full, then giving you more things to worry about is the last thing you need.

Recognising this, our next post is specifically for business leaders who are juggling many balls, and lack time and resources. Subscribe to our Blog today to never miss an update.

About the author

Danny Wong is the Founder and CEO of GOAT Risk Solutions. He is a thought leader in risk maturity, having engaged with hundreds of leaders and professionals in extensive market research. He has first-hand experience of supporting major corporates in a +20 year career specialising in Enterprise Risk Management. Danny saw a market opportunity for a simple, low-cost risk software solution to help organisations improve risk management capability, and launched GOAT in 2018.

Find out more about GOAT Risk™