One of the most misunderstood concepts in risk management is the relationship between risk and opportunity. Many people view risk and opportunity as opposites – risk is something bad and opportunity is something good. In our view this is an erroneous interpretation. Tony Harb and Mitchell Morley, risk management and governance specialists from InConsult, look at how councils can better understand the relationship between risk and opportunity.
Let’s go back to basics. The international standard on risk management, ISO 31000, defines risk as “the effect of uncertainty on objectives”. It is based on the fact that we live in an uncertain environment in which we cannot always predict the outcome of future events with complete accuracy.
Notice risk is not defined as the “negative” effect of uncertainty on objectives. Future uncertain events may have a positive or negative impact. A positive outcome presents an opportunity which can be defined as “a favourable or advantageous circumstance or combination of circumstances”. A negative outcome might be defined as a hazard or the “exposure or vulnerability to injury, loss, evil, etc.”
Pulling all of this together, risk and opportunity are not opposites. Risk can be a source of opportunity as well as a source of loss. Risk management is as much about maximising opportunities as it is about minimising negative consequences.
A better way to think about all of this is to use the terms “upside” risk and “downside” risk. In pursuing our objectives there are some risks that if they eventuate will have little or no upside. For example, there is unlikely to be any immediate upside impact on objectives if a fire burns your building to the ground or an employee is seriously hurt.
These are purely downside risks – at least in the short term.
Some risks however, may have an up or down side. For example, if we have invested money in the aim of achieving a return on our investment, changes in interest rates could have a positive or negative impact. However, if we have forecast that we will receive a positive return and we receive the exact level of return we forecast is this really an upside? It’s like saying that achieving our objective is an upside. In our view an upside would only occur if we exceeded our target and this was seen as a good thing. If we still received a return but it was less than anticipated then this would be a downside.
Very few risks will be upside only. If we could predict these we would all be off to the casino!
But what does all this mean for councils.
The Opportunity Matrix
The misunderstanding about the relationship between opportunity and risk manifests itself in some unusual ways. We have seen organisations develop risk opportunity matrices as well as risk consequence matrices. Some organisations identify loss of life, quite rightly, as a catastrophic impact on their consequence matrix. But in their opportunity matrix they identify nobody dying as a “significant” opportunity! Others have a separate section on their risk register for “opportunities” as opposed to risks.
Describing All Risks in the Negative
Another manifestation is for people to always describe risks as the chance of not achieving an objective e.g. lower than anticipated return on investments due to change in interest rates. This ignores consideration of the possible upside. A better way to describe this risk might be “variation to anticipated return on investments (positive or negative) due to fluctuations in interest rates”. Describing risks in this way will help to get people to think about maximising opportunities rather than just avoiding disasters.
Response Strategies
Not considering the potential up and down side of risks can result in response strategies or contingency plans that are one dimensional. Think about a risk event that could result in positive or negative publicity depending on the outcome of the event. A typical control for such an event might be a public relations or communication strategy. But if we focus exclusively on the negative consequences of the risk event (i.e. the downside) it is likely that the PR or communication strategy will be all about crisis management or damage control. Thinking about the possible upside might result in a PR strategy that enables the organisation to capitalise or leverage off the upside of the risk if it eventuates.
Objective Setting
Focussing purely on downside risk can also constrain thinking about organisational objectives. If we are constantly looking at what could go wrong there will be a natural tendency to set fairly conservative, low risk objectives. Whilst this may be entirely appropriate for organisations with a conservative attitude to risk (i.e. low risk appetite) it can inhibit thinking about those risks or situations that we may be able to exploit to exceed our objectives or achieve more challenging targets.
Think About the Positives
The key is when thinking about risk and undertaking risk management activities (for example when designing consequence ratings tables, setting objectives) think about whether there could be an upside as well as a down side from a future event. If there is, consider controls or strategies that might enable the organisation to capitalise on such situations should they arise as well as strategies or controls to minimise negative outcomes.
Avoiding risks is not the objective of risk management. In fact, risk management is an opportunity enabler. However, don’t take risks that are not well understood. Don’t take risks when the upside risk does not justify the downside risk. Understanding your objectives and both the potential upside and downside of risks will help organisations to be better prepared and hopefully make better decisions. Thinking about the upside can open people’s minds to the full range of potential outcomes from future events.