Risk Management: A Definition, a Framework, and More
From checking the weather report to looking both ways before crossing the street, we partake in risk management every day.
These processes are a near-unconscious part of life, and it’s really not so different for businesses. Just like individuals, organizations must contend with threats around them, both in the marketplace and in the world in general.
That’s where risk management comes in. Risk management is the discipline of identifying, analyzing, and responding to potential threats that could impact capital, earnings, or strategic goals.
But of course, it’s not quite that simple. Risk management is complicated, but if you’re just getting started, we’ve got your back. Keep reading for a definition of risk management, why it matters, types of risks to account for, and the typical risk management process.
A definition of risk management
The business world (just like the rest of the world) has always been full of risk. But factors like globalization, climate change, and the accelerating pace of technological advancement have made risk management more important than ever. The COVID-19 pandemic is the perfect example of a huge, complex risk that posed an existential threat to businesses everywhere.
This has led to a shift away from traditional risk management to a newer, holistic model referred to as Enterprise Risk Management (ERM). In the old model, risks were classed according to their related business functions and managed separately. For example, a potential economic downturn might be handled by the CFO, and the shift away from television advertising towards social media would be the terrain of the marketing department.
Enterprise Risk Management looks at all risks together, examining how they interact and could potentially impact the business as a whole. Then, companies using ERM can take a proactive, integrated approach to manage them.
The risk management process
In general, the risk management process can be broken down into five main steps. While these basic elements of risk management remain the same, how exactly organizations approach them will be informed by their risk tolerance and the specifics of their industry and audience.
The five step risk management process
- Identify possible risks across categories and business functions.
- Investigate, research, and analyze the likelihood of each risk and their potential impact.
- Prioritize risks in order of urgency and relation to business goals. For example, if customer experience is a priority, a business might first act on risks affecting that area.
- Take action to mitigate, manage, or respond to each risk.
- Monitor the outcome of risk management efforts, and readjust as needed.
Risk management can be undertaken as a top-down or bottom-up process. To manage risk from the top down, teams would start with the organization’s most important functions or processes, then investigate possible threats that could impact them. Bottom-up risk management would start from the potential dangers themselves, like extreme weather or COVID-19, and then look into how they could potentially affect the business.
Risk across industries
The financial sector is often the first industry to come to mind in relation to risk management. In this field, risks are easier to quantify because they tend to be, well, financial — numerical values that express the risk inherent in borrowing, lending, or investing money in order to turn a profit.
But every business can benefit from risk management, no matter what industry they’re in. Here are common types of business risk that all organizations might run into:
- Reputational risk: Anything that could draw negative attention to the business, such as negative media coverage, lawsuits, or bad customer experiences.
- Operational risk: Events that prevent a business from being able to operate normally. These could originate internally (think staffing issues or technical problems) or externally (accidents and natural disasters).
- Compliance risk: These risks arise from failing to adhere to laws, rules, and regulations. These could be industry-specific, such as worker safety regulations, or doctor-patient confidentiality. They can also be more general, such as needing a business licence or tax registration number.
- Security risk: The risk of leaking or compromising sensitive information. This could be customer information, such as credit card details, or sensitive information from inside the company. This can also reflect physical security risks, like the chance of a break-in.
- Financial risk: Financial risks don’t just affect the financial sector. These risks can stem both from lending out money, or from debt carried by a company itself.
The Harvard Business Review’s risk management framework
Risk is inherently complex and difficult to plan for, so it’s difficult to classify into just a few categories. Harvard Business Review has created a new framework for understanding risks that is both broader and more action-oriented than the above categories. In this system, there are three types of risk:
- Preventable risks: These are risks coming from within the organization, which can be avoided through rules and regulations, such as safety rules or an employee code of conduct.
- Strategy risks: Calculated risks taken on intentionally for the potential of gain. Most financial risk taken on by lending institutions would fall into this category.
- External risks: Risk coming from outside the company, which can’t be controlled at all, only planned for or responded to. An example would be natural disasters.
Communicating risk
It doesn’t matter how hard risk management teams work — without an effective way to share their information, insights, and suggestions, companies can’t take meaningful action to manage risk.
Risk reports are the answer, providing an easily accessible format for risk management teams to report their findings. Risk reports make it easy for stakeholders, leaders, and or anyone involved in the business to make informed decisions about how to account for and react to risk.
Risk reports should include the data or information that demonstrates the existence of the risk, as well as their relation to, and potential impact on, important business functions and objectives.
Then, they should include suggested actions or steps that could be taken to reduce, respond to, or mitigate the risk. Depending on how the risk management team is structured within the company, this could be the plan they’ve already decided to move ahead with or suggestions for the C-suite or board of directors to consider.
Not sure where to start? Try the risk report templates we built for Trello and Notion.
Get ready for risk
By now, you have a clear idea of what risk management is, and how companies can use it to ensure they keep thriving, no matter what the future may bring.
Remember, risks are inevitable — it’s how we plan for and respond to them that counts. It’s a risky world out there, but with some careful risk management techniques, that’s nothing to be afraid of.