Sounds pretty obvious but some organisations still don't get the connection between proactive risk management and achievement of company objectives. As mentioned in an earlier post, risk definitions are many and varied but they all have the same general theme - uncertainty of outcomes that can have a positive or negative effect on objectives.
So where do risks come from? What generates risks to the organisation?
It is said that risk arises when there is a change in the environment in which an organisation operates or the organisation is out of line with the value demands of its stakeholders. Therefore we have two sources of risk - those generated externally to the organisation and to which management must respond, and those whose origins emanate from within the company itself.
Appropriately managing both of these sources of risk is critical. Why? Because organisations need resources (people, equipment, financing, partnerships etc) to achieve their objectives and unmanaged risks make it difficult for organisations to secure these resources.
Not all risks are created equal so we can break them down into categories to further understand their nature. Broadly, these are 'Dynamic' versus 'Static' risks and 'Speculative' versus 'Pure' risks.
Dynamic Risks:
These risks arise from the external environment - for example, economic conditions, the operations of the financial markets, competitor initiatives and customer preferences. It's managements job to respond to these risks in a way that creates value for the organisation (or at least minimises losses).
Static Risks:
Whilst not related to the organisations operating environment, these risks can and often are externally generated. Natural disasters or frauds are examples of static risks - they occur on a semi-regular basis.
From these examples, it can be seen that static risks lend themselves to being an insurable risk whereas dynamic risks are not insurable (but may have other risk treatments which we'll discuss in a future post).
Speculative Risks:
Are just what the title suggests - a manager speculates that an initiative will provide a gain for the business, but there is also the possibility of a loss. Another example is a gambler who speculates that they will pick a winner but could clearly walk away out of pocket.
Pure Risks:
A pure risk on the other hand has only two possibilities - a loss or no loss. Think about the possibility of a company building being affected by fire - it will either happen or it won't.
As per the Dynamic / Static relationship, Pure risks are generally insurable (car insurance, building insurance etc) whilst Speculative risks tend not to be insurable.
Historically, risk management has focussed almost exclusively on Pure / Static risks - that is, it has largely been a discussion about having appropriate insurance coverage.
Risk Management in the modern era has to be different - speculative risks are where value can be created for the organisation so management of these opportunity risks is at least as important as the more traditional exposure risks.
There is no choice - organisations who want to survive in the long term must manage risk!