All organizations occasionally should stop and consider the risks and opportunities facing them, and discuss both mitigation options for the risks and exploitation options for the opportunity. There are many different ways of doing this, but one of the simplest frameworks is the tried and tested impact / probability matrix. What you do is list all possible risks (or opportunities) first in a small group. Every risk gets written down on a post it and posted on a wall or whiteboard, and then you start mapping them in a two dimensional chart that looks at every risk’s probability of occuring and the possible impact that it will have:
Impact can be calculated in many different ways, but should probably be a compound measure of at least the following qualitatively assessed properties: the cost of the risk (low, medium, high), the degree to which the risk reduces future options (low, medium, high), the differential in competition (does this risk affect only us – again low, medium, high) and the recovery effort needed (low, medium, high). All of these are related and overlapping, but the point is to fermize the impact over a couple of different concepts to ensure that you get a good sense of the risk.
The probability should be assessed by looking at percentages, but retaining the uncertainty in the percentages. One way of doing that is to define a risk interval within which you think the risk is situated with +75% likelihood. That is an intellectual kludge, but it allows you to paint the risk through that interval:
By doing this you have started to map the risks, and now you can add a matrix to the chart to classify the risks in different ways. One commonly used categorization is the following:
Now, the next thing you want to do is to take the risks in the upper right corner and organize them on two different dimensions – yield and effort. This step is often overlooked, but that is a mistake. If you really want to think through risks and opportunities you need to also think through your ability to impact and mitigate the risks. Once you organize them in that matrix you get something that looks like this:
Now, when you organize your risks in the following way you will see which ones you should start working on – and it is not the top right corner. The heroic risks attract a lot of attention, but if you do not start with the low effort, high yield risks you are making a strategic mistake. The low effort, high yield – the no brainers – is always what you should do first, and then you should prioritize according to yield effort and work through hard, operational and thankless risks before you even try your hand at the heroic risks. Often, addressing heroic risk requires a singular organizational focus and commitment. Do you have that? If not, create it before you try. The risks we are looking at in this quadrant are quests, with great payoffs but a ton of work!
This framework will get you some way towards thinking through risk in your organisation.