Risk 101

Risk 101

Risk 101 Jonathan Poland

Risk evaluation is a crucial component of the risk management process. It involves assessing the potential impact and likelihood of identified risks to determine their significance. This evaluation helps organizations prioritize risks and allocate resources effectively to manage them. Let’s delve deeper into the topic:

Purpose of Risk Evaluation:

  • Prioritization: By evaluating risks, organizations can prioritize them based on their potential impact and likelihood. This ensures that the most significant risks are addressed first.
  • Resource Allocation: Once risks are prioritized, organizations can allocate resources (like time, money, and personnel) more effectively to manage these risks.
  • Informed Decision Making: Risk evaluation provides decision-makers with a clearer picture of the potential threats and opportunities, allowing them to make informed decisions.

Steps in Risk Evaluation:

  • Risk Identification: Before you can evaluate risks, you need to identify them. This involves recognizing potential threats and opportunities that could affect the achievement of objectives.
  • Risk Assessment: This step involves determining the likelihood and potential impact of the identified risks. It’s often done using qualitative or quantitative methods.
  • Risk Ranking: Based on the assessment, risks are ranked. This helps in understanding which risks need immediate attention.
  • Determine Risk Tolerance: Organizations need to determine their risk tolerance, which is the amount of risk they are willing to accept. Any risk that exceeds this tolerance level needs to be addressed.

Methods of Risk Evaluation:

  • Qualitative Analysis: This method involves describing risks in terms of their potential severity and likelihood using descriptive terms like “high,” “medium,” or “low.”
  • Quantitative Analysis: This method uses numerical values to represent risk. It might involve statistical data, financial values, or other measurable metrics.

Outcome of Risk Evaluation:

Once risks are evaluated, organizations can decide on the appropriate risk response strategies, such as:

  • Avoidance: Eliminating the risk by discontinuing the associated activity.
  • Mitigation: Reducing the impact or likelihood of the risk.
  • Transfer: Shifting the risk to another party, like through insurance.
  • Acceptance: Acknowledging the risk and preparing to deal with its consequences.

Review and Monitoring:

Risk landscapes are dynamic, and new risks can emerge while existing ones can change in their significance. Hence, continuous monitoring and periodic reviews of the risk evaluation are essential. Risk evaluation is a foundational step in the risk management process. It ensures that organizations are aware of their risk landscape and can take appropriate actions to manage those risks effectively.

Risk Management

Risk management strategies are formulated based on the outcomes of risk evaluations. The goal is to address the identified risks in a manner that aligns with the organization’s objectives, risk appetite, and available resources. Here’s a step-by-step breakdown of how risk management strategies are formed using risk evaluations:

Understand the Risk Context:

Before forming strategies, it’s essential to understand the broader context in which the organization operates. This includes its objectives, stakeholders, regulatory environment, and other relevant factors.

Use the Risk Evaluation Outcomes:

The results from the risk evaluation (i.e., the ranking and assessment of risks based on their likelihood and impact) provide a foundation for strategy formulation.

Determine the Organization’s Risk Appetite:

Risk appetite is the level of risk an organization is willing to accept in pursuit of its objectives. It acts as a guidepost for strategy formulation. Risks that exceed the organization’s risk appetite will need more aggressive management strategies.

Select Appropriate Risk Response Strategies:

Based on the risk evaluation and the organization’s risk appetite, one or more of the following risk response strategies can be chosen:

  • Avoidance: This strategy involves not taking or discontinuing an action to avoid the risk altogether. For instance, if a business venture is deemed too risky, the organization might decide not to pursue it.
  • Mitigation: This involves taking steps to reduce the likelihood or impact of a risk. For example, implementing safety protocols can mitigate the risk of workplace accidents.
  • Transfer: Some risks are best managed by transferring them to another party. This is commonly done through insurance or contractual agreements. For instance, a company might take out insurance against natural disasters.
  • Acceptance: If a risk is deemed acceptable based on its likelihood and impact (and considering the organization’s risk appetite), it might be accepted without any specific action. However, contingency plans might be put in place to address the consequences if the risk materializes.
  • Exploitation: In cases where the risk presents an opportunity, strategies might be formulated to exploit the situation. For instance, if there’s a potential market disruption, a company might strategize to capitalize on it.

Develop and Implement Action Plans:

Once the appropriate strategies are selected, specific action plans are developed. These plans detail the steps to be taken, resources required, responsibilities, timelines, and monitoring mechanisms.

Continuous Monitoring and Review:

The risk environment is dynamic. As such, it’s essential to continuously monitor the identified risks and the effectiveness of the management strategies. Adjustments to the strategies might be needed based on changing circumstances.

Communication and Reporting:

Effective communication is crucial. Stakeholders, including employees, management, and external parties, should be informed about the risks and the strategies in place. Regular reporting ensures transparency and accountability.

Forming risk management strategies is a systematic process that leverages the insights gained from risk evaluations. The strategies are designed to align with the organization’s objectives and risk appetite, ensuring that risks are managed in a way that supports the organization’s goals.

Monitoring & Review

The monitoring and review phase is a continuous and integral part of the risk management process. It ensures that the risk management strategies remain effective and relevant in the face of changing circumstances. Here’s a detailed look at this phase:

Purpose of Monitoring and Review:

  • Ensure Effectiveness: To confirm that the risk management strategies and actions are working as intended.
  • Detect Changes: To identify new risks or changes in existing risks due to shifts in the internal or external environment.
  • Continuous Improvement: To refine and enhance the risk management process based on feedback and lessons learned.

Key Activities in the Monitoring and Review Phase:

  • Regular Check-ins: Scheduled reviews of the risk management plan to ensure its relevance and effectiveness. This could be monthly, quarterly, or annually, depending on the nature of the risks and the organization’s context.
  • Performance Indicators: Using Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) to measure and track the effectiveness of risk responses and the status of risks.
  • Audit and Assurance: Internal or external audits can provide an independent assessment of the risk management process, ensuring that it aligns with best practices and regulatory requirements.
  • Stakeholder Feedback: Engaging with stakeholders, including employees, customers, and partners, to gather feedback on the perceived effectiveness of risk management activities.
  • Incident Reporting: Establishing a system for reporting and analyzing incidents related to risks. This helps in understanding the root causes and can lead to refining risk management strategies.

Adjusting Strategies:

  • Refinement: Based on the insights from monitoring and review, risk management strategies might need adjustments. This could involve strengthening certain controls, introducing new measures, or even relaxing controls if a risk level decreases.
  • Re-evaluation: If significant changes are detected in the risk landscape, it might be necessary to revisit the risk evaluation phase to reassess the impact and likelihood of risks.

Documentation and Reporting:

  • Maintain Records: Keeping detailed records of monitoring and review activities, findings, and actions taken. This provides an audit trail and can be valuable for future risk assessments.
  • Report Findings: Regularly reporting the outcomes of monitoring and review activities to relevant stakeholders, including senior management and the board. This ensures transparency and keeps decision-makers informed.

Continuous Learning:

  • Lessons Learned: Capturing and analyzing lessons from both successful risk management and instances where risks weren’t managed effectively. This contributes to the organization’s knowledge base and helps in refining future strategies.
  • Training and Development: Based on the findings from the monitoring and review phase, there might be a need for additional training or development programs to enhance the organization’s risk management capabilities.

The monitoring and review phase is not a one-off activity but a continuous loop. It ensures that the risk management process remains dynamic, responsive, and effective in managing risks in a changing environment. It’s the mechanism that ensures the organization’s risk management approach remains proactive rather than reactive.

Learn More
Quality Management Jonathan Poland

Quality Management

Quality management is a process that ensures products and services meet certain standards of quality before they are released to…

Ideation Jonathan Poland


Ideation is the process of generating ideas and solutions to problems. It is a crucial step in the creative process,…

Best Industries for Selling B2G 150 150 Jonathan Poland

Best Industries for Selling B2G

The best industries for companies that want to acquire a government contract or grant are those that are aligned with…

Root Cause Analysis Jonathan Poland

Root Cause Analysis

Root cause analysis (RCA) is a method of identifying the underlying causes of a problem or issue in order to…

Employee Engagement Jonathan Poland

Employee Engagement

Employee engagement is a measure of how motivated, committed, and involved an employee is in their work. Research has shown…

Original Research Jonathan Poland

Original Research

Original research refers to the creation of new knowledge through the investigation of a topic or problem. This can involve…

Customer Experience 101 Jonathan Poland

Customer Experience 101

Customer experience (CX) refers to the overall experience that a customer has with a company or brand, from their initial…

Dispute Risk Jonathan Poland

Dispute Risk

Dispute risk refers to the potential for a disagreement or conflict to arise in a business context, resulting in negative…

Accept vs Except Jonathan Poland

Accept vs Except

To accept is to consent, to receive or to believe something. Except means “not including.” Accept: to consent, to receive,…

Content Database

Search over 1,000 posts on topics across
business, finance, and capital markets.

Contract Awards Calendar 150 150 Jonathan Poland

Contract Awards Calendar

Governments around the world typically follow a structured and organized process for awarding contracts to suppliers, contractors, and service providers.…

Geographic Segmentation Jonathan Poland

Geographic Segmentation

Geographic segmentation is a marketing strategy that involves dividing a target market into smaller groups based on geographical characteristics such…

Business Assets Jonathan Poland

Business Assets

In business, assets are useful property that are owned by the company. These assets can be divided into three categories:…

Sales Metrics Jonathan Poland

Sales Metrics

Sales metrics are commonly used to assess the performance of a sales team or individual salesperson. These metrics can be…

Research Types Jonathan Poland

Research Types

Research is the process of systematically seeking and interpreting knowledge through inquiry, observation, experimentation, and analysis. It is a way…

Lobbying Jonathan Poland


Vertical integration is when a single company owns multiple levels or all of its supply chain.

Target Costing Jonathan Poland

Target Costing

Target costing is a cost management approach that involves setting a target cost for a product or service and then…

Risk Exposure Jonathan Poland

Risk Exposure

Risk exposure refers to the potential costs that an organization could incur as a result of a particular risk or…

Customer Need Examples Jonathan Poland

Customer Need Examples

Customer needs refer to the specific desires or requirements that a customer has for a product or service. These needs…