strategy

Tactical Risk

Tactical Risk Jonathan Poland

Tactical risk refers to the potential for losses due to changes in business conditions in real-time. Tactics differ from strategy in that they involve immediate, short-term actions taken in response to current conditions. In contrast, strategy is a long-term plan for achieving specific goals or objectives. Tactical risk is therefore associated with present threats and is focused on addressing immediate challenges rather than long-term conditions.

Tactical risk is an important consideration in risk management, as it involves addressing risks that are imminent or already occurring. This can involve developing and implementing strategies to mitigate or prevent these risks, as well as having contingency plans in place to respond to unexpected events. By effectively managing tactical risk, organizations can minimize the potential impacts of short-term disruptions and ensure that they are able to continue operating smoothly. The following are a few examples of tactical business risks.

Credit Risk
A bank extends an unsecured line of credit to a large electronics firm based on the company’s healthy financial condition. A few months later, the electronics company suddenly issues a press release saying that they have discovered unidentified accounting irregularities that will have a material impact to its financial condition. Based on the press release, the bank identifies the credit line as a high risk account and freezes it before more withdrawals can take place.

Market Risk
A farmer reconsiders plans to plant her fields with corn when prices drop on the futures market.

Information Technology Risk
A bank uses a series of network routers that are identified as having a major security vulnerability. They quickly develop a plan to address the vulnerability by rerouting traffic and patching the routers.

Competitive Risk
A solar panel manufacturer receives news that their biggest competitor is ready to commercialize a new type of solar cell that has a high conversion efficiency and is inexpensive to manufacture.

Marketing Risk
An airline releases a new ad campaign with a catchy slogan. A popular internet meme suddenly appears that makes fun of the slogan and suggests that the company has poor customer service. The company quickly ends the campaign in response.

Health & Safety Risk
A company is contacted by three employees from the same office location who say that they have been diagnosed with a communicable disease. The company quickly contacts all staff who work at the location to inform them of the situation and to ask that they work from home for the rest of the week.

Legal Risk
A concert promoter in Japan receives news that a typhoon is heading towards their outdoor summer event. The promoter decides to cancel the concert despite the high costs of refunding tickets in order to avoid legal risks associated with injuries from the typhoon.

Tactics vs Strategy
Tactics and strategy are both military terms. Military organizations primary view tactical risk as the conditions on a battlefield. An army may identify strategic risks before a battle but tactical risks can only be identified as they unfold.

Unknown Risk

Unknown Risk Jonathan Poland

An unknown risk is a potential loss that is not recognized or identified. In the context of risk management, unknown risks are those that have not been identified and managed as part of the risk management process. These risks may be difficult to predict or anticipate, and can have significant impacts on an organization if they occur.

Unknown risks can be particularly challenging for risk management, as they are not accounted for in risk assessments or management strategies. This can make it difficult for organizations to prepare for or respond to these risks effectively. To address unknown risks, it is important for organizations to have robust risk management processes in place to identify and assess potential risks, as well as to have contingency plans in place to mitigate their impacts.

Unknown Unknowns

An unknown unknown is the state of being unaware that a particular type of knowledge exists. For example, an investor who is unaware of the concept of liquidity may purchase the stock of a firm with a high debt load, negative cash flow from operations, rising cost of capital and other issues that make bankruptcy possible. Such an investor is exposed to a firm’s liquidity risk without knowing that such a concept exists.

Black Swans

Black swans are a class of high impact, low probability events that are difficult to predict. In some cases, low probability risks are excluded from risk management because they seem so improbable. However, events that are high impact may be a significant risk even if their probability is extremely low.

Risk Identification Shortfall

Risks may simply be missed by the process of risk identification. For this reason it is common to involve all stakeholders in risk identification and to bring in subject matter experts as required. For example, an information security expert may be required to identify risks to an information technology project.

Calculated Risk

Calculated Risk Jonathan Poland

Calculated risk is an essential concept in the field of risk management. It refers to the process of carefully assessing and evaluating risks in order to make informed decisions about whether or not to take those risks.

There are many factors that go into calculating risk, including the potential consequences of a particular action or decision, the likelihood of those consequences occurring, and the potential benefits and drawbacks of taking the risk. By considering these factors, individuals and organizations can determine the level of risk they are willing to take and make informed decisions about whether or not to proceed with a particular action.

Calculated risk is an important concept in a variety of industries, including finance, insurance, and business. It is also relevant to personal decision-making, such as when individuals are deciding whether or not to invest in stocks or take out a loan.

In order to effectively calculate risk, it is important to use a systematic and structured approach. This may involve using tools such as risk assessment matrices or decision trees to analyze the potential risks and benefits of a particular action. It is also important to continually monitor risks and adjust risk management strategies as necessary.

In conclusion, calculated risk is a critical component of effective risk management. By carefully assessing and evaluating risks, individuals and organizations can make informed decisions about whether or not to take those risks and can implement strategies to effectively manage and mitigate those risks.

Here are some examples of calculated risks:

  1. Investing in stocks: When an individual decides to invest in stocks, they are taking a calculated risk. They must consider the potential returns and the risk of losing money.
  2. Starting a business: Starting a business involves taking a calculated risk. Entrepreneurs must consider the potential costs and benefits of starting a business and the likelihood of success.
  3. Taking out a loan: When an individual takes out a loan, they are taking a calculated risk. They must consider the potential benefits of using the loan, as well as the risk of not being able to repay the loan and the potential consequences of default.
  4. Going on a long distance hike: When an individual decides to go on a long distance hike, they are taking a calculated risk. They must consider the potential dangers and challenges of the hike, as well as the potential benefits and enjoyment of the experience.
  5. Pursuing a career in a competitive field: When an individual decides to pursue a career in a competitive field, they are taking a calculated risk. They must consider the potential rewards and opportunities in their chosen field, as well as the risk of not being able to find employment or succeed in their career.

Risk Monitoring

Risk Monitoring Jonathan Poland

Risk monitoring is the ongoing process of keeping track of risks and managing them effectively. The risk management process often begins with identifying risks, determining how to address them, and implementing controls to mitigate those risks. Risk monitoring involves regularly evaluating the effectiveness of these risk management efforts and identifying any new risks that may arise. It is an essential part of ensuring that risks are effectively managed over time. The following are common elements of risk monitoring.

Risk Identification
The continuing process of identifying new risks.

Risk Analysis
Ongoing analysis of risk probability, impact, treatment options and other factors such as moment of risk.

Risk Controls
Monitoring the implementation of risk controls such as risk mitigation processes.

Measurement & Communication
Measuring current risk exposure and communicating risk information to stakeholders. This may include regular reviews.

What is Risk Communication?

What is Risk Communication? Jonathan Poland

Risk communication involves informing people about potential hazards and the steps that can be taken to prevent or mitigate those risks. This process can include providing warnings, disclosing information, and engaging in two-way communication to effectively manage and address risk. The following are illustrative examples.

Disasters
A government agency calculates the risk of an earthquake based on the frequency of historical earthquakes in a region. They regularly communicate the risks to the public in a variety of media in order to encourage preparation such as earthquake resistant construction.

Health
A product that is known to be unhealthy is required to display a warning on its label in a particular country, province or state.

Environment
A city warns of forecast poor air quality and communicates restrictions put in place to mitigate the situation.

Safety
A construction company conducts mandatory annual safety training for all employees that includes a breakdown of the most common safety risks related to different types of construction sites. Training is aimed at creating awareness of common risks and communicates actions that can be taken to reduce risk.

Financial Risk
A financial advisor accurately communicates investing risks to clients including factors such as volatility, liquidity risk, concentration risk and the risk profile of an asset or security.

Project Risk
A project manager communicates a risk management plan to stakeholders. All stakeholders are given an opportunity to identify risks and provide ideas for reducing risk. Risk owners are asked to sign off on the risk management plan. As new risks are identified, the process repeats.

Business Risk
A purchasing manager at a manufacturing company warns operations and marketing teams of a possible shortage of parts due to supply chain disruptions.

Moment of Risk
A telecom company warns its corporate customers of maintenance to network infrastructure that may impact performance or result in downtime.

Risk Prevention

Risk Prevention Jonathan Poland

Risk prevention is the process of identifying, assessing, and mitigating potential risks that may arise in a given situation. It is an important aspect of any organization or individual’s operations, as it helps to minimize the potential negative impact of risks on the organization or individual’s goals and objectives.

There are several approaches to risk prevention, including the following:

  1. Risk assessment: This involves identifying and analyzing potential risks, as well as their likelihood and impact. This helps to prioritize risks and determine the appropriate actions to take.
  2. Risk control: This involves implementing measures to minimize the likelihood or impact of identified risks. This could include measures such as installing safety equipment, developing policies and procedures, or training employees.
  3. Risk communication: This involves informing relevant parties about identified risks and the measures being taken to mitigate them. This could include communicating with employees, customers, or regulatory agencies.
  4. Risk monitoring: This involves regularly reviewing and updating risk prevention measures to ensure that they are effective and up-to-date.

Effective risk prevention requires a proactive approach, as well as the involvement of all relevant parties. It is important for organizations and individuals to regularly review and update their risk prevention measures to ensure that they are effective in minimizing potential risks.

Risk prevention and risk management have the same basic goals and methods. The term risk prevention is more often used in fields where risk has distinctly negative connotations such as in health, safety and crime prevention. The term risk management is used when risk has both positive and negative connotations such as in business and investing. For example, the terminology “risk prevention” isn’t appropriate for an investment bank because some level of risk taking is required to put capital to work and produce value.

Risk Identification
The process of identifying the risks associated with a strategy, decision, process, procedure, event or action.

Risk Analysis
Determining the probability, impact and triggers of identified risks.

Risk Avoidance
Altering your strategies, decisions, processes, procedures, products or actions to avoid a risk. For example, a firm that reformulates its products to remove hazardous ingredients that represent a health and safety risk to workers.

Risk Reduction
Taking steps to reduce the probability or impact of a risk. For example, a doctor who starts a patient on a low dose of a new medication to reduce the probability and impact of an adverse reaction to the medicine.

Risk Contingency
Planning what you will do if the risk occurs in order to reduce its impact. For example, tsunami shelters and evacuation procedures.

Risk Minimization
Risk minimization is the process of reducing the probability and/or impact of a risk as low as possible. This can be expensive. For example, it may cost $10 to reduce a risk by 95% but $400,000 to reduce a risk by 99.8%. For this reason it is rare to use the word “minimize” in the context of risk management. However, some risks are minimized whatever the cost. For example, the design of an aircraft may seek to minimize the probability of an aircraft accident.

Secondary Risk
A secondary risk is a risk that occurs due to your efforts to reduce risk. For example, if you have surgery to reduce the risk of a heart attack, the risks associated with the surgery itself are secondary risks.

Residual Risk
Residual risk is the risk that remains after your efforts to treat risk. Generally speaking, risks aren’t “prevented” but are reduced as residual risk usually remains even if you attempt to minimize risk.

Risk Response

Risk Response Jonathan Poland

Risk response is the process of addressing identified risks in order to control or mitigate their impact. It is an integral step in the risk management process and involves making decisions about how to address each identified risk. This planning and decision-making process involves stakeholders deciding on the most appropriate course of action for each risk.

Risk response can involve taking steps to eliminate the risk, reduce its likelihood or impact, transfer the risk to another party, or accept the risk. The chosen response should be based on an assessment of the potential costs and benefits of each option, as well as the organization’s risk tolerance and capacity. By effectively responding to identified risks, organizations can minimize the impact of potential negative events and maximize their chances of success. The following are the basic types of risk response.

Avoid
Change your strategy or plans to avoid the risk.

Mitigate
Take action to reduce the risk. For example, work procedures and equipment designed to reduce workplace safety risks.

Transfer
Transfer the risk to a third party. For example, purchase fire insurance for an unfinished building.

Accept
Decide to take the risk. Generally speaking, all strategies and plans involve some level of risk. Risk also has a relationship with reward whereby reducing risk towards zero can also reduce potential payback.

Share
Distributing the risk across multiple partners, teams or projects. For example, four projects each have a software architect and each identifies the risk that the software architect is a critical resource. They decide to share the risk by pooling the software architects into a team that provides a service to all four projects. If one architect quits, the service can be continued.

Contingency
Making plans to handle the risk if it occurs. For example, back-out procedures that can restore a system if a launch fails.

Enhance
Enhancement is a response for a positive risk. Project management methodologies may view finishing a task early or under budget as a positive risk. Enhancement is an action that is taken to increase the chance of the risk occurring.

Exploit
Another treatment for positive risks. Exploiting a risk is to make use of resources that become available if the risk occurs. For example, if a task finishes early, you plan to reassign the resource to more work.

Risk Mitigation

Risk Mitigation Jonathan Poland

Risk mitigation is the process of identifying, analyzing, and taking steps to reduce or eliminate risks to an individual or organization. It is an important part of risk management, as it helps to minimize the impact of potential risks and maximize the chances of success. There are several strategies that can be used to mitigate risk, including implementing controls, conducting risk assessments, developing contingency plans, and insuring against potential losses. It is important to consider the potential costs and benefits of each risk mitigation strategy in order to determine the most effective and efficient approach.

One important aspect of risk mitigation is communication. It is crucial to keep stakeholders informed about potential risks and the steps being taken to address them. This can help to build trust and confidence in an individual or organization, and can also help to identify additional risk mitigation opportunities. In addition to these strategies, it is important to regularly review and update risk mitigation plans in order to ensure that they remain effective over time. This may involve reassessing the likelihood and impact of potential risks, as well as the effectiveness of the risk mitigation measures in place.

Overall, risk mitigation is an important part of successful risk management, and can help to ensure the long-term success and stability of an individual or organization. The following are general types of mitigation technique, each with an example.

Audits
Regular audits may identify problems such as accounting errors or security vulnerabilities before they become larger problems. Audits can be used both as a process of risk identification and mitigation. For example, accounting audits are a way to reduce the risk of financial fraud.

Backups
Backing up business information in multiple secure physical locations.

Business As Usual
Continuing with normal operations in the face of extraordinary events.

Communication
Communicating a risk may serve to reduce it. For example, if a bank has identified a particular type of fraud as a risk, communicating it to front line managers may help to prevent it.

Contingency Plans
Planning for critical situations such as natural disasters or security incidents can reduce the impact of such events should they occur.

Diversification
The process of allocating your capital and resources in diverse areas to reduce risk and volatility. For example, a company that sells 100 products in 12 different categories will typically have more stable revenue than a company with a single product.

Due Diligence
Due diligence is the process of investigation before committing to something such as a contract or strategy. Basic due diligence such as checking the financial, environmental, corporate social responsibility and management practices of a potential partner is a basic step in risk reduction that is often considered a legal obligation.

Equipment
Equipment designed to mitigate risks such as safety gear for construction.

Ergonomics
Ergonomics is the design of products to suit human cognitive and physical characteristics. It is considered a tool of risk mitigation such as preventing the risk of repetitive strain injuries with well designed furniture and equipment.

Error Handling
Designing systems so that errors are handled in such a way that processes, automation and user interfaces remain functional. Historically, systems were often designed to immediately halt upon finding any type of error. This is an unacceptable business risk in many scenarios. Well designed modern systems are designed to work around errors as far as possible.

Error Tolerant Design
User interfaces that prevent human error from having serious consequences. For example, a car may be designed not to let you put it into reverse when you’re moving forward.

Facilities
In some cases entire facilities are built to mitigate risks. For example, a data center may be built to reduce security related risks.

Graceful Degradation
Machines and systems that are designed to keep working with limited functionality when they are damaged or lose resources such as an internet connection. Important to the safety of equipment such as aircraft.

Infrastructure
Infrastructure such as computing, network and communication equipment may be used to reduce business risks. For example, equipment that is designed to handle security threats such as denial of service attacks.

Maintenance
Maintenance such as applying patches to software.

Measure And Reduce
The first step in risk mitigation is typically to find a way to measure a risk. Once a framework for measuring risks is in place, business strategies and day to day operations can work to reduce risk. For example, measurements of financial risk such as value at risk can be used to make investment choices that reduce risk.

Mistake Proofing
Designing systems, equipment, processes and procedures to reduce risks associated with human error. For example, aircraft maintenance tools may be kept in special cases that make it obvious if a tool is missing. Each maintenance typically involves a check to see that all tools are accounted for to prevent a forgotten tool from damaging an engine on takeoff.

Performance Management
Setting risk reduction goals as part of performance management.

Policies
Policies designed to reduce risk such as safety procedures at a construction site.

Process Control
Controls built into processes such as approvals designed to reduce financial risks.

Process Improvement
Process improvements such as automating steps to reduce errors.

Redundancy
Redundancy is the practice of eliminating single points of failure by having two or more of each critical resource. For example, a company with 2,000 employees who all work out of a single location might consider having at least two geographically distributed offices to mitigate risks such as an infrastructure failure or a disaster that strikes a location.

Scalability And Capacity
Building enough capacity and ensuring that you can scale to meet business volumes. For example, hiring enough customer service representatives so that you have ample capacity when an unexpected number of staff call in sick.

Standards
Establishing standards to guide business practices, decision making and design. For example, a technical security standard can reduce security risks if applied to all technology projects.

Subject Matter Expert
A subject matter expert is an authority in a particular business, technical or scientific domain. Review of decisions, designs and implementations by experts can reduce risks. For example, having a workplace safety expert review your work processes to implement improvements may reduce health and safety risks.

Supplies
Storing supplies to reduce the impact of a risk. For example, extra parts for a critical machine may reduce operational risks if such parts take a long time to procure from a supplier.

Testing
Testing such as product or system testing is a core risk mitigation technique. For example, properly testing the quality of a system will reduce the risk that it will fail at launch.

Training
Training such as compliance training for employees designed to reduce compliance and reputational risks.

Validation
Validation of information before it is accepted by systems and processes. For example, validating user input in an expense management tool may reduce the risk of accounting errors.

Verification
Verifying information with authoritative information sources. For example, verifying the information on a mortgage application may reduce credit risk.

Risk Reduction

Risk Reduction Jonathan Poland

Risk reduction involves the use of various methods to minimize or eliminate risk exposures. This can be done by decreasing the likelihood of a risk occurring, or by reducing the potential impact of the risk if it does occur. These efforts are often tailored to the specific risk tolerance of an individual or organization.

There are many ways to reduce risk. Here are a few examples:

  1. Implementing safety procedures and protocols: This can help prevent accidents or injuries in the workplace, for example.
  2. Using protective equipment: Wearing helmets, gloves, and other protective gear can help reduce the risk of injury in certain activities.
  3. Diversifying investments: Spreading investments across a range of asset classes can help reduce the risk of financial losses.
  4. Insuring against potential losses: Insurance can provide financial protection against a variety of risks, such as property damage, liability, and loss of income.
  5. Conducting risk assessments: Identifying and analyzing potential risks can help organizations take proactive measures to prevent them from occurring.
  6. Developing contingency plans: Having a plan in place to address unexpected events can help reduce the impact of those events on an individual or organization.
  7. Implementing controls: Controls, such as security measures or quality control procedures, can help reduce the likelihood of risks occurring.

Risk Avoidance
Avoiding an activity or position that may cause risk. For example, a business may decide that a new product strategy is too risky to pursue.

Risk Mitigation
Pursuing an activity but finding ways to reduce its associated risks. For example, an amusement park can mitigate safety risks by eliminating latent human error in their maintenance procedures.

Risk Transfer
Paying to transfer risks to an insurance company or business partner.

Risk Sharing
Finding ways to reduce risks by pooling resources with others. For example, a group of companies may reduce the risk of losing key executives by planning to transfer resources on a temporary basis in the case of an unexpected loss.

Customer Satisfaction Jonathan Poland

Customer Satisfaction

Customer satisfaction is the practice of measuring how happy customers are with a brand’s products and services. This is typically…

Product Benefits Jonathan Poland

Product Benefits

A product benefit is the value that a customer derives from a product or service. It is what makes the…

Taxes Jonathan Poland

Taxes

Taxes are mandatory financial contributions that are levied by a government on individuals, businesses, and other organizations. The money collected…

Barriers to Entry Jonathan Poland

Barriers to Entry

Barriers to entry refer to factors that make it difficult for new companies to enter a particular market. These barriers…

Product Features Jonathan Poland

Product Features

A product feature is a characteristic or aspect of a product that contributes to its overall functionality and performance. Product…

Attention Economics Jonathan Poland

Attention Economics

Attention economics is a field of study that focuses on the value of human attention as a limited and highly…

Substitution Pricing Jonathan Poland

Substitution Pricing

A substitution price is the price at which a customer will choose to switch to a different product or service…

Business Ethics Jonathan Poland

Business Ethics

Business ethics refer to the principles and values that guide the behavior of individuals and organizations in the business world.…

Progress Trap Jonathan Poland

Progress Trap

A progress trap is a situation where a new technology, which has the potential to improve life, ends up causing harm due to a lack of risk management.

Learn More

Inherent Risk Jonathan Poland

Inherent Risk

Inherent risk is a term used in the field of auditing to describe the risk that a company’s financial statements…

Lead Generation Jonathan Poland

Lead Generation

Lead generation is the process of identifying and attracting potential customers for a business. This is typically the first step…

Channel Pricing Jonathan Poland

Channel Pricing

Channel pricing refers to the practice of setting different prices for a product or service depending on the sales channel…

Comparative Risk Jonathan Poland

Comparative Risk

Comparative risk is a method of evaluating and comparing the potential impacts and likelihood of different risks. It is used…

Everyday Low Price Jonathan Poland

Everyday Low Price

Everyday low price, commonly abbreviated as EDLP, is a pricing strategy in which a retailer offers its products at a…

Product Knowledge Jonathan Poland

Product Knowledge

Product knowledge refers to the ability to effectively communicate information and answer questions about a product or service. This knowledge…

Rental Lease 101 Jonathan Poland

Rental Lease 101

In general, a rental lease is a contract between a landlord and a tenant that outlines the terms and conditions…

Environmental Challenges Jonathan Poland

Environmental Challenges

Environmental issues are detrimental changes to the Earth’s natural surroundings that negatively impact the current quality of life for individuals…

Payback Theory Jonathan Poland

Payback Theory

Let’s say you live in a town with two bakeries for sale at $1 million each. Both offer similar products…