Avoid Fishy Risk Management
Gustavo Martin Herman
Global MBA | Multicultural Entrepreneur | Certified in Cybersecurity
Let’s start by making clear that this article is written for those who have not drank the risk-management “Kool-Aid.” It is intended for leaders in organizations who are laser-focused on increasing the bottom line, with a basic understanding of the implications of poor risk management. The goal is to leave you with a priceless (literally) perspective on the value and some key steps for smart risk taking.
Why “fishy.” Oxford Languages defines “fishy” as “relating to or resembling fish” and “arousing feelings of doubt and suspicion.” Let’s dovetail on both uses of the term:
-We might be naturally "wired" to minimize or ignore risk, just like fish in the ocean swim carelessly, without focusing on bigger fish that might eat them in a snap.
-We might not be sure that resources invested to manage risk are worth “the bang for the buck.”
Reflecting on these two angles, both make sense. Imagine the horrible existence of a fish living scared to dead, focusing all the time in the myriad of bigger fish swimming around them in search for food. Likewise, who can feel confident on the ROI of risk management, without good (and sometimes no) metrics.
In respect for your time, we’ll cut to the chase and jump straight into some key elements to potentially refine your risk management perspective for smarter risk taking.
Take risk metrics “with a grain of salt.”
Unless you have numbers to account for probabilities and impact (i.e. insurance incidence modeling or even poker), you should be very careful rating risk, and determining how much resources you invest to manage it. Just like in any other “investment”, you should approximate the ROI with relevant accuracy on known factors (precision should be less critical).
Avoid overreacting due to emotion or stress.
Emotion has been used effectively to manipulate behavior, from the “bogey man” to selling things. Make sure that your investment decisions on resources are objective, not based on emotion. If proactive enough, you should take time to consider the business implications. Do not decide “on the heat” of a simulation or reacting to a closed painful incident. Most importantly, understand who and why are you being pushed in any direction. Risk advice should be unbiased and free of conflicts of interest.
Follow through.
There is nothing worst that abandoning identified risks in “limbo.” Make sure somebody is accountable to follow up on implementation, testing, and maintenance, if more information is required, or if you decide to move forward. It is probably common to have initiatives “water down” or expire, until consequences become real or affect your business again.
Innovate.
Avoid “dusting off” outdated mechanisms to manage risk. Everything in the world is evolving rapidly. Make sure that your risk management coordinator is a motivated result-oriented leader with broad technical skill sets, guided by an extensive cross-cultural business acumen.