Risk Management

High Risk, High Consequence?

By: | October 1, 2016

Joanna Makomaski is a specialist in innovative enterprise risk management methods and implementation techniques. She can be reached at [email protected].

Imagine you are a board member on a $200 million widget-making company. The risk manager has duly presented their quarterly risk register to you. You learn of two risks.

The first risk states there is a 1 percent chance that in any given year a rainfall could flood the factory costing an estimated $4.8 million in plant and employee injury damages, and loss of business. The company insurance policy excludes coverage for damages and loss of business due to flooding.

The second risk states there is a 90 percent chance that 24 company laptops worth $2,000 containing company information will go unaccounted for in any given year. Your insurance policy excludes coverage for mysterious disappearance of those assets.

I have three rules of thumb when it comes to risk response planning and investment.

Risk 1 has a low probability with sudden high consequences, while Risk 2 is a near-certain event with a comparably low unit consequence value. Both risks present a total expected loss of $48,000 for any given year. Risk management is looking for board guidance as to which risk to respond to first. Which risk captures your attention?

In recent conversation, a board member told me he felt that risk management often neglects high-consequence risks because of low likelihood, and that high consequence risks must be addressed regardless of their likelihood. He felt that most risks were inadequately selected, ranked and qualified.

He suspected risk management was only comfortable presenting risks that boards would perceive as manageable. Was he right?

Consider Risk 1. Did the register highlight the associated reputational losses and future opportunity losses? Did the register stress that embedded in the event was an employee injury?

If management re-evaluated the two risks to incorporate associated losses and the expected loss was yet again equal, which risk should take priority?

I have three rules of thumb when it comes to risk response planning and investment.

Rule 1: Address low-hanging fruit. Risk 2 has a 90 percent certainty of occurrence. It’s a matter of time. Let the register reflect this. The loss is almost a given and should be treated accordingly. If your company can influence the risk for a reasonable cost, just do it.

Rule 2: Deal with risk that can severely derail your operation. Ask how quickly the company could bounce back if the risk were to occur. Let your register reflect your answer.

Rule 3: Address risks that can exceed your capacity to bear risk. Know the level of loss you can handle any given year. Let your register reflect that. Does the company have the capacity to absorb flooding damage costs of $4.8 million any given year? If not, it needs your attention. Moreover, if this one risk has the ability to wipe out the company, it needs serious attention.

The prickly disconnect between management and boards seems to stem from how risks are reported. Easy fix: Let’s start there. &

More from Risk & Insurance