Q: What are some strategies I can use to evaluate risks when making decisions for my business?
A: I would make the argument that managers are mainly in the business of assessing and addressing uncertainties rather than risks.
The distinction here is that risks are measurable uncertainties and there are few situations where a manager has a large, credible and relevant amount of data to make projections of the potential impact of threats. Insurance companies and brokers can provide aggregated data on, say, workers' compensation claims providing insights into the contours of work-related injuries, but even then there is a high level of uncertainty as to whether these estimates accurately reflect your organization's experience. Remember: You are mainly in the uncertainty management business.
So how do we evaluate risks and uncertainties when there either is not much reliable data available? We have found that good managers need to realize that some things can be prevented or mitigated (fire insurance), and some things can be managed (safety procedures on the shop floor), but that mainly the manager's role is to create a resilient organization.
The orientation of an overall risk management strategy is to focus on an organization's resilience to surprises and the uncertain future. This flips the focus of thinking. We are not thinking about specific risks as much as we are focused on our positioning to respond and adjust to changing circumstances.
There are many views on how resilience is achieved. Just note that resilience reflects an organization's robustness, the presence of redundancies (backups), the capacity for resourcefulness, the speed of responses to events and recovery time.
Broadly, managers need to also "think about thinking." We say that managers need to find ways to introduce critical thinking into the process of analyzing risks and uncertainties. How might we be wrong? What information are we missing — what don't we know? What are our priorities in terms of addressing risks and uncertainties? In an important sense, risk management is mainly a way of thinking critically about the presence and impact of uncertainty on an organization.
Peter C. Young is the 3M Endowed Chair in International Business and a professor of risk management at the University of St. Thomas Opus College of Business.