Every decision takes us into a future of opportunity and danger. To move forward with confidence, we need to get to grips with risk and uncertainty

Making decisions

In business, we're making decisions at every turn. Some are hugely significant, while others relate to day-to-day issues. Each decision has many possible outcomes: some good, some bad, some indifferent. A new product may succeed or fail. A new staff member may do well or badly. If we join a project, it may boost our career or result in extra work.

To make better decisions, we need to understand risk. This means getting to grips with the probability and impact of the possible outcomes of a decision to choose the best alternative.

Why take the risk?

The word 'risk' carries the connotation of danger, and risk management often focuses on avoiding problems. But every cloud has a silver lining, and risks often have potential upsides too.

Taking risks is the only way to realise opportunities. When we talk about things being 'risky', we usually mean that we don't know what will happen.

We often feel that 'risky' situations are inherently bad, because we are biologically 'hardwired' to avoid situations that might involve loss.

To maximise business opportunities, we have to be able to work with uncertainty, rather than trying to avoid it, ignoring it or going with our gut feelings.

The types of risk

Risk affects businesses at several levels:

• operational risks relate to the running of the business: people's actions and decisions; quality control; health and safety; workflow and capacity; information systems; technology and infrastructure
• strategic risks relate to the big decisions in business: which markets to enter; how to obtain key resources; how much to innovate or go for growth; how to shape the business's culture and values; responding to competitors and new customer needs
• project risks relate to specific pieces of work: uncertainty over timescale, quality and cost are three key areas
• financial risks relate to issues around financing: credit risk (uncertainty over repayment); interest-rate risk (uncertainty over the value of fixed income obligations); currency risk (uncertainty over exchange rates); commodity risk (uncertainty over the value of holdings) and liquidity risk (uncertainty over the ability to buy or sell something quickly at its fair value).

Responding to risks

Once you've identified a risk, you need to decide how to respond to it. The main alternatives are:

• Eliminating risks. Getting rid of a downside risk - if you can - is always the best option. Any risk with an unacceptable potential downside, such as death or bankruptcy, is a candidate. But in other cases, the cost of elimination can outweigh the benefit.
• Tolerating risks. If a downside is very unlikely, or would not have a huge impact, you may choose to tolerate it. This means you will do nothing to stop it happening, but will only respond after the event. An example would be increasing product prices to compensate for a proportion of manufactured units being defective.
• Diversifying risks. Diversification is about spreading risk around. It can reduce potential negative impacts, but normally at a cost. For example, printers depend on paper suppliers to keep their presses running. By setting up many different suppliers, they diversify this operational risk, but must put more time and effort into contract management. ISAs offer those with limited stock-market knowledge a way to diversify personal financial risk.
• Concentrating risks. This is the opposite of diversification: deliberately putting all your eggs in one basket. This is normally done to save time, reduce cost or provide better focus: an example would be appointing a full-time project manager rather than allowing a project to be run by committee. In financial terms, concentration might mean investing in a single company you believe will do well.
• Hedging risks. Hedging means taking additional risks that offset other risks, so that they balance out - a common approach to financial risk. We 'hedge our bets' in everyday life, for example when we make more than one tentative plan for an outing on the same night, in case one plan doesn't work out.
• Transferring risks. This means paying someone else to manage a risk for you. Household insurance is a good example. In business, we transfer risks when we outsource aspects of our operations, such as IT, to a third party.

Key tips for success

Choosing the right response to risk depends on your own knowledge and understanding. Some key approaches are:

• Know your operations. Make sure you know where risks can arise. Understand the implications of choosing or creating new processes. If operational risk is unavoidable, be realistic about the potential impacts.
• Understand strategic risk. Realise when you're taking a decision - identify all the alternatives in every situation. Continuing along your present course is still a choice, and it isn't necessarily the best one. Are there risks inherent in simply remaining in your current market? What strategic risks might result from future change?
• Get to grips with probability. We often talk about things as being 'quite likely', 'unlikely' or 'improbable' without any shared idea of what we mean. Learn the language of probability so you can quantify probability - and understand when precise quantification is impossible.
• Assess impacts. We often take decisions without thinking through the potential impacts - positive and negative. Before you incur a risk, think through the positive outcomes you hope to realise, and the negative outcomes you hope to avoid.
• Manage information. Document your responses to risk and share what you learn. Ensure that those who make decisions have access to the information they need, in a format they like.
• Define roles. Work out who 'owns' risks by default, then decide who should 'own' them for best results. Ensure those who will manage risks have enough authority to do so. Make risk transfer explicit, not implicit or hazy.

When things go wrong

If realising opportunities means taking risks, then sooner or later a downside will occur. Our response to errors is a key part of enlightened risk management.

By improving the way we make decisions, we can minimise the probability of errors. By improving the way we respond to errors when they occur, we can minimise the impact of errors and (crucially) realise the opportunity for learning that errors provide.

• No blame. Our decisions don't just flow from our own competency. The tools we use, the information we have, our psychological make-up and the organisational context all have a big part to play. But when things go wrong, we simplify things. We like to point the finger, attributing downsides to the deficiency or stupidity of an individual. But this teaches us nothing. We need to move away from this 'natural' perspective on error and unpack the complexities behind our mistakes, so we can learn from them.
• Sharing responsibility. Sharing information about risks means they are taken with full understanding of the implications. If things go wrong, the responsibility should be shared. No individual's reputation should be endangered if the business has decided to incur a risk. This effectively transfers the risk from the individual to the business.
• Rewarding better decisions. Much of our management culture rewards people on the results of their actions - profit being the supreme example. Realising upsides means reward, while realising downsides means punishment. But uncertainty over outcomes means that good decisions, based on sound understanding of risks, might still result in downsides. Conversely, poor decisions might realise benefits if the gods are smiling. Enlightened managers reward those who take decisions well, regardless of the outcome, rather than those who are lucky.

Contacts