Risk management does not have to be complicated or over-engineered, but it does start with having a good grasp of the risks your business faces (i.e., risk identification).
What is a Risk?
Simply put in the context of your business, a risk is any event that can introduce uncertainty in your ability to meet your business objectives.
Risk to Your Business Objectives
You have certain goals that you want for your business and have a plan in place to achieve those goals, but things can and will go wrong along the way to meeting those objectives. Therefore, it is important that you have a risk management process in place to protect your future. Knowing your risk landscape is an important step in that process.
ADVERTISEMENT
Risk Taxonomy
Let’s face it, there is an endless number of risks that can be identified that may impact your business – but which of these matter most?
To answer this question, it is helpful to structure your risks into categories that are relevant for you.
Start with high level groupings, such as operational, strategic, and your financial risks (e.g. credit, market and liquidity risks). These are your Level 1 risks.
Your Level 1 risks can be further segmented into more specific risk categories. These are your Level 2 risks. These groupings can be even further segmented.
The segmentation of your risk groupings is limitless, but it often does not exceed three or four levels. If you identify your risk categories beyond four levels, the simplicity of your risk management process can be compromised.
The hierarchical categorization of your risk types is your risk taxonomy.
View the video below on risk Taxonomy Categorization for more information.
Identifying Risks
With your business objectives and risk taxonomy at hand, you are equipped to start identifying your specific risks for each risk category.
ADVERTISEMENT
Start with your business objectives because they drive the risk identification process. Think about what activities you are undertaking or the processes you have in place to achieve these objectives. Then, consider the things that could go wrong with those activities or processes and write them down. Don’t forget to use your risk taxonomy as a guide for identifying the types of risks that could be relevant.
The risk identification process can and should take place at any time. As soon as you think of one, write it down! Still, it is a good practice to organize and schedule time to identify your risks at least annually. Perhaps this can coincide with the time you set aside to think about your business objectives.
Conduct your risk identification process alone or with a group. It can be based on a top-down (e.g., performed by managers) or bottom-up (performed by employees) approach.
There are no set rules for how you identify your risks. Each approach can have its plusses and minuses. It just depends on what works best when you take into consideration the size and complexity of your business.
A Word of Caution When Identifying Your Risks
Often times, one can tend to focus on the cause of a risk or an impact of a risk, rather than the risk itself during the risk identification process.
While risk causes and impact are certainly very important to understand and play a role in the management of your risks, these elements are considered elsewhere in the risk management process. So, try to maintain your focus on the actual risk, not its cause or impact.
