“What could possibly go wrong?”—for a phrase that’s embedded in our consciousness, it often has surprisingly little impact on the way we manage our business. “Nothing can go wrong; nothing we can’t handle; no need to dwell on the negative; we can’t live our lives in fear.” But wishful thinking is a long way from risk management. According to a recent survey, over one quarter of all companies have no enterprise-wide risk management (ERM) plan and over 60% never regularly monitor or address risk with their leaders and managers, let alone their employees.

So how do we manage risk in a world that has already proven it can surprise us any time it wants with a new and overwhelming threat?

The Focus of Risk Management

Risk management does not make problems disappear; it helps identify and assess them and points to controls that will minimize their impact as much as possible. It may influence: 

• Immediate decisions—who belongs on this team? 
• Long-term strategies or plans—what do we do if our main distributor fails?

Risks may be: 

• Internal, such as those associated with a reorganization or development of a new product
• External, such as those influenced by the economy, regulations, or competition. 

The compass of risk and risk management may involve facilities, employees, technologies, innovations, compliance, operations, finances, reputation, and a myriad other factors. Government regulations, industry best practices, benchmarks, and standards such as those set by the International Organization for Standardization (ISO) may provide the impetus for change. Risk audits may be mandated by partners, investors, and client companies.

The Process of Risk Management

As with all problems, the reason to consider risk is to determine if it is worth the resources required to address it; if so, how to contain or avoid it; and if it cannot be contained or avoided, is it still worth taking because of the rewards involved. The following six steps are those widely recommended for making those decisions:

1. Understand the risk and where it is most likely to occur (for example, which part of the supply chain is most vulnerable or where does the team lack the most experience).
2. Determine the likelihood and potential extent of the risk (one team fails, one project is late, a supplier fails, the entire supply chain is cut off).
3. Measure the risk against others to determine priorities in dealing with it.
4. Develop a plan to avoid or lessen the risk and to recover if the risk occurs.
5. Monitor to see if the risk materializes, if other risks become more threatening, or if the plans in place need modification.
6. Communicate at every stage so that every employee, leader, and stakeholder is aware of the risk and the steps being taken; involve customers and others who might be worried about potential or actual risk.

Risk Management at the Team Level

When it comes to managing risk for a team or an individual project, a leader should ask:

• Is the data about the risk reliable?
• Is the risk acceptable or unacceptable; is it a priority?
• What is the result of addressing the risk? 
• What is the cost of addressing the risk; what resources are needed and are they readily available?
• Is risk management practical?
• Does everyone understand and accept the risk?
• What can individual team members do in their separate roles to mitigate or avoid the risk?

In undertaking risk management, keep in mind that not all risks are predictable; you may not foresee them, you may not realize their threat, and you may avoid them without ever realizing you did so. However, pretending that they do not exist will ensure consequences down the road that may be far more costly personally and professionally than any risk management process.