The three risk responses

The ultimate objective of risk management is to identify treatments that reduce hazardous risks to acceptable levels. 

Opportunities, on the other hand, should be maximized – we want to increase the probability and impact of positive risks, so treatments should position us to take full advantage of them if/when the risks materialize.

Although our options are practically infinite, we theoretically have only three choices.

Avoid

Avoiding a risk means deciding not to start or continue the activity that gives rise to the risk in the first place. 

For example, if we don’t want our iPads to be dropped or damaged, don’t use iPads – stick to pens, paper, and clipboards. 

In this instance, we are effectively reducing the probability of the risk occurring to zero.

Change the probability

Although we may not be able to avoid a risk entirely, we might be able to reduce its probability of occurrence.

For example, we might hold an outdoor event during the driest month of the year to reduce the probability of rain damage.

Alternatively, we might intervene to increase the probability of an opportunity being realized. 

In the Ryan Gosling example, we might offer him $1,000,000 for his time, changing the probability of him helping from ‘rare’ to ‘almost certain’ overnight.

Change the impact

If we can influence probability, we can also change the impact of a risk, should it eventuate as an issue. 

We can do this by transferring the risk to someone else (for example, by sub-contracting out specialist work) or sharing the impact of a risk with, for example, an insurance company.

---

The cost of risk management

Risk treatment options are not necessarily mutually exclusive or appropriate in all circumstances.

Selecting the most appropriate risk response involves balancing the costs and efforts of implementation against the benefits derived, keeping in mind your legal, social, and other obligations.

Sounds a bit like the business case, doesn’t it? 

Indeed, the decision-making process is quite similar – define the problem, consider the costs and benefits of alternative responses, and make recommendations. 

You can even use multi-criteria analysis!

And stakeholders… did we mention stakeholders?

Indeed, you should always consider the values and perceptions of stakeholders and the most appropriate ways to communicate with them. 

After all, though equally effective, some risk treatments can be more acceptable to some stakeholders than others.

And when risk treatment options are likely to impact operations or risk elsewhere in the organization, those stakeholders should also be involved in the decision.