What Is Risk?
What A Risk Is
1risk \’risk\ n [F risque, fr. It risco] 1: possibility of loss or injury; PERIL 2: a dangerous element or factor 3 a: the chance of loss or the perils to the subject matter of an insurance contract; also: the degree of probability of such a loss b: a person or thing that is a specified hazard to an insurer c: an insurance hazard from a specified cause or source.
Definitions 1, 2 and 3a best characterize risk from a program management viewpoint: there is the possibility (though not the certainty) of some future event occurring, and the occurrence of that event will, or, at least, may, cause a loss. Risk encompasses both the likelihood (probability) of an uncertain future event occurring and the consequence (loss) should the event occur. In a broader sense, risk in the program management view should also consider the possibility of uncertain future events that will provide gains as well as losses.
To be a risk, therefore, an event must: 1) be in the future, 2) be uncertain, and 3) result in a gain or loss to the program should it occur.
What A Risk Is Not
Any event that does not fit the criteria in the previous sentence is not a risk. In particular, an event that has already occurred is not a risk, an event that is certain to occur is not a risk, and an event whose consequence is neither a gain nor a loss is not a risk.
If an event has occurred that produces an advantageous result, it is a benefit. If an event has occurred that produces a detrimental result, it is a problem. One difficulty at many firms is that many items that are classified as risks are, in fact, problems: events that have already occurred that have costly consequences. Whereas risks can be mitigated (more on this later), problems must be solved. It is certainly possible that the future consequences of a problem may not be fully known; in that case, the unknown consequences are properly classified as risks and, as such, may be candidates for mitigation or contingency plans. However, program management must be able to distinguish between the program activities of solving a problem, something that must be done, and mitigating a risk, something that is optional.
If a future event is certain to occur, it is not a risk; it is a future benefit or future problem depending on the nature of its consequences. As with an event that has already occurred, if the consequences of a certain, future event are unknown then these consequences are properly classified as risks, and may be candidates for mitigation or contingency planning. Again, program management must be able to distinguish between handling of certain future events and the handling of uncertain future events.
If an uncertain future event will result in neither positive nor negative consequences, that event is not a risk. Although such events are rare—some might say nonexistent—program management needs to consider the continuum of possible consequences if only to better analyze events that truly are risks. There will undoubtedly be a range of outcomes that program management will find acceptable, but they need to be aware of that range and be able to quantify whether the consequences of a future event will fall into that range or not. Put another way, program management needs to foster an environment in which its team members are comfortable presenting not only the most likely outcomes, but also “the best of the best” possible outcomes and “the worst of the worst” possible outcomes.