In risk management, downside risk refers to potential negative outcomes, losses, or adverse impacts of a particular action, decision, or scenario. It’s the part of risk that could result in harm, such as financial loss, reputational damage, or operational failure. Managing downside risk focuses on controlling and mitigating these potential losses. On the other hand, upside risk is the potential for positive outcomes or gains from taking on certain risks. Upside risk is often less emphasized in traditional risk management, but it’s key in strategic planning and decision-making. It includes opportunities for growth, profit, innovation, or competitive advantage that may come from calculated risks. The Strategies to Maximize Upside and Control Downside can be as:
- Risk Identification and Analysis: Thoroughly identify all potential risks and analyze them in terms of both downside and upside potential. By understanding both, organizations can make informed decisions about which risks to take on and which to avoid.
- Risk Appetite and Tolerance: Define your organization’s risk appetite (the level of risk you are willing to pursue) and risk tolerance (the acceptable level of risk exposure). This helps balance between seizing opportunities (upside) and protecting against losses (downside).
- Enhanced Risk Monitoring: Use a proactive approach to monitor both downside and upside risks. This includes setting up key risk indicators (KRIs) for downside risks and key performance indicators (KPIs) for upside potential, ensuring a holistic view of risk across the organization.
- Adaptive Risk Response Strategies: For downside risk, use response strategies like avoidance, mitigation, or transferring risk (e.g., insurance). To maximize upside risk, adopt strategies like investing in innovative projects, strategic partnerships, or business process improvements that could lead to competitive advantage.
- Building a Risk-Aware Culture: Encourage a culture that views risk as an opportunity for growth rather than solely a threat. Empower employees to think creatively about how they can manage and leverage risks effectively.
- Regular Review and Scenario Analysis: Use scenario planning to understand the potential outcomes of both upside and downside risks under different situations. By preparing for various scenarios, you can better manage adverse effects and capitalize on favorable conditions.
By actively managing downside risks while remaining open to upside potential, an organization can enhance resilience and agility, positioning itself to achieve sustained growth and competitive advantage.
Risk Likelihood
Risk likelihood refers to how often a risk is expected to happen. It’s sometimes called risk frequency, but this term implies the risk occurs regularly, so “risk likelihood” is used more broadly here. Risk likelihood can be measured either as an inherent risk (its natural likelihood) or based on current conditions and controls in place. For risks with a historical record, like vehicle accidents in a fleet, past incidents can help predict how often they might happen. A transport company, for example, could estimate the likelihood of vehicle breakdowns both with and without existing controls, like maintenance programs. However, assessing the inherent likelihood of accidents is trickier, as it would require imagining the outcome without any safety controls. Even if it’s hard to measure inherent risk for breakdowns, the company should still assess the effectiveness of its vehicle maintenance and whether it’s cost-effective. The same applies to driver training programs aimed at reducing accident risk. Whether risks are measured inherently or under current conditions, comparing fleet performance with industry averages is useful. Some controls don’t affect the likelihood of a risk but rather its impact. For instance, wearing seat belts doesn’t lower the chance of a car accident but does reduce injury if one happens. Similarly, a sports club may want to prevent key players from being unavailable. For instance, a player’s absence might result from inappropriate behavior, so the club could establish a “code of conduct” for players, including guidelines for a healthy lifestyle, with penalties for violations. Additional controls might include fitness monitoring and support for international players adapting to the country. Other measures, such as high-quality medical facilities and insurance, could further help manage the risks associated with player absence.
Risk Magnitude:
Risk Magnitude refers to the overall size or scale of a risk. It combines both likelihood (how often the risk might happen) and impact (the severity of the consequences if the risk does happen). Risk magnitude gives a complete picture of a risk’s importance by taking into account both how likely and how damaging it could be. For example, a risk with a high likelihood but low impact may have a similar magnitude to a risk with a low likelihood but high impact. Risk impact focuses solely on the severity of the consequences if a risk materializes, regardless of how likely it is to happen. It describes how much harm or disruption a risk could cause. For instance, an impact might be measured in terms of financial loss, damage to reputation, health and safety effects, or operational disruptions. The difference between Risk Magnitude and Risk Impact lies in scope. The difference Between Risk Magnitude and Risk Impact. The difference lies in scope:
- Risk impact measures only the severity of the outcome if the risk occurs.
- Risk magnitude combines both impact and likelihood, providing a more comprehensive assessment of the risk’s overall threat level.
In risk management, considering risk magnitude helps prioritize risks since it evaluates both how likely and how harmful each risk could be. Reducing the scale of hazard risks is essential. In hazard risks, magnitude often means the inherent severity of the risk if it happens. Lowering overall hazard risk severity involves reducing both the impact and consequences when an incident occurs. For instance, wearing a seatbelt can reduce injury severity in a car accident but doesn’t affect the chance of having an accident. A major fire, for example, could cause extensive property damage and high costs. To lessen the severity of such a fire, the focus should be on reducing its impact on the organization’s finances, infrastructure, reputation, and market position (FIRM). Actions to manage impact would focus on limiting damage during the fire and containing costs afterward. The consequences affect the organization’s strategy, tactics, operations, and compliance (STOC). Loss control focuses on lowering the scale, impact, and outcomes of a negative event. Damage control is also important for protecting a company’s reputation. If a serious event occurs that draws public attention, the organization must reassure stakeholders by showing it responded appropriately. Typically, in cases like a severe train or plane accident, the company’s CEO or chairperson will be present at the scene to demonstrate concern and leadership. Poor handling of media can worsen reputational damage if the organization fails to plan effectively before incidents happen. In these cases, lack of preparation can lead to more harm to the organization’s image. Finally, controlling costs after an incident is critical. Cost management is typically supported by a business continuity plan (BCP) or disaster recovery plan (DRP) prepared in advance. These plans help the organization keep costs as low as possible following an incident.
Hazard risks
Reducing the severity of hazard risks is important for various areas, including fraud prevention, health and safety, property protection, IT system reliability, and reputation management. When these risks occur, steps should be taken to lessen the event’s severity and reduce its impact and consequences. While the main goal in managing hazard risks is to prevent losses, successful management also requires focusing on limiting damage and controlling costs. The insurance industry is increasingly aiming to settle claims efficiently and cost-effectively, encouraging organizations to resume normal operations quickly. Some insurers refer to these efforts as “cost containment.” Reducing the severity of incidents should be part of a broader approach to loss control. This integrated approach helps organizations manage both the likelihood and the impact when a hazard risk occurs. In general, loss control is the combination of loss prevention, damage limitation, and cost containment. Though loss prevention is the most critical part, all three aspects are essential for effective hazard risk management.
Before an event happens, the organization should have controls in place to prevent losses. As he event unfolds, actions should be taken to limit the damage it causes. After the event, cost-saving measures, such as activating business continuity plans and setting up arrangements to reduce repair costs, should come into play. Disaster recovery plans are important for both limiting damage and controlling costs. Despite best efforts, risks can still occur, so it’s essential to assess hazard risks thoroughly and prepare plans for handling the incident during and after it happens. These plans should aim to minimize the damage and tightly control the costs associated with the event.
Loss prevention, Damage Limitation and Cost Containment
One way to think about loss control is to break it down into three activities Loss prevention, damage limitation, and cost containment are strategies used in risk management to handle potential losses from adverse events, but each focuses on a different phase and approach to managing the risk.:
- Loss Prevention: This focuses on reducing the chances of an adverse event happening in the first place, though it can also help lessen the size of the event if it does happen. Different types of risks call for different loss prevention methods. For health and safety, loss prevention might mean avoiding risky activities or stopping the use of hazardous chemicals. For building safety, it could involve removing fire hazards and storing flammable materials safely. For fraud and theft risks, it may include separating responsibilities, tagging valuable items, and doing background checks on new hires.
- Definition: Loss prevention aims to prevent a harmful event from occurring in the first place, or to reduce the chance that it will happen.
- Focus: This strategy is proactive and focuses on lowering the likelihood of a risk materializing.
- Examples: In an oil and gas company, loss prevention might include regular inspections and maintenance to prevent leaks, safety training for employees, and enforcing strict protocols to avoid accidents.
- Damage Limitation:This focuses on reducing the severity of the event if it does occur. Damage limitation is most effective when plans are in place to act while the event is still happening.
- Definition: Damage limitation is about reducing the severity or magnitude of an event while it is happening.
- Focus: This strategy is reactive and works to control the extent of damage during the event.
- Examples: If a fire breaks out, using fire suppression systems to contain it quickly is a form of damage limitation. Similarly, emergency response actions like deploying containment booms for an oil spill help limit the spread of damage.
- Cost Containment: This involves reducing the financial impact and long-term effects of the event. Cost containment focuses on keeping repair costs low and using business continuity plans to keep the organization running after an asset has been damaged.
- Definition: Cost containment focuses on minimizing the financial impact and consequences after the event has occurred.
- Focus: This approach manages costs associated with repairs, recovery, and business continuity after an incident.
- Examples: Cost containment might involve activating a disaster recovery plan, using insurance to cover repair costs, and implementing business continuity plans to resume operations quickly.
- Key Differences
- Timing: Loss prevention is proactive (before the event), damage limitation is reactive (during the event), and cost containment is post-event (after the event).
- Purpose: Loss prevention reduces the likelihood of occurrence, damage limitation reduces the extent of damage, and cost containment minimizes financial impact and operational disruption.
Each approach is essential for a comprehensive risk management strategy, and together, they help protect an organization from various stages of potential loss .Damage limitation strategies for fire hazards are well established. Although sprinkler systems are often thought of as a prevention tool, they are actually the main control to limit damage when a fire starts. Other fire damage limitation measures include fireproof partitions in buildings, fire shutters, and well-prepared plans to protect or move valuable items. For example, after the fire , valuable artwork are quickly moved to safe areas. Even with strong health and safety measures, workplace accidents still happen. To limit damage, most organizations provide first aid facilities. In high-risk workplaces, some companies even have medical facilities on site, which may include specific treatments for hazards present. For instance, cyanide antidotes may be available in chromium-plating factories, and emergency eye-wash bottles are often found in areas where hazardous chemicals are used. For example oil spill can highlight important lessons for risk management. While measures can be in place to prevent the spill and manage cleanup costs, damage limitation measures appeared less prepared. Since it took weeks to stop the leak, there was time to introduce damage control, but plans were not sufficiently developed in advance. When hazard risks occur despite prevention and damage control, cost containment is often still needed. For example, after a severe fire, arrangements for salvage, cleaning, and decontamination of damaged items help reduce costs. Cost control steps after an incident, like these, should be outlined in business continuity, disaster recovery, and crisis management plans. Additionally, insurance policies often cover “increased cost of operation,” which can arise when a company has to subcontract production or use a distant factory to keep operating. If a manufacturer finds that faulty goods are in the market, it should have a plan ready to notify customers and help them identify the products.
Product recall risk management: Any company involved in making, assembling, selling, or processing products could face financial losses from a product recall. Direct costs include paying staff to carry out the recall and paying for ads on radio, TV, newspapers, or industry magazines to inform the public. Indirect costs include lost production time, as regular staff focus on the recall, and hiring temporary workers to keep production going. The biggest indirect cost, however, is the potential loss of market share due to bad publicity. A product recall aims to protect customers from harm, remove the product from the market and production, follow regulatory rules, and safeguard the company’s assets.
Upside of Risk
Upside of Risk can be defined as
- Fewer disruptions to normal operations and greater operational efficiency resulting in less downside of risk
- Ability to seize an opportunity because competitors did not identify the cost-effective solution to a risky feature of a contract
- Specifically identifying positive events during the risk assessment and deciding how to encourage those events
- Opportunity management, by completing a detailed review of a business opportunity before deciding to embrace it
- Achieving a positive outcome in difficult circumstances as an unintended and/or automatic result of good risk management
Defining the positive side of risk is a big challenge in risk management. Risk management aims to help organizations meet requirements, improve decision-making, and run core processes more effectively and efficiently (known as MADE2). But risk managers want to identify additional, unexpected benefits that come from managing risk well. These benefits, or the “upside of risk,” occur when the gains from taking a risk are greater than if the organization had avoided it altogether. For example, if a manufacturing company produces waste by-products that are hard to dispose of, they could turn this challenge into an advantage by selling the waste or creating a new product from it. Here, solving a problem results in extra, unforeseen benefits. Simply put, the upside of risk is the reward from taking the risk. Climbing a difficult mountain, for example, involves risk, but the upside is the reward of safely reaching the summit. Another view is that risk management is about aiming for the best outcomes and reducing uncertainty. From this angle, the upside of risk is reaching organizational goals by managing the risks involved in the chosen strategies and operations. Another way to look at the upside of risk is to consider it in risk assessment workshops, focusing on identifying risks that could lead to positive outcomes. This means asking questions like, “What events could make things turn out better than expected?” By creating a list of these positive risks, the organization can work on making them more likely to happen or increasing their benefits. One benefit of the upside of risk is that it allows the organization to take on opportunities it might otherwise avoid. In business, this can mean pursuing a chance that competitors might see as too risky, either because the organization is more efficient or has identified a smart way to develop that competitors missed. This way, the company targets only the profitable parts of a new opportunity. The upside of risk can also be seen as taking a chance on a venture that, while risky, turns out well. This requires being willing to pursue risky opportunities, with controls in place, when competitors might back away. Finally, the upside of risk can mean having a strong risk management process. Meeting mandatory obligations alone can be seen as an upside, though it may not be very persuasive to senior managers. More convincingly, the upside is the chance to go after a business opportunity competitors would avoid due to risk aversion. There is debate in the risk management field about how to define the upside of risk. Some standards suggest adding a “take the risk” option to the traditional 4Ts (tolerate, treat, transfer, terminate), making it the 5Ts, focusing on opportunity rather than just taking risks for their own sake. An example of this is when someone seizes an opportunity that others see as risky. It’s not about enjoying the risk itself but embracing the opportunity despite the risk.
Opportunity assessment
To successfully take advantage of business opportunities, organizations benefit from doing opportunity assessments. Many consulting firms conduct detailed evaluations of each new business opportunity, examining potential profits, extra income, and reputation boosts from working with certain clients. Opportunity assessments can be used for evaluating both new business ventures and new clients, with the goal of identifying additional possibilities that could come from gaining that client. These assessments also consider potential downsides of working with a new client. Sometimes, after evaluating, a company may even decide not to pursue a particular client. For example, if a theater notices a drop in attendance, it might assess ways to earn more from those who still attend, like improving food services, offering organic options, or selling themed merchandise. The theater could also explore sponsorship deals and discuss with local businesses what types of shows would attract support. This kind of assessment could help the theater choose productions with good sponsorship potential, allowing it to stage performances that might otherwise seem too risky. Many organizations already manage opportunities, though it might not be recognized as part of risk management. Ideally, opportunity management should be integrated into the development of strategies and tactics. Some organizations lack specific processes for assessing new business opportunities, mergers, or acquisitions. During risk assessment workshops, many organizations now consider both risks and opportunities, tailoring the risk matrix and the likelihood and impact ratings to fit their needs. When assessing both risks and opportunities, organizations typically need a diverse group of people involved, since risks are often linked to operations and compliance, while opportunities are related to strategy. After identifying and analyzing opportunities, organizations should evaluate them and determine actions or controls to increase the chances of achieving the expected benefits. The same opportunity assessment approach can be used to analyze and manage these identified opportunities on the risk matrix. To successfully take advantage of business opportunities, organizations benefit from doing opportunity assessments. Many consulting firms conduct detailed evaluations of each new business opportunity, examining potential profits, extra income, and reputation boosts from working with certain clients. Opportunity assessments can be used for evaluating both new business ventures and new clients, with the goal of identifying additional possibilities that could come from gaining that client. These assessments also consider potential downsides of working with a new client. Sometimes, after evaluating, a company may even decide not to pursue a particular client. For example, if a theater notices a drop in attendance, it might assess ways to earn more from those who still attend, like improving food services, offering organic options, or selling themed merchandise. The theater could also explore sponsorship deals and discuss with local businesses what types of shows would attract support. This kind of assessment could help the theater choose productions with good sponsorship potential, allowing it to stage performances that might otherwise seem too risky. Many organizations already manage opportunities, though it might not be recognized as part of risk management. Ideally, opportunity management should be integrated into the development of strategies and tactics. Some organizations lack specific processes for assessing new business opportunities, mergers, or acquisitions. During risk assessment workshops, many organizations now consider both risks and opportunities, tailoring the risk matrix and the likelihood and impact ratings to fit their needs. When assessing both risks and opportunities, organizations typically need a diverse group of people involved, since risks are often linked to operations and compliance, while opportunities are related to strategy. After identifying and analyzing opportunities, organizations should evaluate them and determine actions or controls to increase the chances of achieving the expected benefits. The same opportunity assessment approach can be used to analyze and manage these identified opportunities on the risk matrix.
Example of Risk assessment checklist for Financial
- Lack of availability (or unacceptable cost) of adequate funds to fulfil the strategic plans
- Insufficiently robust procedures for correct allocation of funds for strategic investment
- Inadequate internal financial control environment to prevent fraud and control credit risks
- Inadequate funds to meet historical liabilities (including pensions) and meet future anticipated liabilities
Example of Risk assessment checklist for Infrastructure
- Inadequate senior management structure to support organization and embed ‘risk-aware culture’
- Insufficient people resources, skills and availability, including concerns about intellectual property
- Inadequate physical assets to support the operational and strategic aims of the organization
- Information technology (IT) infrastructure has insufficient resilience and/or data protection
- Business continuity plans are not sufficiently robust to ensure continuation of organization after major loss
- Product delivery, transport arrangements and/or communications infrastructure unreliable
Example of Risk assessment checklist for Reputational
- Poor public perception of the industry sector and/or potential for damage to the brands of the organization
- Insufficient attention to ethics/corporate social responsibility/social, environmental and ethical standards
- Poor governance standards and/or sector is highly regulated with high compliance expectations
- Concerns over quality of products or services and/or after-sales service standards
Example of Risk assessment checklist for Market place
- Insufficient revenue generation in the marketplace or inadequate return on investment achieved
- Highly competitive marketplace with aggressive competitors and high customer expectations
- Lack of economic stability, including exposure to interest rate fluctuations and foreign exchange rates
- Marketplace requires constant innovation and/or product technology is rapidly developing
- Supply chain is complex and lacks competition and/or raw materials costs are volatile
- Organization is exposed to potential for international disruption because of political risks, war, terrorism, crime or pandemic
Scoring for Different level of Risk
No Risk -0
Little Risk-1
Some Risk-2
Medium Risk-3
High Risk-4
Extreme Risk-5
To calculate an organization’s riskiness index, it’s necessary to identify the specific hazard risks the organization is actually facing. In other words, assessing the riskiness index helps reveal the organization’s true level of risk exposure. Once this risk level is known, the board can determine if this risk fits within the organization’s risk appetite, risk capacity, and aligns with the board’s overall approach to risk. Organizations should be careful not to assume that the risks they are currently taking are the same as the risks they are willing to take, just because they’ve identified those risks using something like the riskiness index.
Upside in Strategy, Projects, and Operations
Organizations typically have a mission statement, a set of objectives, and a clear understanding of what their stakeholders expect. The board must then create a strategy to meet these goals and expectations effectively. To make informed decisions, the board needs risk information about the planned strategy and any alternative options. This risk assessment helps improve the chances of making the right decisions. For opportunity risks, like acquiring a new client or launching a product, there may be limited data to predict outcomes. Accurately assessing the chances of both positive and negative events is crucial to deciding whether to proceed with the opportunity. For example, if a new product is launched, the goal might be to increase the likelihood of success by maximizing cost-effective media and advertising efforts. Strategic planning combines risk management with high-level planning. It’s a structured process to reach consensus on the key issues that will shape the organization’s future. Failing to implement or choosing the wrong strategy can be extremely harmful. Strategies are carried out through tactics, which are implemented via projects and day-to-day processes, forming the organization’s business model. Risk management ensures these processes work effectively and reduce uncertainty. Thus, the benefit of risk management in strategy is that it helps design and implement an efficient approach, improving the organization’s core operations over time.
Every organization needs to adopt the right core processes, which are the key activities that fulfill specific stakeholder expectations. In business process re-engineering (BPR), these activities are seen as essential. There’s a difference between a process being efficient and being effective. An efficient process runs smoothly and without extra costs, but it might not be the best way to meet the organization’s needs. When processes need improvement, a project is usually set up to make these changes. If multiple projects are needed, this is often called a program. Through these projects, organizations aim to improve the efficiency or effectiveness of core processes. By assessing risks before making changes, an organization can help ensure the project is completed successfully—on time, within budget, and meeting its goals. To gain the positive side of risk (the upside), projects need good management and the right selection. Organizations often do a post-project review, sometimes led by internal auditors, to confirm that the project achieved its intended benefits and was worth the resources invested. In tough financial times, organizations need to prioritize projects that offer the best use of limited resources. Risk management in projects is linked to implementing tactics to fulfill the organization’s strategy. Some organizations only approve projects that will reduce risk. For instance, if an activity is at risk due to weak IT systems, a project might aim to improve these systems, reducing risks and boosting efficiency. In summary, good risk management makes it more likely that projects finish on time, within budget, and meet quality standards. It helps manage outcomes, whether they match the plan or not.
Organizations need to run operations that are both efficient and effective. Efficient operations use the organization’s resources well and avoid unexpected disruptions. When operations use the least resources for the most output, they provide the greatest benefit. Effective operations mean choosing the best way to carry out these activities. For example, traveling across a busy city might be efficient by car or bus, but the most effective way in large cities is often by metro.
Risk management can help organizations ensure their operations are both effective and efficient. In a business setting, this can provide an advantage over competitors by allowing work to be done at a lower cost while remaining profitable. For public services, effective and efficient operations are also crucial, as these services often have challenging delivery targets. Risk management supports improvements in public services by making operations more flexible and resilient, which is part of gaining the upside of risk. In a competitive market, achieving the upside of risk can sometimes impact competitors, suppliers, or third parties. But seeking the benefits of risk-taking requires awareness of possible downsides. Avoiding certain actions because they seem too risky could sometimes actually increase risk. The first step in the risk management process is to set the context, and a “riskiness index” can help define both the external and internal context for the organization. When setting this context, it’s important to think about the upside of risk and how the organization can benefit from opportunities related to strategy, tactics, and operations. For compliance risks, there’s also a potential upside. If an organization needs a license from a regulator to operate, a good relationship with that regulator can help. By meeting and even influencing high standards, an organization may gain an advantage over competitors who might struggle with these standards.
