Blog Post

Often, the end of the risk assessment feels like the end of the process and things start to ease off. Unfortunately, this is when the real work begins because, now that you have identified and prioritized your risks, you need to do something about them. There are several options when it comes to dealing with a risk but it’s risk treatments I want to focus on here. These often go askew when mitigation measures aren’t designed carefully. This wastes resources and the risks aren’t reduced. ...

Back in his 1962 State Of The Union Address, JFK noted that “the best time to repair the roof is when the sun is shining.” He was making the point that the US needed to make harder economic decisions while the economy was strong rather than trying to implement cuts and structural changes during a downturn. However, this idea extends well beyond economics and is something we should apply whenever there is a difficult decision to make. There will be times where something truly unexpected crops up and we don’t have much chance to plan beforehand but, in most situations, we can plan ahead. The critical thing is that hard decisions are much easier to tackle when you aren’t already in the middle of a stressful situation. ...

Right or left? The red pill or the blue pill? Speak up or stay quiet? Should I stay or should I go? A decision point is a moment when a significant choice presents itself and the decision made will result in a significant change of course that cannot be undone easily. Moreover, that same choice or option is unlikely to reemerge in the future. The essential elements are that the decision is significant, non-repeatable, and non-reversible. ...

One of the things I’ve enjoyed most as a consultant is having the opportunity to learn about organizations from a wide variety of sectors. These have ranged from schools, NGOs and the private offices of high net-worth individuals to Fortune Five oil and gas companies and governments. On the one hand, I’ve discovered that there are considerable similarities in all organizations, no matter their sector or size. However, I’ve also become acutely aware that the things that make the most significant difference – good or bad – are often very subtle. ...

“Without data, you’re just another person with an opinion.” [W. Edwards Deming](http:// https://deming.org/deming/deming-the-man), US academic and father of the continuous quality improvement movement in the US.* A big part of the risk assessment process is the risk assessment, and a large part of that is usually the risk analysis. The problems is that this involves metrics and math which people often find challenging for two reasons. Firstly, the math can be fuzzy and complicated to follow. ...

There are two times you get punched: when you’re expecting it and when you aren’t. Sometimes you know what’s coming, but there might also be times where you get punched, seemingly out of nowhere. Spoiler for those that haven’t tried this: getting punched hurts, no matter what. The question is, what can you do to make it hurt less? In some ways, knowing you’re going to get punched is worse because you know what’s coming. I’ve only boxed a couple of times, but it turns out that the ring is really (really, really!) small. Half the people in there want to hurt you, and the other half isn’t going to stop them. You also realize that three minutes getting hit by someone feels a lot longer than three minutes of Game of Thrones. ...

Gary Vaynerchuk uses the term micro speed: macro patience to describe his approach to business. This goes a long way to explain the seeming contradiction between his 100-miles-an-hour life and his Zen-like view of when things will come good. Looking back on the last two and a half years working mostly for myself, this is a useful mindset for anyone who’s starting out on their own, part of a startup or busy small business. ...

“Well, there was the kidnapping. Is that something you’re interested in?” It was our last day of a week-long site security survey. We were meeting with the site manager to wrap up our visit but this was the first time we had heard anything about something as serious as this. So yes, a kidnapping was something we were very, very interested in learning about…. I have no idea why it hadn’t come up before: we had conducted dozens of other interviews that week and had dozens of pages of notes. However, it almost didn’t come up at all: at this late stage, we were going to skip the interview and go straight into a review of our findings. ...

I’ve written before about how you need to have a clear idea of what you’re trying to achieve with your risk assessment and to get everyone onto the same page. Without this kind of understanding, it’s very unlikely that you will complete the assessment in the time available. Even if you do, you might not have answered the original question. So you need to plan your assessment properly but what does that look like? Here’s a short five-step process to make sure that you are well-prepared for your assessment before you ask the first question or open up a spreadsheet. ...

There are lots of different methodologies for assessing or breaking down a risk. The most common is a two-factor approach where the likelihood and potential impact of an event combine to create a risk. Likelihood (of the thing) + Impact (how the thing affects you) = risk This is what’s used for The World’s Simplest Risk Model. However, this two-dimensional approach leaves out one thing. Sometimes there are barriers between the event or threat and you. So in addition to the event and its potential impact, there’s the concept of vulnerability or exposure: factors that make you more or less susceptible to the event. These can be passive factors – e.g. physical distance – or active measures you’ve taken to reduce your vulnerability to an event. ...