Blog Post

“That’s been one of my mantras – focus and simplicity. Simple can be harder than complex: You have to work hard to get your thinking clean to make it simple. But it’s worth it in the end because once you get there, you can move mountains.” Steve Jobs This quote sums up the paradox of simplicity – simple is hard. Working out what the essentials are and how to do things efficiently isn’t just hard, it can seem like more work than just sticking with the complicated path in the first place. ...

You say either and I say either You say neither and I say neither Either, either, neither, neither Let’s call the whole thing off “Let’s call the whole thing off” George and Ira Gershwin It’s good to have an idea of what you are going to be talking about before you start any discussion, but this is vitally important when you are talking about risk. The word is used conversationally and technically in lots of different ways so we need to be clear that we are all speaking the same language to avoid confusion later on. ...

As a risk manager, you will often be asked to explain the RoI (return on investment) of you, your team, even the whole risk management program. Effective risk management can help an organization grasp an opportunity and realizing an upside risk should generate a positive RoI. However, when you are focussed on shoring up a weak system, plugging gaps and minimizing risks, showing an RoI can be hard. Even so, an inability to show a positive RoI in a cost-conscious environment can threaten investment in your team. It can even make people question the value of the program as a whole. ...

‘Lean’ is a buzzword in software development describing an approach where you conduct lots of short, fast experiments and iterate depending on the outcome. ‘Lean’ also conjure up images of a racehorse or athlete. Fit, powerful and ready for peak performance. ‘Lean’ can also means stripped of anything superfluous and free of frills. Your risk assessment process needs to include elements of all of these. Your need a lean risk assessment process. ...

Your biggest risks aren’t usually the ones staring you in the face The big ticket items – the ones that are at the top of everyone’s list, the first thing the CEO wants to talk about – aren’t usually the biggest risk you’re facing. These might be the biggest threats. These might reflect everyone’s biggest fear. But because these are so well known. Because these get so much attention, you’re probably spending a lot of time and effort on these risks. The result is thatthese are closely monitored, well mitigated and heavily managed so the resultant risk is relatively benign. ...

It was the highpoint of a recent meeting with a large firm’s corporate security team. While we were showing them around DCDR, the CSO leaned over to a colleague and said “I love the simplicity“. Cue smiles from our side…. Our intent was always to make the best piece of risk management software possible and a key part of that was to keep things simple. However, as time goes on, it’s easy to lose sight of the original concept, to add ‘just one more feature’ and eventually end up with a Frankenstein’s monster which looks nothing like your original idea (and that everybody hates). ...

Failure is not Definitely an Option People agree that starting a business is risky and although the failure rates might not be as dire as people like to say, 20% fail in their first year and only 50% make it to five years. A decade in, only 30% are still around (Stats courtesy of Fundera.). A tech startup takes that to a whole new level because of the additional layers of uncertainty that technology imposes. Startup’s risks are significant. ...

Conducting a risk assessment is a big project and, like any big project, there are a lot of things between you and success. However, there are five common risk assessment problems that crop up time and time again. These make the difference between success and failure no matter what else you do. Keep these five problems in mind and plan accordingly to maximize the chances of success with your next risk assessment. ...

I received an email a while back from someone just making their start in risk management asking if I had any thoughts or advice on the risk management skills they needed. The response quickly became several pages long and I thought it was worth turning it into a blog piece that others might benefit from. This could also be titled ‘Letter to a 30-year old me’ or a 40-year old me.. ...

In some ways, all risks can be considered subjective for two reasons. Firstly, how we perceive risks is a very personal matter based on in-built biases, the experiences we have had and our current situation. An example from a well-known risk textbook is an icy sidewalk. A child might see that as a fun thing to slide on so their perception is that there is no risk. A retiree will perceive this as a high risk as their chance of falling and becoming injured is higher and more debilitating. If a kid falls, they usually just get up and carry on with what they are doing. ...