Make sure your contingency plan isn’t based on flawed assumptions. Use this quick checklist to run a health check on your contingency plans.

*How can you spot the point where risks become events? How do you know you’ve moved from something that might occur to something that is actually occurring? * I’d argue that you don’t need to identify the specific point of change, and you’ll waste valuable time trying to spot the exact moment of transition. Most importantly, if you wait to see the transition point, your response will be on the back-foot from the get-go. ...

DCDR V2.0 is live. Here’s a quick 90-second tour.

I looked back at some of my degree notes the other day and came across something I’ve been meaning to work on for a long time. (By long time, I mean about 10 years*.) It’s based on two concepts. First, the work that Brian Toft, Simon Reynolds and Barry Turner did with respect to how disasters evolve and how we can learn from the. The second concerned how to differentiate between emergencies and crises. Bringing these concepts together gives us a model or framework for how risks become events and how these events can become disasters. ...

We seem to be pretty bad at talking to one another right now. Subjects where you might expect some general agreement with maybe a slight difference on the edges become die-in-the-ditch arguments. Arguments that rapidly spiral into unrelated areas of increasing vitriol. If you’re talking about sports, then that’s fine: we don’t expect Yankees or Red Sox fans to agree. However, we need a way to have a measured debate when talking about public safety, national security, or healthcare issues. I believe that we can achieve that by improving the deficit model for risk communications. (There’s a primer on risk perception and communications here if you’re not familiar with the topic.) ...

*Asking ‘what is risk management?’ often gets you the trite answer ‘it’s the management of risk’ or we get a list of activities associated with risk management. Neither result is satisfying and we need a better definition that explains the intent of risk management along with some clarification of what this is and is not. Here, I’ve presented some initial ideas on a definition along with four components that should give us a more thorough definition. * ...

As risk managers, we spend a lot of time working out how to get things done. After all, the risk assessment is just the start of the process. Once you’ve identified your risks and worked out how to address them, you need to get down to work: then the actual management part begins. Determining ownership for many risks will be relatively straightforward and departments will often fight very hard to maintain ownership of risks that fall within their remit. ...

I realized a while back that it can be too easy to mistake ‘simple’ with ‘easy’ and I’ve been concerned that promoting a simple approach to risk management might lead people to think that this makes everything easy. Unfortunately, even though a KISS approach makes risk management easier, it doesn’t do away with the need for hard work altogether. Worst of all, it can be easy to mistake shortcuts for simplification. ...

Most of the risk assessment models I’ve discussed before use a basic formula to calculate a value for risk. By adding or multiplying values for the individual factors, you’ll get a numeric value for the risk itself. That’s going to allow you to put things into order, apply a color-code or description. That gives you enough differentiation to start a risk-based discussion or determine where you need to focus your attention and resources. ...