We’re getting towards the end of the year and, after a year like this, it’s understandable that we’re trying to wind down. Unfortunately, risk management doesn’t work like that so your risk register is sitting there, waiting for some TLC. Those big, scary reds are still there and you know that there’s still a lot to do. There are also a few ambers that you’re concerned about but haven’t quite got around to yet. ...

Defining an organization’s risk appetite and risk tolerance is one of the most significant challenges a risk manager faces. I’ll explain why in a moment but it’s important to understand these parameters as this helps managers at all levels understand where they are operating in relation to the organization’s risk /comfort level. Understanding these limits guides them when they are deciding which initiatives to pursue or kill. Or how much mitigation a risk requires. Maybe it’s what helps them decide it’s time to start pulling out of a market or country. ...

I think it’s safe to say that we’re all ready for 2020 to be over. The arrival of January 1st won’t miraculously solve all of our issues but we will be moving into a year where a lot of the unknowns of 2020 are now knowns. That’s a huge relief for risk manager who probably feel like they’ve been playing on heroic mode all year. 2020 wasn’t a game of Halo, but it felt like it at times ...

Make sure your contingency plan isn’t based on flawed assumptions. Use this quick checklist to run a health check on your contingency plans.

*How can you spot the point where risks become events? How do you know you’ve moved from something that might occur to something that is actually occurring? * I’d argue that you don’t need to identify the specific point of change, and you’ll waste valuable time trying to spot the exact moment of transition. Most importantly, if you wait to see the transition point, your response will be on the back-foot from the get-go. ...

DCDR V2.0 is live. Here’s a quick 90-second tour.

I looked back at some of my degree notes the other day and came across something I’ve been meaning to work on for a long time. (By long time, I mean about 10 years*.) It’s based on two concepts. First, the work that Brian Toft, Simon Reynolds and Barry Turner did with respect to how disasters evolve and how we can learn from the. The second concerned how to differentiate between emergencies and crises. Bringing these concepts together gives us a model or framework for how risks become events and how these events can become disasters. ...

We seem to be pretty bad at talking to one another right now. Subjects where you might expect some general agreement with maybe a slight difference on the edges become die-in-the-ditch arguments. Arguments that rapidly spiral into unrelated areas of increasing vitriol. If you’re talking about sports, then that’s fine: we don’t expect Yankees or Red Sox fans to agree. However, we need a way to have a measured debate when talking about public safety, national security, or healthcare issues. I believe that we can achieve that by improving the deficit model for risk communications. (There’s a primer on risk perception and communications here if you’re not familiar with the topic.) ...

*Asking ‘what is risk management?’ often gets you the trite answer ‘it’s the management of risk’ or we get a list of activities associated with risk management. Neither result is satisfying and we need a better definition that explains the intent of risk management along with some clarification of what this is and is not. Here, I’ve presented some initial ideas on a definition along with four components that should give us a more thorough definition. * ...