Posts

It was the highpoint of a recent meeting with a large firm’s corporate security team. While we were showing them around DCDR, the CSO leaned over to a colleague and said “I love the simplicity“. Cue smiles from our side…. Our intent was always to make the best piece of risk management software possible and a key part of that was to keep things simple. However, as time goes on, it’s easy to lose sight of the original concept, to add ‘just one more feature’ and eventually end up with a Frankenstein’s monster which looks nothing like your original idea (and that everybody hates). ...

Failure is not Definitely an Option People agree that starting a business is risky and although the failure rates might not be as dire as people like to say, 20% fail in their first year and only 50% make it to five years. A decade in, only 30% are still around (Stats courtesy of Fundera.). A tech startup takes that to a whole new level because of the additional layers of uncertainty that technology imposes. Startup’s risks are significant. ...

Conducting a risk assessment is a big project and, like any big project, there are a lot of things between you and success. However, there are five common risk assessment problems that crop up time and time again. These make the difference between success and failure no matter what else you do. Keep these five problems in mind and plan accordingly to maximize the chances of success with your next risk assessment. ...

I received an email a while back from someone just making their start in risk management asking if I had any thoughts or advice on the risk management skills they needed. The response quickly became several pages long and I thought it was worth turning it into a blog piece that others might benefit from. This could also be titled ‘Letter to a 30-year old me’ or a 40-year old me.. ...

In some ways, all risks can be considered subjective for two reasons. Firstly, how we perceive risks is a very personal matter based on in-built biases, the experiences we have had and our current situation. An example from a well-known risk textbook is an icy sidewalk. A child might see that as a fun thing to slide on so their perception is that there is no risk. A retiree will perceive this as a high risk as their chance of falling and becoming injured is higher and more debilitating. If a kid falls, they usually just get up and carry on with what they are doing. ...

Two major events are going to happen in US within the five years. One is a replay of the US subprime mortgage collapse which spawned the 2008 financial crisis. The other will occur when the bubble of college debt bursts. Both events – one of which may well trigger the other – will cause massive strain on US banks with potential global repercussions. This isn’t a bold claim. There are lots of people, all of whom much more familiar with this kind of risk than I am, sounding similar alarm bells. For example, the day after I started writing this, the Financial Times’ editorial was on a similar topic. And there may be other significant events that occur in addition to these but making forecasts about what’s going to happen isn’t the point of this article. ...

Happy September! I’m a big fan of September for several reasons: the weather is cooling down, vacation-time is over, fall race season is starting (well, it is normally) and there’s a lot of pie-ready fruit available (I love pie). However, one reason I really like this month is that September is a great month for getting things done. And if you have any plans to build or update your enterprise risk management system by the end of the year, this might be your last chance to get started.** ** ...

We often say ‘the devil is in the detail’ meaning that it is the small things that will catch us out. But sometimes the problem begins by looking at the details in the first place. Don’t get me wrong, I’m a fan of details. I believe the more planning and specificity you can put into something, the better. The problem occurs when we jump into the details too quickly. Instead of starting with a strategic perspective, we dive right into the weeds. ...

“The first rule of snakes [problems] is, if you see a snake, you kill it….Just take care of it” Jim Barksdale, former CEO Netscape It’s rare for an event to be truly unexpected. We know that our personal habits affect our health. We know that incorrect use of tools and machinery can cause injury. We know that small-scale corner-cutting leads to more serious infringements. We know that running complex systems – like drilling rigs or nuclear power stations – beyond established safe parameters can be catastrophic. ...

This post originally appeared on Quora in response to the question ‘What is a risk mitigation plan?’ Link What is a risk mitigation plan The risk mitigation plan is a series of specific actions or steps you will take in response to a risk once you have completed your risk assessment. However, before you start to develop the mitigation plan in detail, you need to determine a general course of action based on one of five main options: avoid, tolerate, treat, transfer and terminate (A4T). Which of these is most applicable will depend on your risk tolerance (short term), risk appetite (longer term) and what you can reasonably achieve with the resources available (ALARP). ...