Although there are many definitions of risk, there seems to be agreement that risk is a negative notion, based on the possibility that exposure to a situation or an event can cause damage, harm or loss. In actual fact, we face risk all the time, everywhere, we just do not think about it so that we do not go crazy. What if a devastating earthquake happens and my house collapses? What if I get attacked by a crazy person or a dog? What if I get a stroke or an aneurism? What if…the list is endless. So we go about our lives not really bothering too much about these seemingly improbable events…until one happens. Some people try to mitigate some of these risks by living healthily and doing regular medical check-ups, by taking on insurance policies and/or setting up security systems etc. However, not all risk is on such a life-altering level, and neither are all damaging occurrences so rare.

Therefore, it is considered wise to be proficient in how to assess risk, to know how probable it is for such situations to occur and what their impact on your life could be. Then, of course, you would be more able to make decisions on what you can do to (a) lower the chances of it happening and (b) what contingencies to put in place if it does happen.

The insurance industry has made a whole science out of this, and that’s how they calculate how much a policy should cost. The higher the probability of something bad happening, the higher the premium, since the insurance companies know that they will get many claims. Also, the higher the potential damage, the higher the premium, depending on how low the probability is of the damage happening. Even if it is not a regular occurrence and therefore there would be very few claims over a lifetime, each claim may be very costly. It’s a balancing act.

Whether it is in our personal life, at governmental level, in industry, corporate or business environments, or in project planning, a risk assessment becomes a necessary process. Therefore, at Malta Business School we cover risk assessment in a variety of courses; whether in business and management, operations management, or project management, amongst others.

 

Step 1

The first step, we advise, is to do a brainstorming exercise, listing all the possible risks that your business or project can face, no matter how likely, remote or severe. In many ways this could qualify for the ‘Threat’ Quadrant of a SWOT exercise, discussed further in Edition 10 of Empowerment Through Knowledge.

 

Step 2

Once you have done your brainstorming you may still continue coming up with more situations as you go along, but it is time to apply the Risk Assessment Matrix. It is generally depicted as a 3×3 or 5×5 matrix, with the horizontal side being the level of impact or severity, and the vertical side being the probability level or likelihood of the event happening. In the simpler 3×3 version, one would use Low, Medium and High levels, while in the 5×5 version one would fine-grain the levels by adding a medium-low and a medium-high level. So the probability levels would look something like: very likely, likely, possible, unlikely and very unlikely; while the impact levels could be named: negligible, minor, moderate, significant and severe. As long as there is a grading of probability and impact that are clearly understood, the terminology used is less important.

As you can see from the table, the different sections have different colours. Starting from the bottom left-hand corner, you have the green zone, the negligible or low impact situations, with a low probability of occurrence. Each situation should be assessed on its own merits, and objectivity (avoiding wishful thinking or head-in-the-sand behaviour) is highly recommended. However, in general, these situations should be assessed quickly and ignored, since they are unlikely to happen, and even if they do, they create negligible damage. Hence, you would be able to take them in your stride.

 

Step 3

The other extreme, the top right-hand corner, is the red zone where you would be dealing with high impact situations that are likely to happen. These need to be analysed very carefully. It is imperative that the damage done if (or when) such situations do happen, is assessed so that you can (a) try to mitigate the risk of something like this happening and (b) create contingency plans for when they do happen. Not doing this can mean the failure of a whole business or, at best, very expensive delays to a project.

In between the red and the green zones, we have a variety of sections with varying levels of probability and impact. The amount of time and effort invested in each risk that you place in any of these sections will require some critical thinking and decision-making on your side. For each one, you will need to make sure that you can have business or project continuity, without going overboard with what you need to do to mitigate it, avoiding the creation of higher costs than if the event actually happens. So, assess the likelihood and the severity of each situation, and decide how to avoid going from the frying pan into the fire, and plan out what you can do if you actually get burned.

 

Two real-world examples that most of us can relate to

COVID Lockdown

This was a high-impact situation on many businesses. The likelihood of it happening would have been considered very low, except for the fact that the WHO had been warning the world about pandemics for quite some time, and different regions did experience similar events in the last few decades, whether SARS, MERS or Ebola, just to name a few. Finally we had what is sometimes known as a ‘Black Swan’ event, and it hit everywhere.

Businesses that already had a delivery service suffered much less than those that did not. Some even prospered. Businesses that had a strong online offering and a good e-commerce platform, again, did much better than those that relied on a high-touch, face-to-face process only.

 

Street-closure for 3 months

This happens, and it can drive a small business, such as a shop or restaurant into the ground. The severity will depend on the length of the closure, and on how severe the closure is. Are they going to leave a passage to your door or not? Still, the impact is not negligible, and needs to be assessed well. The likelihood of such an occurrence? In Malta… much more likely.

Again, it is important to have an ear to the ground with respect to local councils, roads departments, etc, so that you can have some preparation time if you do find out that it is going to happen. Although such situations are hardly avoidable, since you have no control over the public sector bodies involved, having contingency plans becomes even more important. The online offering and e-commerce platform, together with a delivery service, is one popular way nowadays. A hairdresser or nail-technician could start offering haircuts and nail-care at home to their clientele, thus strengthening the loyalty of these customers. Perhaps they could even offer hair- or nail-care parties at the house of a good client (similar to the Tupperware parties) where other customers are invited. A restaurant could opt for a food truck, or a shop could set up a pop-up shop.

 

Conclusion

Lower impact risks could include having a power cut, a move by a competitor, or a new competitor encroaching onto your turf, for example. The list of risks is varied depending on your particular situation, whether it’s a business in a specific industry, a public service department, a special project, or just everyday life. In Maltese we have an apt expression that is very relevant: “Ahseb fil-hazin halli t-tajjeb ma jonqosx”. In a similar tone, there is a business saying that goes: “What you don’t know can harm you.” So be prepared, as the scouts would say.