When I think about risk management and the business I usually have the perspective of a business leader.
Maybe that’s because by the time I was leading a risk management function, I was already a vice president and working with the executive management team.
I was focused on helping them succeed; I was not one of the people using the tools and techniques of the specialist risk practitioner to quantify and report risk levels.
Which brings me to a situation and question that I believe illustrates an essential point in managing risk.
As an executive, I am given a report that shows that some sources of risk are at undesirable levels. (I will let you decide whether that means they exceed risk appetite, risk tolerances, risk criteria, risk limits, or are simply too high in our judgment.)
So what?
What should we do about it?
Let’s say that we understand how these sources of risk might affect our business, the likelihood of achieving our goals and objectives, our personal and enterprise success.
Of course, that is not usually the case with risk reports, but let’s assume the level of risk has been translated effectively into actionable business language.
I still ask “So what? What should we do about it?”
You might say that we need to apply a risk treatment. (That sounds like applying…
