True business resilience and business continuity management relies on knowing the risks that threaten your business and deciding your approach to addressing them.
Have you done more than a gut check to assess your risk? Risk assessment is a formal, systematic review. And there are four ways you will manage risk, all of which are strategic decisions made by senior management.
- Accept – This is a conscious, reasoned decision to do nothing. You have either assessed the likelihood of the risk is low and/or that doing anything else is too costly for the potential benefit. In any case, you are betting the risk won’t happen or you can absorb the impact if it does.
- Transfer – In this case, you are letting or paying for some other entity to shoulder the cost in case the risk becomes reality. This can be either outsource vendors, third parties in your supply chain or insurers. Either option can be viable if the cost-benefit calculation makes sense, but transferring risk offers little direct control and may not be fully effective.
- Limit – This approach is any step your organization takes to mitigate risk. For example, this can be regular data backups, promptly applying software patches, maintaining additional inventory and spare parts and cross-training personnel for key roles.
- Avoid or eliminate – The opposite of accepting risk are steps to prevent or greatly reduce the likelihood of the risk becoming reality. While usually the most expensive approach, you calculate that it will be worth it compared to the cost of impacts when an event occurs. This is when it becomes clear that business resilience should be part of how you do business. There are various ways to avoid risk.
- Can an operation be re-engineered or eliminated?
- Should a product or service be eliminated?
- Should procurement requirements be modified or should a particular supplier be replaced?
- Should new equipment or facilities be acquired?
Each risk will have its own approach. Risk management is a cost-benefit calculation that should be strategic, driven by corporate objectives, approved at the highest level and evaluated frequently.
