The paradox of risk management

Organisations operate in a world full of uncertainty. From economic downturns to cyberattacks, unforeseen events can derail even the most carefully crafted plans.

In today's dynamic market, risk management isn't an outdated periodic exercise for the overly cautious, conservative CFO. It has become a necessary, forward-thinking strategy for navigating uncertainty, separating the prepared from the vulnerable. Yet in SMEs the adoption of a formal risk-management process is often limited, perhaps because it is perceived as a complex, time-consuming burden, or because its benefits are not fully appreciated.

Understanding risk

A clear understanding of risk empowers organisations to navigate uncertainty effectively. Is risk simply a threat, or can it also present opportunities? A broad definition commonly used in the literature runs as follows:

Risk is the expression of the likelihood and impact of an uncertain, sudden and extreme event that, if it occurs, may impact positively (opportunity) or negatively (threat) on the achievement of a project or an objective.

This definition addresses, first, the uncertainty of any event that could affect the organisation or its objectives, and combines likelihood with potential impact so that risks can be prioritised. Second, it makes clear that the impact can be positive (opportunity) as well as negative (threat). Both aspects matter equally. Warren Buffett put it well: "Risk comes from not knowing what you're doing."

The two objectives of risk management

By proactively managing risk, organisations safeguard stability and continuity. But a forward-thinking approach goes beyond guarding against threats; it can also uncover opportunities and create value. The objectives can be summarised in two ways:

1. Risk management as protection. Identifying, measuring and controlling risks to minimise negative impact and ensure stability and continuity. An overly cautious approach, however, can stifle innovation and limit growth, so a balance between protection and calculated risk-taking is essential.
2. Risk management as value creation. A well-designed programme can be a source of competitive advantage. It lets an organisation view and manage risk holistically, at corporate level by limiting net exposures (crucial for access to capital) and at business-unit level by ensuring all material risks are evaluated by the people closest to them.

The paradox

The paradox of risk management arises because organisations must balance these two objectives. Overemphasis on protection leads to excessive risk aversion, hindering value creation. Too much focus on value creation results in inadequate control, jeopardising stability. The goal is not to eliminate all risk. As Nocco and Stulz (2006) note, companies are in business to take strategic and business risks; a company should have a comparative advantage in bearing firm-specific risks, because it knows more about them than anyone else.

By reducing non-core exposures, a company can take on more strategic business risk and seize more of the opportunities in its core business.

The key to navigating the paradox lies in a balanced approach: protecting the organisation from threats while uncovering opportunities and creating value.

The value of risk management

Embracing this paradox is an exciting opportunity for the CFO. By fostering a culture of informed risk-taking, the CFO can champion a practical framework that need not be complex or burdensome to begin with. It supports a culture of risk awareness and empowers every level of the organisation to make informed decisions based on a clear understanding of the risks and opportunities at hand.

This framework should be a living document, continuously monitored and improved. Regular reviews keep it aligned with evolving strategic objectives and the organisation's risk profile, and incorporating lessons from past incidents and near misses strengthens it over time. A well-designed framework helps identify and mitigate threats before they escalate, while uncovering promising opportunities. Companies are in business to take risks, but successful companies take calculated risks guided by a comprehensive strategy.

Let's discuss

Is your risk-management approach balanced and aligned with your strategic objectives? Is your organisation missing opportunities, or is it over-averse? A fresh look at the risk-management practice in your organisation can optimise strategy and unlock growth.