The Risk Assessment Landscape Map
A Method For Evaluating And Managing the Risks of A Business
Developed by Bob Norton
Too often, managers focus solely on the probability of a risk or problem happening and ignore far more important factors such as the cost of failure and the ability to actively manage each risk as more is learned. To properly manage a business risks must be evaluated and monitored constantly. Steps can usually be taken to adjust the three main risk factors before and during any project. The three main factors that should be evaluated and tracked are: 1) The cost of a failure, 2) The probability of a failure and most importantly 3) The controllability, or ability to manage, the risk. Each of these factors must be taken into account to properly manage any risk at the beginning of any project and each time major new pieces of information become available that impact those risks. Because human beings tend to be able to think in only three physical dimensions in addition to time, it is important to clearly communicate to people who only spend a small fraction of the time you do on a subject, by clearly showing complex concepts on two dimensional paper or slides. Sometimes a very complex concept can be broken down into several layers, or several two dimensional graphs, so that each accurately addresses two or three of the possible five or six dimensional problem. This allows people to both grasp and focus on certain issues. I have developed the following risk assessment diagram specifically for this purpose. Used in conjunction with a Market Landscape Map, it can be a very powerful tool to evaluate a market entry strategy, a new business opportunity or even a business as a whole. What is important, although sometimes hard to do, is to develop it in the context of specific assumptions that are fairly narrow. For example, you must do this for a specific product or service against a single vertical market or niche, not against several, as the risks will almost always be vastly different from niche to niche or market to market.
Frequently, identifying and managing risk is the major way in which a company can avoid disasters and achieve success. Larger risks, can generate larger rewards, and can be taken when those risks are very manageable or when the cost of failure is not too high. Larger risks can also be taken when these unknown factors will be revealed more quickly and the task can be abandoned earlier and at a low cost, based on certain risk milestones. Typically young companies can alter course easily, while larger more established companies often have too much momentum and overhead to be agile. Therefore, large companies need to look out in time further and change course much sooner. The diagram is a great tool for accessing risks and watching them closely. It can be easily updated over time and will help people understand the three major dimensions of risk, not just the probability of failure because taking risks should not be viewed as just a binary yes or no decision. Expected milestones, or deflection points, can sometimes help limit the risk and allow you to take larger risks without necessarily incurring the full cost of failure. In other words, manage these risks closely as you learn more and make changes when new information becomes available.
For this exercise to be useful, it must be done in the context of a set of specific assumptions that include both the current state of affairs and certain goals. For example, this chart can be used to assess each niche or vertical market that could be entered with a particular new technology. However, the ability to identify these risks and to rate their probable failure costs and potential for success is an exercise that requires a lot of business experience and a good understanding of the market space. Virtually everything has a small probability of failure, and confusing self-confidence and passion with absolutely no risk is dangerous, so err on the side of listing every risk initially; whether costly or uncontrollable. You must brutally confront the facts and ignore all bravado and self-confidence when doing this exercise. Anything that is not 100% in your control is a potential risk. I do not recommend you rate every generic risk that every business has in a given situation such as overall competitive risk (from everyone and anyone), raising capital, and losing key employees. These are known risks that everyone faces and must be managed every day, but are generally less controllable. However, competitive responses from specific, formidable competitors should be shown to help evaluate and tune the business model, product or other factors. Tracking generic risk will probably fog up your landscape map and take the focus off the important risks you can manage more closely and can have an impact on through business model changes.
I recommend that every business undertake this exercise to evaluate any new investment or business opportunity. It should take only a couple of hours for a senior management team to complete this task and can be the difference between success and failure as it provides the opportunity to tune your business. It is also a powerful tool to evaluate and communicate the risks of an entire business venture for any investment. If all the risks are down in the lower left quadrant, this is probably a great investment (assuming the economics of the business will work), but if there are multiple risks that are in the top right quadrant then the business can fail no matter what management does. However, this process can often lead to changes in a business model that “design out” these risks and drive them down and to the left on the chart. This exercise in business design can greatly increase your chances of success long before an investment begins
Instructions for using this chart. The four steps to risk assessment and management:
1) Make a complete list of all risks specific to your situation (the situation must be well defined and bounded)
2) Place a probably of failure on each risk from 5% to 99% in this list (this will determine the relative size of the risk bubble you will draw). This is best achieved through true brainstorming with all possible risks listed initially. Then narrow the list to the biggest six to twelve risks to draw the risk map.
3) For each risk select a location on the map based on the relative cost of failure (vertical) and its controllability by you (horizontal axis) and place a risk bubble on the chart of the appropriate (relative) size.
4) Now you can ask smart questions about how you could change the situation, or your business model, product or design, to pull these risks down and to the left to increase their controllability, reduce their probability of happening and/or reduce the cost or timeline for failure. Real “out-of-the-box” thinking is required here and so an outside consultant can be very helpful.
Like many good documents, this should be a living and breathing thing that is updated as circumstances change and more is learned.
Like so many things, this exercise is useless without the right expertise and many years of appropriate experience in the room. This is a subjective exercise that must be based on real-world experience. Certainly all five key business disciplines must be represented. This might be five people or just three, but it is not likely to be one or even two people. You also need to have the right research and information on the market or problem available and it must be very well understood by your team. If you think there are fewer than a half dozen risks then you probably need to go back and do some more work, as not many businesses will have that small a list of risks. After deciding to move forward you can assign each significant risk to a specific team member to watch and manage and then revisit them every few months, or whenever new information becomes available.