What is Risk?

Most people think a risk is something bad, which is often, though not always true. More specifically, a risk is a future event that would have a significant impact on you or something you care about if it should happen. The effect may be bad (threat) or sometimes good (opportunity).

You and I – every single one of us – live in a world of risk. Risk is uncertainty. It’s future tense, as opposed to “problem,” which is present tense.

We often manage risk by denial, declaring ourselves helpless in the face of implacable destiny, or checking our horoscope to find a propitious day to ask for that promotion. We deny the existence of randomness by chanting self-help mantras – “I’m good enough, I’m smart enough, and doggone it, people like me!” – declaring ourselves solely responsible for all that befalls us.

There is, however, a science of risk. We tend to notice the work of risk professionals only when they fail, when the patchwork of convertible debt swaps backing subprime mortgages unravels due to faulty pricing. But it’s not only the economy, stupid. Risk managers keep airplanes in the air, buildings from collapsing, and secure every bit of a modern infrastructure.

Fundamental Concepts of Risk

A risk event may be likely, or it may be unlikely. You have to take into account both the severity of the impact and its likelihood.

How likely is it that this risk will occur? Sometimes we know with mathematical certainty. More often, the best we can do is guess: pretty low, or almost certain. Impact can sometimes be turned into a number: $1000, or €50. Other times, it’s about as specific as that scene in Ghostbusters when Egon explains what will happen if they cross the streams: “It would be bad.”

The standard risk formula is R = P x I, or the value of a risk is its probability times its impact. That’s particularly helpful in pricing financial risk. If there’s a 10% chance of something happening that would cost you $1,000, then the value of the risk is $100. That means if you can get rid of the risk for under $100, it’s clearly profitable to do so. If it will cost more than $100 to get rid of the risk, you have to consider whether other factors justify the additional cost.

Because risks can be threats or opportunities, you have to know the difference between a “pure risk” and a “business risk.” A pure risk is all downside. If you didn’t get in an accident today, you’re not better off — you avoided becoming worse off.

A business risk — a stock market investment, for example — has an upside and a downside. There is a possibility you will make money, and a possibility you will lose money. The risk formula’s P x I has to be determined for the upside and for the downside, so you can see how the risks balance. If the result is favorable, that’s an argument for the investment; if it’s unfavorable, perhaps not.

For example, let’s say you’re offered an investment for $5,000. In return, you are guaranteed a 70% chance of $50,000, and a 30% chance of losing your investment. That works out to an expected monetary value of $33,500 (the value of the opportunity risk [$35,000] plus the value of the loss [-$1,500]).

But the real outcome isn’t $33,500. You’ll receive either $50,000 or lose your $5,000. There are three possible strategies — bet on the upside (go for the $50,000), hedge the downside (avoid losing the $5,000 by not betting), or bet the expected value (take the investment because an expected $33,500 means more than keeping an actual $5,000).

Your personal choice may be influenced by how much is in your bank account.

Ways to Manage Threat Risk

• Avoidance (change the environment so the risk no longer exists)
• Transference (give or sell the risk to someone else; buying insurance is a common risk transfer strategy)
• Mitigation (do things to reduce likelihood or impact of the risk, even if you can’t get rid of it completely)
• Contingency planning (come up with a plan to follow if the threat should start to develop or seem likely)
• Acceptance (ignore it for now and deal with it if it happens)

Ways to Manage Opportunity Risk

• Exploitation (take the value and cash it in)
• Enhancement (try to grow the value to a higher level)
• Sharing (give, trade, or sell the value to someone else
• Contingency planning (come up with a plan to follow if the opportunity should start to develop or seem likely)
• Acceptance (ignore it for now and deal with it if it happens)

Residual and Secondary Risk

Most risk strategies can’t get rid of every bit of risk. You start with an initial level of risk, and whatever’s left after you identify your strategy is the residual risk. You can come up with additional ways to reduce the residual risk further, but at some point you normally accept some level of residual risk and move on. We take our lives in our hands every day we get behind the wheel of a car, but really, what choice do most of us have?

Secondary risk is new risk created by your proposed solution to the original risk. If you spend time and energy to get rid of Problem A, and that means less attention to Problem B, it’s possible you’ve made things worse overall. Make sure you inspect any proposed solutions for secondary risk before rushing to implement them.

* * *

While some risk tools are enormously sophisticated, and their use only appropriate for specialists, you and I can use many of the techniques of experts to make our lives safer more prosperous and more successful.

We don’t want to sweat the small stuff, but the truth is, it’s not all small stuff. Some risks we can, and should, accept.

Others, we can't — though sometimes we have to.