Career Forum / Expert Insights / Home

Managing Risk

When people hear “risk management” they often take it as a signal to change the conversation. What these people may not understand is that effective risk management can be the difference between failure and success. The world in which businesses operate today is volatile, uncertain, complex and ambiguous. Whether your business is a start-up, rapidly growing, or matured, understanding and applying risk management principles will reduce the chance of failure, and position your organisation for success.


Risk management is something we all do every day. For example; if we know there is a traffic jam that poses the risk of us arriving at work late, we have two choices: Leave home earlier, or drive to work faster. Our intuitive risk management tells us to leaver earlier, and drive safely.

The process we inherently use is:

  1. Think of what negative consequences could happen
  2. Judge whether these consequences are minor or major
  3. Think of ways to protect ourselves and others from these consequences
  4. Regularly check that we and the people we care about are protected

In business, risk is managed in a similar way:

  1. Identify
  2. Assess
  3. Mitigate
  4. Monitor

First, identify potential risks – what negative consequences or impacts could happen that will get in the way of achieving my goals?

When identifying risks in your business, the first important step is to understand the context – why are you identifying the potential risks? One relevant example is that you could be considering merging with another business and you want the merger to be successful.

Once you understand the context it is best to involve as many relevant people as you can in the risk identification. (Relevant people are those who have a stake and an understanding of the context.) If it is for a merger, then representatives from both businesses should be involved.

Once you understand the context and you have the right people, you can ask the right questions. If you are considering a merger, you may ask: What could make this merger unsuccessful?

There is no such thing as a risk not worth identifying. the more risks you identify, the more risks you can protect against, the stronger your business, and the greater the chance you will achieve your goals. Remember: you can’t manage your risks before you know what they are.

The second step is to assess the size of each identified risk to determine how to spend resources managing it. Use two factors to assess the risk: Likelihood and impact (see table below). For example: if you are launching a new product, there is a risk that your staff will not have the skills to sell it.

To assess this risk using the two-factor scale, you would ask two questions:

  1. What is the likelihood of my staff not having the right skills – low, medium or high
  2. What would be the impact if my staff couldn’t sell the product – low, medium or high

You may decide likelihood is high, as the product is new and staff aren’t skilled, and that the impact is high, as it is a key product that has required a lot of investment. Therefore, the risk is high and must be addressed.

The third step is to select a strategy to manage, or mitigate, the identified risk. For example: to manage the risk mentioned above, you could recruit new sales staff, outsource the sales function or provide training to the sales team.

When selecting your strategy, consider cost vs benefit. There is always a cost involved in managing risk, as it will usually require resources. It is important to ensure the cost of the risk mitigation is less than the cost of the negative consequence.

Finally you need to monitor your chosen risk management strategy to ensure it is working effectively. If not, you should change your strategy. For example: If you have decided to train your staff, you could test you team on product knowledge and sales skills. If they have failed to gain the skill required to sell the product, you need to go back a step and select a new strategy.

Risk management is an uncomplicated process that will save you from many complicated problems. Remember the 4 steps: Identify, Assess, Mitigate & Monitor, and maximise the chances of your success.



Gabriel Helmy is the founder and CEO of The Capacity Specialists, a learning and development service provider, and has been in Cambodia since 2008. In Cambodia, Gabriel has consulted and provided training in risk management for microfinance institutions including Prasac, Sathapana, HKL, Amret, Kredit & AMK. Prior to that, Gabriel worked in the Australian financial sector for almost 20 years, primarily in the fields of banking and risk management, including for three of Australia’s four major banks.


Contribution by Gabriel Helmy, The Capacity Specialists