Probability AND Impact

You deal with risk everyday, but did you know that risk is comprised of just two things: the probability of an event happening AND the impact of that event happening. These two things, probability and impact, can be assessed in terms of High, Medium, and Low. Once an assessment is complete, risks can be racked and stacked against one another so that the most probable risks with the highest impact get the most attention.

Risk is cause and effect based, and can apply to anything. I personally like to use if/then statements when describing a risk because they clearly illustrate cause and effect:

If X occurs, then the direct result is Y.

An example of assessing risk that is near and dear to my heart, is the risk that organizations face when they let their employees have a voice on the internets.

LET?

I use the phrase “let employees have a voice” loosely, because no matter what organization I work for I definitely have a voice. I can choose to be boisterous or discrete about my point of view in order to fit into a specific culture. I can also choose to leave a digital paper trail by using my voice on-line, or not by simply having analog conversations with friends, family and neighbors.

At the end of the day, all employees have a voice… with real opinions powering them.

Which leads me to my first point… We wouldn’t have to cringe about what an employee might say on-line if we knew what was acceptable and what was not and relayed it to them. If we let them in on what was going on, and made them feel good about what they do.

It’s not hard to create a positive work environment. Smile. Listen. Slap a high five like you mean it. Or even hand out a free hug every once in a while. Being a human being at work goes a long way toward building a great work environment.

Once you’ve created this positive work environment, you know what people will be talking about on-line. How much they love working at your organization.

SO HOW MANY OTHER POINTS ARE THERE?

Fortunately for you I only have one more. It’s about the impact to the business if anything bad should be said by an employee. First of all, impact is very easy to overstate during a risk assessment. Get a group of people together talking about risk, and catastrophic failure comes up a lot. This is why it is important to temper the impact of an impending positive or negative event with the probability of that event happening.

Going back to our trusty if/then statement structure:

If an employee says something bad on-line, then all of our customers will stop buying from us.

The impact of this statement is huge, but the actual probability of it happening is minuscule. Short of showing executive leadership involvement in dumping toxic chemicals into a public swimming pool, it would be very difficult for a single employee to be able to destroy an entire customer base with a blog post or a Facebook update. Therefore, this risk would either be low in the pecking order or would need to be reworded. A better statement may be:

If an employee says something bad on-line, then a segment of our customers may stop buying from us.

However, this statement is still not quantified. How much is a segment of business? Does it matter which segment of business we’re talking about. (i.e. some customers are more profitable than others) You get the idea. Making a risk statement as specific as possible will go a long way toward helping leadership make business decisions.

It also goes a long way toward stopping the insanity around catastrophic failure impact scenarios when it comes to employee involvement on-line.

CASE STUDY

I’m really looking at Whole Foods as a case study on this topic. The Whole Foods CEO, John Mackey, has aired his opinions on health care reform and a segment of his customers are upset about it. Time will tell if this segment activates against the brand and actually affects the Whole Foods bottom line. We should all be interested in those results.

WHAT DO YOU THINK?

Do you have the discipline to construct true, if/then risk statements? Have they worked for you? What do you think of John Mackey? Please let me know in the comments below.