Risk events from any category can be fatal to a company’s strategy and even to its survival.Ĭompanies should tailor their risk management processes to these different risk categories. Sources of these risks include natural and political disasters and major macroeconomic shifts. External risks arise from events outside the company and are beyond its influence or control. Strategy risks are those a company voluntarily assumes in order to generate superior returns from its strategy. Examples are the risks from employees’ and managers’ unauthorized, unethical, or inappropriate actions and the risks from breakdowns in routine operational processes. Preventable risks, arising from within the organization, are controllable and ought to be eliminated or avoided. Kaplan and Anette Mikes present a categorization of risk that allows executives to understand the qualitative distinctions between the types of risks that organizations face. But rules-based risk management will not diminish either the likelihood or the impact of a disaster such as Deepwater Horizon, just as it did not prevent the failure of many financial institutions during the 2007–2008 credit crisis. Many such rules, of course, are sensible and do reduce some risks that could severely damage a company.

Risk management is too-often treated as a compliance issue that can be solved by drawing up lots of rules and making sure that all employees follow them.

Tight magazine 2012