Fundamentals of Risk Management

159

---

Risk assessment
160
TAbLE 
14.1
Defining the upside of risk
Fewer disruptions to normal operations and greater operational efficiency resulting 
in less downside of risk 
Ability to seize an opportunity because competitors did not identify the cost-effective 
solution to a risky feature of a contract 
Specifically identifying positive events during the risk assessment and deciding how 
to encourage those events
Opportunity management, by completing a detailed review of a business opportunity 
before deciding to embrace it 
Achieving a positive outcome in difficult circumstances as an unintended and/or 
automatic result of good risk management
Another interpretation of the upside of risk is that the risk assessment workshop 
should also focus on identifying risks that have an upside outcome. The risk assess-
ment workshop would therefore address questions like: ‘What events would create
a better outcome than expected?’ A register of positive outcome risks can then be
identified and actions can be taken to make those upside risks more likely to occur 
and/or have more beneficial impact and consequences when they do materialize.
A more satisfactory explanation of the upside of risk is that the organization
will be able to undertake activities that it would not otherwise have the appetite
to undertake. In a commercial sense, this is enabling an organization to seize a busi-
ness opportunity that a competitor does not have the appetite to take, or considers 
to be too risky. This may be because of the greater efficiency within the organization, 
or because a cost-effective means of changing the organization by a development 
project has been identified that the competitor failed to recognize. On a strategic 
level, this upside of risk may arise from the organization identifying a means of 
targeting the business opportunity, but only the profitable component of that busi-
ness opportunity.
A further way of looking at the upside of risk is to reflect on a business venture 
that turned out successfully in circumstances where failure could have been foreseen. 
This is a somewhat retrospective approach based on the analysis: ‘that could have 
gone wrong, but it did not and therefore we have enjoyed the upside of taking that 
risk.’ This approach to the upside of risk depends on the organization being willing 
to pursue a risky venture, albeit with adequate controls in place, that leads to a 
positive outcome in circumstances where a competitor may not have been willing
to take the risk.
Finally, there is the analysis of the upside of risk that reflects on the benefits of 
having a robust risk management process. Achieving the MADE2 benefits, especially 
benefits related to mandatory obligations, may be considered to be a sufficient reason 
for undertaking a risk management initiative. In these circumstances, certain organ-
izations may consider that achieving compliance with mandatory obligations is an 
upside of risk.

---