What it means
The first decision is what could go wrong and how severely: a warehouse faces fire, theft, injury and supply interruption, each with different causes and consequences. A fire alarm helps people respond, sprinklers can limit fire damage, safe storage may reduce ignition risk, and separating locations can prevent one event from wiping out all stock.
Avoidance may mean not taking a particular hazardous activity at all, and each choice changes a different part of the risk. Prevention aims to make an event less likely, while loss reduction limits impact after it starts, and some controls do both.
A second payment approval can catch an erroneous transfer before money leaves, and transaction alerts can speed response if one gets through. A second supplier may reduce disruption from one factory but not from a shared transport route, so map dependencies to avoid a false sense of protection from two suppliers exposed to the same failure.
Controls need owners and evidence: write down who performs a stock count, how exceptions are escalated and what happens when the usual approver is absent. A policy that staff never follow is not an effective control.
Test backups by restoring data, not just noting that backups ran, and review incidents and near misses to see whether the risk assessment missed a pathway, with training that reflects the work people actually do. Cost-benefit analysis can help prioritise, but a single expected-loss number may hide severe tail outcomes, and a low-probability event that threatens safety or the firm's survival can make prevention worthwhile even when an uncertain average saving looks small.
Legal and ethical obligations also cannot be reduced to a narrow expected-value calculation. For routine measurable risks, compare the control's annual cost with the plausible change in frequency and severity, then test whether the improvement occurred.
Insurance belongs alongside, not in place of, risk control: a policy may pay some financial loss, but it may not restore customer trust, a life or lost time. Conversely, even strong prevention may leave residual exposure worth financing through insurance or reserves.
Review the controls and cover together so an exclusion, deductible or ineffective safeguard does not surprise management after a loss. As operations change, controls can become outdated: a business opening online orders adds data and fraud risks, and a new warehouse changes the physical exposure.
Assign a periodic review and update procedures after changes in systems, staffing or suppliers. Focusing solely on last year's incident can miss the next important threat, so good risk control turns an assessment into practical action, then checks the result.
In practice
Real-world examples.
Example
A warehouse installs sprinklers and tests its evacuation process to reduce fire impact. The sprinklers do not stop a fire from starting, but they limit the damage, and the drill shows staff how to leave safely.
Example
A company requires two independent approvals for payments above $50,000. A mistyped bank account is caught by the second approver before the money leaves, which prevents a loss that a single approver might have missed.
Example
A manufacturer checks whether its backup suppliers depend on the same shipping route as its main supplier. Finding that they do, it qualifies a third supplier in a different region so a single port closure cannot stop production.
Formula
Calculation
Illustrative expected annual loss = Estimated annual event probability x Estimated loss per event
Worked example. A fictional risk has a 10% annual chance of a $500,000 loss, so expected annual loss is 10% x $500,000 = $50,000. A control costing $20,000 a year is estimated to cut the chance to 4%, without changing severity, so expected annual loss becomes 4% x $500,000 = $20,000.
The modelled reduction is $50,000 - $20,000 = $30,000. After the $20,000 annual cost of the control, the modelled net benefit is $30,000 - $20,000 = $10,000 a year.
Probabilities are uncertain, and this simplified model omits safety, tail risk and other effects.Case study
Seen in the real world.
This illustrative and entirely fictional example follows Palm Pharmacy, an invented group of stores that suffered several stock losses. Management first separated theft, recording errors and damaged goods rather than assuming every discrepancy had the same cause. It added documented access controls, shift stock checks and targeted cameras where lawful. The team trained staff, reconciled high-value items and reviewed exceptions monthly. In the invented first year, measured stock losses fell 80%, from $150,000 a year to $30,000, so the saving was $120,000.
The controls cost $40,000 to run, leaving a net benefit of $80,000 before any change in insurance cost. Its insurer later offered a lower premium at renewal, but the company did not count that outcome as guaranteed when approving the controls. It also watched whether losses shifted to other products. The case shows why a measured control process matters more than buying equipment and assuming the risk has disappeared.
Watch out
Common mistakes.
- Relying on insurance alone to address preventable safety or operational harm.
- Listing controls without assigning owners or testing whether they work.
- Using an expected-value calculation to dismiss a catastrophic or legally required safeguard.
Questions
People also ask.
What is risk control?
Practical steps to avoid a risk or reduce its chance or impact.
How is it different from risk financing?
Control changes exposure; financing arranges money to cover losses that remain.
How can a business test a control?
Assign an owner, keep evidence, simulate or audit where appropriate, and compare incidents and near misses over time.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%