What it means
Every commercial decision involves accepting some risk in exchange for a return, so risk management is really about making those trade-offs deliberately rather than by accident. A structured approach turns vague worries into a list that can be ranked, owned and reviewed.
The standard cycle has four steps: identify risks, assess them by likelihood and impact, respond, then monitor. Responses fall into four broad choices, usually summarised as avoid, reduce, transfer or accept, and most real situations end up as a blend.
The financial value of the discipline comes from comparing the cost of a control with the loss it prevents. Spending $90,000 on a backup facility is only sensible if the expected loss it removes is comfortably larger, and putting numbers on both sides turns an argument about caution into an investment decision.
In practice most organisations maintain a risk register: a table listing each risk, its owner, its likelihood, its impact, the controls in place and the residual risk that remains afterwards. Boards typically review the top ten entries quarterly and set an appetite statement describing how much risk they are willing to carry in each area.
The most common failure is treating the register as paperwork. A risk framework only earns its keep when it changes real decisions, such as choosing a second supplier, raising an insurance limit or walking away from a contract whose penalty clauses are larger than the margin.
In practice
Real-world examples.
Example
A software company holds 70% of its recurring revenue in one client. It classes this as a high-impact, medium-likelihood risk, sets a target of no client exceeding 30% of revenue within three years, and reports progress against that target at every board meeting.
Example
An importer buying in euros and selling in dollars faces currency risk on every order. Rather than guessing at rates, it hedges 60% of forecast purchases twelve months forward, accepting a small cost for a much narrower range of possible outcomes.
Example
A care home operator reviews its insurance after a near-miss with a faulty lift. It finds cover for equipment failure but not for the loss of income while a wing is closed, adds business interruption cover, and records the residual risk as accepted at the new, lower level.
Think of it
“Risk management is identifying what could go wrong and preparing to deal with it.
Formula
Calculation
Expected Loss = Probability of Event x Financial Impact of Event
A food distributor identifies the risk that its single cold storage site loses power for more than 24 hours. Based on regional outage history and the age of the equipment, it judges the annual probability at 15% and the impact, being spoiled stock plus lost contracts, at $2,000,000. Expected loss is 0.15 x $2,000,000 = $300,000 a year. A standby generator and monitoring contract would cost $90,000 a year and would cut the probability to 4%, giving a residual expected loss of 0.04 x $2,000,000 = $80,000. The reduction in expected loss is $300,000 - $80,000 = $220,000, so the net annual benefit is $220,000 - $90,000 = $130,000 and the control is clearly worth buying.Case study
Seen in the real world.
Marlowe Instruments is a fictional maker of laboratory equipment, used here as an illustrative example. Its risk register listed 46 items, all colour coded, and the board reviewed it once a year in about ten minutes.
When a specialist supplier of a single sensor component went into administration, Marlowe found it could not ship its main product line for eleven weeks. The risk had been on the register for four years, rated medium, with no owner and no action recorded against it. The lost margin came to roughly $1,400,000.
Afterwards the company rebuilt its approach around a much shorter list. Twelve risks, each with a named owner, a quantified expected loss and an agreed control budget, replaced the 46-line table.
Single-source components were mapped and dual-sourced where the expected loss exceeded the cost of qualifying a second supplier. The illustrative lesson is that a long register can be far weaker than a short one that someone actually owns.
Watch out
Common mistakes.
- Confusing risk management with risk elimination, which leads to over-control, slow decisions and missed opportunities that competitors take instead.
- Building a register that lists risks but names no owner, so nothing is done between reviews and the document becomes a record of known problems rather than managed ones.
- Ignoring correlation, and assuming a recession, a customer default and a funding squeeze are independent events when they usually arrive together.
Questions
People also ask.
What is risk appetite?
It is a board-level statement of how much risk the organisation is prepared to accept in pursuit of its goals, which gives managers a reference point for day-to-day decisions.
What is the difference between inherent and residual risk?
Inherent risk is the exposure before any controls are applied, while residual risk is what remains after the controls are in place and working.
Can small businesses do this without a formal framework?
Yes, a single page listing the five things most likely to sink the business, who owns each and what is being done, delivers most of the benefit at almost no cost.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%