I HAVE conflicting feelings about ISO 31000’s definition of risk. This standard defines risk as ‘the effect of uncertainty on objectives’, a definition that succeeds at simultaneously being both clear and enigmatic.
Witness the various discussions in LinkedIn about what the definition means. Look around the web for many online blog entries, articles, and explanations of what the definition mean, and carefully note the certitude shown by those who wrote those online materials about what the definition means. Notice how they differ in their understanding.
In light of the absence of any clarifying remarks by the writers of the standard (who seem to be non-existent on the internet) about what they meant by their definition, I have settled on my own understanding of what they meant.
Their definition seeks to succinctly explain the nature of risk. When they say ‘effect’, they mean ‘phenomenon’. They don’t mean ‘consequence’ as many online writers seem to think. (Or at least, the standard writers should not have meant ‘consequence’ in sense of a risk eventuating bringing forth its consequences!). The reason why I feel certain ‘effect’ is not ‘consequence’ is because risk is about something that has not yet happened. If something has not happened, it has no consequence. Had they said, ‘risk is the potential effect of uncertainty…’, then it would clear they would have meant ‘consequence’.
My current position is that the standard writers are attempting to explain in the definition what the essence of risk is.
The best way I can think of of what they are saying is by making an analogy, comparing ‘risk’ with ‘shadow’. I will propose a definition of the word ‘shadow’:
the effect of an opaque, solid object on a light source.
I like this analogy because it almost perfectly parallels the ISO 31000 definition of risk. If you have objectives, and you have uncertainty, the intersection of the two brings forth a phenomenon which we call ‘risk’
If you have a light source, and you have an opaque, solid object, the intersection of the two brings forth a phenomenon which we call ‘shadow’.
Remove either objectives or uncertainty, and risk disappears. No intersection, no risk. Remove either the light source or the solid object, and the shadow disappears. No intersection, no shadow.
I have two criticisms for the risk definition though. First, the definition, while strictly correct, is near to being useless. It is an academic, technical definition, not an operational definition that can be acted upon by practitioners ‘in the trenches’. How would risk practitioners explain risk to lay members or board members of the organisation using such a definition?
My second criticism revolves around the use of the word ‘objectives’. The Merriam-Webster definition of objective is “something toward which effort is directed : an aim, goal, or end of action”, accurately reflecting the normal day to day usage of the word to mean something that is being strived for, something to be achieved, something not yet.
But risk is not always (nor even most of the time) about something you wish to achieve. It is often to protect what you already achieved.
What you already have are also at risk.
Strictly speaking, if you have good health and you have a desire to maintain that good health, then you sometime speak of such an objective: to maintain my good health.
But what about other things? People do not consciously state that their objective is to ensure that they keep on having a house. Or that their objective is to remain alive. They have an interest in ensuring they remain alive. They have an interest in ensuring their house remains liveable by them. But they are not objectives in the same degree as things they are striving to achieve, such as a job promotion, completion of a project, and so on.
Your health, your job, your finances, your properties, your relationship. your client list, your market position, your current operating efficiencies, your reputation, etc. are all at risk. These are things you have already achieved; objectives you already attained. You are interested in protecting them; they are your interests.
Risk management is (far more) often used to protect existing interests, while also being used as an aid in ensuring we achieve our objectives. It is in the former where risk management plays a more central role. Risk management is key to maintaining what we have; it is the means there. It is only useful in achieving what we do not yet have; here it is not the means.
My proposition is therefore to change the wording of the risk definition from ‘objectives’ to ‘interests’. Thus risk becomes: ‘the effect of uncertainty on interests’ where interest refers to things we value, such as health, reputation, property. But it also clearly encompasses as well as things you seek to achieve but have not yet -- your objectives.
I think this change would be an improvement to the definition.
