Describing risk as “uncertainty that matters” allows for different types of consequences, and leading standards and guidelines define the concept of risk to include both upside as well as downside impacts.

By Dr David Hillson

This means that the word “risk” can be used to describe uncertainties which if they occurred would have a negative or harmful effect, and the same word can also describe uncertainties which if they occurred would be helpful. In short, there are two types of risk: threats and opportunities.

Accepting this in principle is one thing; using it in practice is another. The traditional risk process (initiate, identify, assess/analyse, plan responses, implement, review) can clearly be used to handle both threats and opportunities. But people who have only used this process to identify and manage threats sometimes have problems extending it to deal effectively with opportunities. And the difficulties start right at the beginning: how can we identify opportunities?

Risk as opportuntity

The first step is to be clear about what we are looking for: uncertainties which might or might not occur, but which if they did happen would help us to achieve our objectives, for example allowing us to work smarter, faster or cheaper.

Equally important is to know where to look for opportunities. There are at least four distinct ways of finding them:

1. Some opportunities arise from the absence of threats. If the bad thing does not happen we might be able to take advantage of something good instead. For example, if poor industrial relations do not lead to a strike, we might be able to introduce an incentive scheme and turn the situation round from negative to positive.

2. Other opportunities are the inverse of threats. Where a variable exists on a continuous scale and there is uncertainty over the eventual outcome, instead of just defining the risk as the downside it might also be possible to consider upside potential. For example, where the productivity rate on a new task is unknown, it might be lower than expected (a threat), or it might be higher (an opportunity).

3. We should also remember secondary risks, which are introduced by implementing a response to another risk. Sometimes by addressing one risk we can make things worse (the response creates a new threat), but it is also possible for our action to create a new opportunity. Avoiding potential delays to my car journey by taking the train might also allow me to do some useful work during the journey.

4. Lastly, we must not neglect “pure opportunities” which are unrelated to threats. These are simply unplanned good things which might happen. For example, a new design method might be released which we can apply to benefit our project. Or a new recruit to the team may unexpectedly possess a skill needed to solve a problem. This type of opportunity needs to be actively sought out, requiring fresh thinking and awareness of how potential additional benefits might be created.

Opportunities cannot be managed unless they are identified. People familiar with identifying threats can start with these, then ask whether their absence or inverse might present an opportunity. Planned actions should also be examined to see whether they open up new possibilities to help us achieve our objectives. But “pure opportunities” must not be forgotten, since these often present the greatest potential upside of all.

About the Author:

© July 2005, Dr David Hillson PMP FAPM. Dr Hillson is Director of Risk Doctor & Partners. To provide feedback on this Briefing Note, or for more details on how to develop effective risk management, contact the Risk Doctor (info@risk-doctor.com), or visit the Risk Doctor website www.risk-doctor.com.