5.2 The Concept of Risk

Risk, in its essence, refers to the potential for an unforeseen event or circumstance to negatively impact an organization’s objectives or operations. It embodies the uncertainty surrounding future events that could lead to undesirable outcomes. For example, a retail store might face the risk of inventory theft, leading to financial losses and potential supply shortages. Similarly, an IT company could be at risk of cyberattacks, threatening data integrity and client trust.

Diving deeper into the sources of risk, they can broadly be categorized into external and internal factors. External factors are those that are outside the direct control of the organization. For instance, economic downturns can lead to reduced consumer spending, impacting businesses across various sectors. On the other hand, internal factors originate within the organization. An example would be a company’s failure to update its software, leading to vulnerabilities and potential data breaches.

Understanding and managing these risks is crucial for businesses to ensure sustainability and growth. A real-world example of this is the global automobile manufacturer, Toyota. Following the 2011 earthquake and tsunami in Japan, Toyota faced significant supply chain disruptions. However, due to their robust risk management practices established after previous disruptions, they were able to recover faster than many competitors. Their proactive approach to identifying potential risks and implementing mitigation strategies showcased the tangible benefits of effective risk management, not just in preventing losses but also in gaining a competitive advantage.

Three fundamental concepts associated with risk are:

• Probability of Risk: This refers to the likelihood of a particular risk event occurring. For instance, the probability of the Suez Canal being blocked by a ship, as with the Ever Given incident, was considered low before the event but has since been re-evaluated by many businesses.
• Degree of Impact: This pertains to the potential severity or consequences of the risk should it materialize. Using the same Suez Canal example, the degree of impact was extremely high, given the massive disruption to global trade and the ripple effects it caused in various industries.
• Ease of Detection: This concept relates to how readily a risk can be identified or detected before it materializes. Some risks, like potential equipment failures, might be easier to detect with regular maintenance checks. However, certain geopolitical risks or sudden natural disasters might be harder to predict or detect in advance.

5.2.1 Risk Priority Number (RPN)

Building upon our understanding of risk and its fundamental concepts, the Risk Priority Number (RPN) stands out as a critical metric in the realm of risk management. The RPN provides a quantitative approach to assess and prioritize risks, enabling businesses to make informed decisions on where to allocate resources and focus their risk management efforts.

The RPN is derived by considering three integral components, each of which we’ve touched upon:

• Probability of Risk: Quantifies the likelihood of a risk event occurring. This is rated on a scale of 1 to 10, where 1 indicates a low probability and 10 signifies a high probability.
• Degree of Impact: Measures the potential severity or consequences should the risk materialize. Again, this is rated on a scale of 1 to 10, with 1 being low impact and 10 being high impact.
• Ease of Detection: Assesses how readily a risk can be identified or detected before it becomes a reality. This component is rated on a scale of 1 to 10, where 1 indicates that the risk is easily detectable and 10 suggests it’s hard to detect.

By multiplying the values assigned to these three components, the RPN is calculated. The resulting number offers a relative measure of the risk, facilitating businesses in prioritizing and addressing the most pressing risks first.

Example 1: Reflecting on the Suez Canal incident with the Ever Given, if the probability of such an event was initially rated as 2 (considered low before the event), the degree of impact as 10 (given the massive disruption), and the ease of detection as 8 (due to the unpredictability of such an event), the RPN would be 2 x 10 x 8 = 160.

Example 2: In the context of an IT company facing potential cyberattacks, if the probability is rated as 7 (given the increasing frequency of cyber threats), the degree of impact as 9 (due to potential data breaches and loss of client trust), and the ease of detection as 2 (with advanced cybersecurity tools in place making it easier to detect threats), the RPN would be 7 x 9 x 2 = 126.

These examples emphasize the significance of RPN in risk management, serving as a compass for businesses to navigate the complex landscape of potential threats and disruptions.