Risk as the Effect of Uncertainty on Objectives

Every manager makes plans. A sales team plans to win ten new customers this year. A warehouse plans to ship every order within two days. A clinic plans to see all booked patients on time. Each plan rests on things that are not certain. A customer may delay a decision. A truck may break down. A doctor may fall ill.

Risk is the name for this gap between what we plan and what may really happen. The International Organization for Standardization (ISO) publishes a guideline for managing risk called ISO 31000:2018. It defines risk in six words: risk is the effect of uncertainty on objectives.

The definition is short, but each word matters. If you understand these words, you understand most of risk management.

Threats and opportunities

Many people think a risk is always something bad. ISO 31000 does not. Because an effect can be positive, a risk can also be an opportunity: an uncertain event that, if it happens, helps you reach your objective faster, cheaper or better.

A threat is an uncertain event with a negative effect on an objective. An opportunity is an uncertain event with a positive effect. A good manager looks for both. If you only look for threats, you protect the plan but you miss chances to improve it.

Notice also that a risk only exists in relation to an objective. "Rain" is not a risk on its own. "Heavy rain delays the concrete pour, so the building misses its handover date" is a risk, because it links the uncertain event to a goal.