In probably half of the presentations I give about FAIR, someone in the audience will raise their hand and ask, “What about positive risk?” Well, in this blog post I’ll provide the first part of my answer to that question.
Which “positive risk” are you talking about?
There are a couple of belief systems that seem to lead people to believe in “positive risk.” The first is based on recognizing that organizations deliberately introduce some risk into the environment in an attempt to increase returns. For example, a company might introduce a new service or product to their risk landscape that has significant potential for increased revenue but that also introduces the potential for loss. This deliberate increase in potential for loss while chasing the potential for gain is referred to by some people as “positive risk.” This is believed to be different than the potential for loss that comes from operational activities that aren’t directly associated with chasing opportunities for gain.
The second belief system that leads people to believe in “positive risk” is based on the premise that “risk = uncertainty”, and uncertainty applies to both positive and negative outcomes.
This blog post will focus on the first belief system, which is overwhelmingly what people are referring to when they ask the question during my presentations. The “uncertainty” belief system deserves a blog post all its own.
A false dichotomy
Let’s compare a couple of examples of “positive risk” vs. “negative risk” in the context of this first belief system.
Example 1 — “Positive risk”
ABC Company builds a new manufacturing facility in a country that offers inexpensive labor (we’ll refer to this country as “XYZ”). ABC Company does this in order to decrease costs and increase its profit margin. In doing so, it also introduces various opportunities for loss that it didn’t have before, for example:
- Perhaps XYZ has a somewhat unstable political environment, which could lead to civil unrest and operational outages
- Perhaps there are companies within XYZ that compete with ABC Company. Furthermore, perhaps XYZ has a history of supporting its own companies by perpetrating or turning a blind eye to industrial espionage
Under this belief system, the increased level of risk that comes from these potential loss events would be viewed as “positive risk” because it was introduced deliberately in an effort to improve profit.
Example 2 — “Negative risk”
ABC Company is subject to potential loss events (including cyber-related events) because it uses computing technology. Under this belief system, the potential loss events that come from using computing technology were not deliberately and explicitly accepted in an effort to increase business profits — i.e., the supposed purely downside aspect that comes from using computer technology means these potential loss events represent “negative risk.”
At this point, I may not have to say another word. You may have already connected the dots and recognized that ABC Company chose to use computing technology expressly because to do otherwise would likely be suicidal from a cost and product/service delivery perspective. In other words, the “upside” for this choice isn’t a specific revenue line item but rather business survival. Regardless, upside is upside, and whether ABC Company’s leadership deliberated on whether or not to use computing technology they did, in fact, make that choice because of the upside and in doing so introduced the risk that comes with it.
What I find interesting is that, under this belief system, risk and opportunity are correctly recognized as two sides of a coin, but only under example 1, above. But as I point out in example 2, they always coexist.
Another nail in the coffin
In order to accept the notion that there’s such a thing as “positive risk” under this belief system, then logically we also have to accept the notion that “negative opportunity” exists. After all, whenever we chase opportunity we also introduce the potential for loss. This logical equalization would mean that risk and opportunity are the same thing. From a measurement, management, and communication perspective, this is impractical and not very useful (to say the least).
A more practical approach is simply to recognize that business-related opportunity and risk always result from decisions and/or actions. Therefore, those decisions and actions are the substrate — the “coin” so-to-speak — that opportunity and risk share. Risk represents the downside component of decisions and/or actions, and opportunity represents the upside. Besides being logical and intuitive, it is also much less complicated than the contrived (and logically shaky) notion of “positive risk” under this belief system.
Summary for this belief system
This belief system attempts to account for the fact that risk and opportunity go hand-in-hand — that’s the good news. Unfortunately, as I described above, a closer look reveals that the underlying premise is based on a false dichotomy and introduces logical problems.
I have yet to identify an aspect of any organization’s risk landscape where I can draw a logical distinction that makes something “negative risk” as defined by this belief system. The conditions that introduce risk into an organization’s risk landscape always come back to choices that include a clear upside.
The next post in this series will discuss the “risk = uncertainty” belief system and whether it makes “positive risk” possible.
