This post originated from an RSS feed registered with Agile Buzz by Laurent Bossavit. Original Post: A definition of risk Feed Title: Incipient(thoughts) Feed URL: http://bossavit.com/thoughts/index.rdf Feed Description: You're in a maze of twisty little decisions, all alike. You're in a maze of twisty little decisions, all different. Latest Agile Buzz Posts Latest Agile Buzz Posts by Laurent Bossavit Latest Posts From Incipient(thoughts)

I'm thinking about risk management quite a bit these days. What is risk ? Webster's says "the possibility of a loss".

That is extremely vague, but it points in the right direction. "Possible" serves as a reminder that risk is about future events. What is in the past is not a possibility - it's a certainty; something has or has not happened. "Possibility" also puts us close to "probability" - future events are uncertain, and that uncertainty can sometimes be dealt with in statistical terms.

Not all risks have causes in the future; we may be at risk as a consequence of something we are doing now - for instance, smoking two packs a day. The future consequences of risk are uncertain, but the causes can be in the present and well known. In fact, most risk stems from predictable causes - it is the outcomes (the "loss" part of the dictionary definition) that are uncertain, and often (unpleasantly) surprising. The smoker knows that the cancer sticks will kill him - he doesn't know when, and who knows what might happen before that. That's the difference between risk and self-destruction.

Not all risks are related to undesirable outcomes. That is what the term "loss" suggests and it may be the common case, but there are exceptions. What is in principle desirable may turn out to be a risk; for instance, a vendor of a new product may run a risk that the product will be so popular that demand will vastly outstrip production, leaving the vendor unable to satisfy its public and destroying its reputation. (Apple regularly faces problems of this type, for instance.)

Finally, consider the possibility of being ticketed for some minor traffic offence - that has some significant probability if you live in a city, and paying a ticket fine is undesirable, but the amount of a ticket fine is small enough compared to our incomes or financial reserves that many of us probably don't regard it as a risk, but merely an annoyance. By comparison, the amounts involved in a lawsuit (say, if your driving kills someone) do count as a risk.

The definition of risk that I offer is therefore as follows: "Risk consists of future consequences, arising from present causes or foreseeable events, which - if they materalize - will exceed our normal capacities for coping."

What do you think ?