Name uncertainty and ownership

What you will understand

• Distinguish a threat from an opportunity and an issue.
• Describe a risk using cause, event and effect.
• Distinguish risk ownership, action ownership, appetite and tolerance.

The idea

“Supplier risk” is too vague to guide a decision. A useful risk description explains what is uncertain, why it might happen and what objective would be affected. Risk management considers both threats and opportunities. Naming the uncertainty clearly makes it possible to assess it, choose proportionate action and assign ownership before its consequences arrive.

A risk involves uncertainty that could affect objectives. A threat has a potentially negative effect; an opportunity has a potentially positive effect. A late delivery that has already happened is no longer merely the uncertainty that it might happen: the current situation needs issue management, while any uncertain further consequences remain risks. Do not remove the earlier history, because it helps explain the response and informs future learning.

Separate cause, event and effect. A cause is the existing source of uncertainty, such as dependence on one specialist. The event is what might occur, such as that specialist becoming unavailable during commissioning. The effect is the consequence for an objective, such as delaying opening by two weeks. This structure prevents a general worry, an existing fact and a potential consequence from being treated as interchangeable descriptions.

Assess likelihood, impact and proximity using the agreed scales. Likelihood concerns the chance of the uncertain event; impact concerns its effect on objectives if it occurs. Proximity concerns when the risk could occur, so a modest risk requiring action tomorrow may demand attention before a larger one several months away. Exposure expresses the potential effect of uncertainty and may concern either positive or negative consequences. Consider the combined position as well as individual entries.

Risk appetite expresses the amount and type of risk the business is willing to take in pursuit of its objectives. Risk tolerance provides measurable boundaries for acceptable variation in objectives at risk. These are related but different: a general willingness to experiment does not authorise exceeding a particular project’s agreed safety, cost or other limits. Risk decisions need the appropriate authority and must remain consistent with the business context.

A risk owner manages and monitors an identified risk and ensures that a suitable response is considered and followed through. A risk action owner, also called an actionee, carries out a specified response action. The same person can hold both responsibilities when appropriate, but an action assignment does not automatically transfer the whole risk. The risk management approach defines the procedures, roles, scales and reporting arrangements; the risk register records the actual risks and their evolving assessment, ownership, responses and status.

Describe uncertainty clearly

Points to remember

• Risk can mean a threat or an opportunity.
• Cause, uncertain event and effect on an objective are distinct.
• Proximity describes timing, while probability describes likelihood.

Your takeaway

Describe uncertainty precisely, assess it using agreed measures and give it a suitable owner. Distinguish appetite from measurable tolerance, and distinguish ownership of the whole risk from responsibility for a particular action.