By Steve Czerniak, Subject Matter Expert, SCORE of Southeast Michigan

Using the process I describe in this blog entry, you’ll see that the COVID-19 pandemic is an “outlier.” That’s a situation that is WAY out of the normal. Something like COVID would be categorized as extremely unlikely to occur (way below remote; “a once in a several lifetimes event”) but one with extremely catastrophic consequences (loss of lives; loss of jobs; economic and cultural disruption; failure of businesses).

In the analysis of a typical business environment, a business leader would be unlikely to consider such a situation or spend time on it. It’s so unlikely to occur that few would develop a “what if” plan for it. However, for those who did consider the possibility and developed a contingency plan for it, they knew what to do. They knew the steps to take to save their businesses. They had reserves available to ride out the storm.

The U.S. Government and military have contingency plans for all kinds of possible situations. Smart leaders know that “hope is not a plan.” Reality tells us that “no plan survives first contact with the enemy” but every victory starts somewhere. Reasoned action beats panic every time.

Sometimes the rare events are negative and sometimes they are opportunities for growth. Erste Allgemeine Versicherung, an Austrian insurance company, had a contingency plan for the fall of the Berlin Wall. When it did happen, they took the binder off the shelf, blew off the dust, and began to execute a step-by-step business plan.

If you can see the business opportunity I’m illustrating, please use it a a learning moment. In the blog entry, I’ve used a simple and light-hearted example to illustrate my point. Think about what could happen and document what you would do if it did. SCORE mentors (and subject matter experts) will be happy to help you.

Assessing Risk

A business or project leader needs to manage the scope, schedule, cost and risk. That’s how you ensure quality products (goods and services) and performance. Scope defines the work to be done. Schedule is about timing and delivery. Cost identifies the allocation of people and other resources. Risk is all about what could go wrong.

In the business world, risk manifests itself through 1) change in scope or performance (additional work tasks; less capability than promised; forced to deliver less than anticipated or more); 2) increased cost; and 3) late completion or deliveries.

Risk is made tangible by evaluating the likelihood of the risk and the severity of the consequences should it happen. For example, a pandemic is one of those things that seemed somewhat unlikely (we thought) but would have a catastrophic consequence on most every piece of our existence (proven in real-time).

The Process

Here’s a five step process for managing risk:

STEP 1. - Identify the potential risk items (develop a list)
In business and project management, here are some classic examples of risk items: Building Issues; Competition with an Event; Funding; Handling Cash; Illness or Injury; Lack of Capital; Sales; Shipping; Staff availability; Supplier problems (e.g. missed deliveries, quality); Technical Issues (e.g. development of a component; computer issues (e.g. with a presentation etc.); Transportation; Under or Over Purchases; Unexpected change in scope or schedule; Vandalism; Visibility into partner plans; Volunteer availability; Weather.

STEP 2. - Quantify the Likelihood of Occurrence
STEP 3. - Quantify the Severity of Consequence
Use the following table to quantify these two items:

Use the following diagram to plot the risk and identify the overall risk rating:

NOTE: C = current risk assessment; M = risk assessment after action is taken

STEP 4. - Identify Risk Response Strategies (for each risk item)
Accept it - Understand it; Build it into the plan
Avoid it - Eliminate the risk
Mitigate it - Change the approach to reduce the risk; could be actively pursuing a “Plan B”
Transfer it - Shift the ownership of the activity (and the risk) 

STEP 5. - Develop Risk Response Plans (to implement the strategy)
As seen in the diagram, actions were taken and the original risk (C) was moved to (M). That moved it from a HIGH to a LOW risk.

After Action Reports: Take time, after the activity is over, to understand what went right, what went wrong, and what could be done better. Appreciate what went right. Figure out why that happened. Learn from what went wrong. Figure out why it happened. NOTE: Use a “Five Whys” analysis to get to the root cause. Ask “Why” five times:

  1. Why did the machine fail? The mechanism broke.
  2. Why did the mechanism break? The metal fatigued.
  3. Why did the metal fatigue? From use.
  4. Why wasn’t the fatigue noticed during regular maintenance? Maintenance wasn’t conducted.
  5. Why wasn't maintenance conducted?  Management did not add maintenance to the procedures. (Oh, Oh. somebody’s in trouble.)

Kind of sounds like a three-year-old asking why. The technique does get down to things on which you can take action in a real hurry.

A Real-World Example

The following is an example analysis from my own life. It’s my analysis of riding my bike to work.

STEP 1. - Identify the Potential Risk Item
When I was working, I would ride my bicycle to work. On some occasions, or in some certain spots, I would ride on the sidewalk. What I learned (the school of hard knocks) was that people don’t stop their car at the stop signs. They blow right through them and pull up to the cross street. Unfortunately, that puts their rear window or trunk right in line with the sidewalk. As a bicyclist is riding along, this calls for evasive action (i.e. full brakes, agile maneuvers, perhaps a side slide).

STEP 2. - Quantify the Likelihood of Occurrence
What I learned was that this is a kind of regular occurrence. I would say “Likely” to “Highly Likely.”

STEP 3. - Quantify the Severity of Consequences
Falling off your bike is not a fun thing to do. At a minimum, you get scratched and tear your clothes. The bike also takes a beating. A serious fall like running into a car and flying over the truck could result in broken bones or closed head injuries (even with a helmet). I would say “Significant” to “Catastrophic.” That puts the overall risk level at MEDIUM (Yellow) or HIGH (Red).

STEP 4. - Identify Risk Response Strategies
There are several things that can be done to respond to this risk.
Accept it - Don't change anything. Face mortal danger like a Klingon. Continuously learn new and innovative ways to shout at drivers.
Avoid it - Drive to work.
Mitigate it - Wear a helmet. Maintain the brakes and steering on your bike. Outfit your bike with reflectors and lights. Wear reflective clothing. Continuously learn new and innovative ways to shout at the drivers.
Transfer it - Put spikes on the roads and produce a biker utopia.

STEP 5. - Develop Risk Response Plans
The local neighborhood had side streets that could be used. I mapped them in some detail to find the best route to minimize the risk.

I got VERY acquainted with my bicycle. Performing maintenance was a weekly occurrence. Of course, the tire pressure got checked every time I went to use it.

My wife was driven to distraction because every store I went into presented an opportunity to buy another reflector or light for my bike or me.

The overall risk went from HIGH to MEDIUM (maybe LOW).

SPECIAL THANKS: To my son, Gregory. He came up with 1) a great question 5 for the After Action Report section and 2) very creative Risk Response Strategies for my bike example.

About the Author

Steve Czerniak retired after a successful 37-year career as a leader and innovator. The last 15 years were a series of opportunities that honed his skills as an internal consultant and “change agent.” In retirement, he is a volunteer consultant and a SCORE Subject Matter Expert for the Southeast Michigan chapter. His personal volunteer objective is to “derive personal satisfaction from helping others, and the organizations they operate, to develop and prosper.” Visit his site:


It's Never Risky to Manage Risk: Use Now as An Opportunity