Over the last few decades, dealing with risk has become an important and distinctive area of management and one that is increasingly being recognised as an essential part of any successful enterprise.

In some ways, we might be forgiven a little surprise at the speed of this development; after all, we all know that ‘risk’ accompanies all of our activities, both personal and professional, and we have all learned to live with it, more or less successful. So far as our private lives are concerned, we know there are statistical risks associated with such commonplace activities as flying, driving car, playing a contact sport, eating certain foods and so on but are usually willing to accept these as a necessary price of convenience or pleasure. We might also, without realising it, apply some simple, everyday risk management by, for example, deciding not to drive on a busy motorway in bad weather or choosing to fly only with airlines we consider ‘reputable’. The Plan B approach – ‘If I’m not there by 4 o’clock, I’ll meet you back at the car’ - is another example of everyday risk management.

On a professional level, we are used to associating risk with such activities as insurance, speculative investments, working with hazardous chemicals and so on. Some of us, in fact, might view ‘risk management’ as a normal, everyday part of our job. Certainly, we will all, almost without thinking, add a contingency factor to any estimates we are required to make although few of us on these occasions will actually attempt to identify and assess what exactly we are guarding against.

Risk management goes beyond the simple acceptance of risk and now embraces every modern-day enterprise, from the commercial worlds of banking, insurance, IT, and marketing through to medicine, health and safety, hi-tech industries such as nuclear and chemical plants and offshore oil and gas installations to all major aspects of public and political life. It is increasingly an integral part of design, development and project management, helping to decide the siting of factories and public utilities for example and, through growing public awareness, influences much of our lifestyle and many of our personal decisions.

Programme Introduction

With such a wide-ranging field, it is almost impossible to develop an all-inclusive definition, one that will apply equally well to all areas of industry and commerce. But broadly speaking, it embodies a style of management that seeks first to determine and then either to minimise or control tangible risks such as mechanical or systems failure, security and fire. Alternatively, it attempts to enhance the benefits from speculative risks such as financial or commercial investment.

Risk management involves two distinct but inseparable components:

First, we have to identify and quantify risks. Unless we do so, have no means of deciding if a risk is worth taking or which of a number of courses of action offers the greatest chance of success. This is part of the risk assessment stage and is seldom a simple process, not least because the methods we use and the form in which we need the information will depend very heavily on the nature of our business.

Second, a business environment has to exist that makes risk analysis as integral part of its operation and adopts a positive, proactive attitude to generating and using eth information. This is the essence of the risk management phase.

These two halves must be treated as one single requirement if the overall process of risk management is to succeed. From an organisational standpoint, a ‘risk assessment’ unit might well exist as a distinct department but its whole ethos – its way of thinking about risk so as to avoid it, or control it, or seek maximum benefit from it – needs to permeate the management function throughout the entire organisation.

It is impossible in a work of this size to cover allaspects of risk management for every type of enterprise. Equally, this is not a course on, for example, statistics or the techniques of analysing the worth of a financial investment. But what we do aim to cover is the underpinning basis of the subject, to introduce its application within a range of enterprises and to set the scene for further study of risk management within the reader’s particular business sector or technology. Thus we begin with a discussion of the perception, terminology and nature of risk before moving on to summarise some of the many approaches that are used to identify and quantify it. Then we look at the culture of management and the organisational environment necessary for successful risk management. Finally, we end with a reference to some high profile events where, in hindsight, risk management was clearly not as much in evidence as it might have been.