Keeping Score - a piece by Mike Lutomski

When I mention “keeping score” I’m not talking about a sporting event you may be betting on, nor am I talking about the last time your spouse took the dog for a walk or folded the laundry. I’m talking about risk management. A lot of people get hung up on scoring a qualitative risk, or where you rank risks from top to bottom. Truthfully, “hung up” is probably an understatement if you’re in a large organization with an active risk process. People will get obsessed and over-focus on the likelihood and consequence score of a particular risk.

Scoring and ranking risks is important, after all it’s a decision support tool, or a management tool where it should help inform important decisions on where to spend resources and focus attention, but these steps of analyzing risks is certainly not the point of risk management.

Risk management is an important communication system where you are trying to gain attention to a potential issue. Trying to get more resources and/or communicate this potential future problem with management and your peers.

Say you use a 5x5 risk matrix, where the vertical axis is likelihood, and the horizontal axis is consequence; it’s not important is your risk is a 3x4 or a 4x3 or even a 5x5. If you’ve entered into the risk register, and have the opportunity to present it to management in a coherent manner, you’ve won. You’ve communicated this potential issue, discussed ways to mitigate it, discussed the resources required including the time and money that it will take to avoid this risk from being realized. It’s not important if some risk management guru or even your peers agree with the “score” of the risk, it’s only important if you’ve gotten attention on the risk!