Transcript
As an auditor, I often get asked, “Why do we do risk assessment in these prescribed ways? Why do we talk about things like likelihood and impact at a more fundamental level than just it makes sense at the surface?” It’s key to understand that human beings are inherently bad at risk. We make very odd choices, and we choose strange things based on what our gut tells us is a risky activity. As a classic example, people are afraid of roller coasters. And yet, when we talk about a roller coaster at a Six Flags or a Disney World, those roller coasters are some of the safest rides that you can imagine existing on the planet. Some of the safest activities you can actually do. Human beings are intrinsically bad at risk. And worse, each one of us has a personal definition of what risk is and isn’t. An entrepreneur or a CEO is vastly more likely to take significant risks I pursuit of common goals. Whereas an auditor, by our very nature, often isn’t. Keeping that in mind, the reason that we about likelihood and impact so much in these risk assessments, and what makes for a very, very, good risk assessment, is that it gives us a place to stand on common definitions. We understand likelihood when we talk about it in terms of, “will this happen in one day? In one week? In one year? In one month?” and we understand impact when we talk about things like, “Is this catastrophic to my environment? Is it absolutely going to send us all home and the company’s going to end? Or is this something that’s going to be a bad afternoon and we’re going to laugh about it afterwards.?” When we establish common definitions for likelihood and impact, we take our instinctive reaction out of the picture. And key to a good risk assessment is establishing that common language and getting real risk.