The double life of risk

International risk standards and guidelines such as ISO31000:2009 define risk as a double-sided concept. This includes the possibility of both upside and downside risks, with either positive or negative effects on the achievement of objectives. We use the word ‘opportunity’ to describe an upside risk with positive impacts, and ‘threat’ for downside risks with negative consequences.

Although the theory is clear, in practice many organisations, teams and individuals have problems with including opportunities in the risk process. We’re not sure how to identify a genuine opportunity, how to assess or prioritise it, what response options exist, or how it should be managed. But we don’t seem to have the same difficulty with threats. If we believe that risk management could and should address both opportunities and threats, how can we bring our practice into line with theory?

The secret to effective opportunity management is to recognise that an opportunity is the same as a threat, apart from the sign of the impact. Once we see this similarity, the way to address opportunities becomes obvious. We can take the standard risk process which we already use for threats, and apply it to opportunities, with simple modifications to recognise that we are dealing with positive upside risks.

So how are opportunities the same as threats? The definition of risk as “uncertainty that matters” covers them both. Just like a threat, an opportunity is uncertain and it may not happen, but if it does occur then it will have an effect on our ability to achieve one or more objectives. The only difference is that if a threat happens it has a negative effect because it turns into a problem, but if an opportunity happens it has a positive outcome as it produces a benefit.

There are also similarities in the process for managing opportunities and threats. We can identify opportunities using the same techniques that work for threats. Obviously we can hold a brainstorm session to think creatively about upside uncertainties, or we could produce an opportunity checklist based on previous good experiences. But we can also use root-cause analysis or decision trees to find potentially helpful things. And risk identification techniques like SWOT Analysis or Force-Field Analysis naturally expose opportunities as well as threats.

When we want to rank risks, the importance of both opportunities and threats can be assessed in terms of probability (“How uncertain?”) and impact (“How much does it matter?”). The only difference between them is that impact is positive for an opportunity and negative for a threat. Then we can use a standard prioritisation tool like the Probability-Impact Matrix or a heat map to find the best opportunities.

We can also model the combined positive effect of opportunities on overall outcomes using quantitative risk analysis techniques like Monte Carlo simulation or sensitivity analysis, with exactly the same approach that we use to model threats. The distinction here is that opportunity impacts are positive, producing savings in time or cost, or enhancing performance or reputation and so on.

Having found some good opportunities that are worth pursuing, we can develop appropriate risk responses. This includes trying to exploit the best opportunities, and enhancing others to make them more attractive.

We should also produce fallback plans to take advantage of any opportunities that might happen spontaneously. In the same way that threat responses aim to remove or reduce the negative effect of downside risks, opportunity responses are designed to capture or improve the positive effect of upside risks.

It is clear that everything we know about downside risks (threats) is also true of upside risks (opportunities). Once we realise that an opportunity is the same as a threat, apart from the sign of the impact, it will be easier to identify, assess and respond to opportunities: we just use the same approach that already works for threats.

And if we manage opportunities proactively, we will turn some of them into additional benefits, including reduced timescales, lower costs or enhanced performance. This will result in more successful projects and businesses, which is good news for everyone.

This briefing was originally published as ‘Opportunities are the same as threats‘ and has been reproduced with permission.