The traditional view of managing risk to be as low as reasonably practicable (ALARP) is fine for negative risk. Unfortunately for ALARP, the ISO31000 definition of risk; the effect of uncertainty on objectives; includes both positive and negative risks. Time methinks, for ALARP to retire before people start to notice that it can no longer do its job anymore.
Figure 1: AHLARP Model
Thanks to ISO 31000:2009 we also want to manage positive risks; to be as HIGH as reasonably practicable. It is time to discuss upgrading ALARP to AHLARP (As High/Low as Reasonably Practicable). There is a lot of talk about the upside of risk, opportunity realization, etc. And then we hit the wall of old terminology such as ALARP. It is time to look at a few acronyms. RTP stands for 'Risk Tipping Point.' It's the point where positive risk starts to outweigh the negative risk.
IT projects, business activities, and saving an endangered species all have at least one thing in common. Without some input of resources/effort, the initiative is more likely to fail than to succeed. In ISO31000 terms, we would say that 'objectives are unlikely to be met.' Of course, pouring resources into something is no guarantee that it will succeed. But all things being equal, and with some basic planning, more resources lead to better outcomes.
In Figure 1, the blue line represents the amount of resources applied. You can see that the risk tipping point is reached fairly early. Broadly speaking, it doesn't take a ridiculous amount of resources to hit RTP. With a few more resources you will have reduced negative risk to a point where extra resources won't make much difference. Positive risk should, in theory, continue to increase up to the point where it (green line) starts to flatten out. Beyond this point, increasing resources (blue line) don't have much impact.
The idea is to manage your business (and your life) to remain in the zone where negative risks of accidents or bankruptcy are minimised, but positive risks such as longevity and profitability are maximise.
Please bear in mind, George Box's famous maxim that "All models are wrong. Some are useful." AHLARP is a model. A way to explain, discuss and apply, a concept. You shouldn't try to put it into a spreadsheet and start looking for a point value. But the concept is still important to understand. You can spend more time, money, and effort on something than the threats or the benefits warrant.
AHLARP becomes the conceptual area where your strategies achieve an optimal region of benefits for a given range of resources. We already know from experience that there is no single perfect point for risk/reward optimization. You are trying to balance resource (cost) with positive risk (potential benefit) and negative risk (potential loss).
There is rarely if ever, a single point where likelihood and consequence form a point value. The idea that we can state something like "this risk as a 57.6% likelihood of generating $123,000 benefit" is a dream. It doesn't happen, at least not outside of sales pitches. At best, you may find a probability distribution where the most likely outcomes are favorable. The idea is to spread risk across a range of outcomes and to have some understanding of the likelihoods of those outcomes.
Figure 2 below, illustrates the likely spread of outcomes if we apply insufficient resources (or quality) to manage a risk.
Figure 2: Inadequate resources increase the likelihood of negative consequences
Figure 3 by comparison, looks at what we seek to do with risk management. If we had to sum up risk management in a single picture, this would be a worthy contender. What we try to do is, to push the spread of likely outcomes towards the positive. A statistician might say that we're applying resources to left-skew the possible range of outcomes. ISO31000 might say that we're attempting to reduce the 'effect of uncertainty on objectives.'
Figure 3: Applying management resources to shift risk outcomes towards the positive
Judging how much investment is appropriate to achieve AHLARP, is, of course, no simple feat. Too little is, well... too little and likely to be a waste of money/time/effort with little impact on outcomes. By contrast, applying an excess of resources is wasteful and leaves inadequate resources for other projects. Figure 4 illustrates this idea as a general concept but doesn't give us the magic formula. If it were easy, we would have few if any Enrons, HIH, Exxon Valdes, etc. It would also be harder for us to find jobs to pay our rent.
Figure 4: Range of 'prudent' investment
Determining what is 'prudent' or 'appropriate' requires analysis, and is beyond the scope of this article. But, there are some principles you can apply. You might think 'the riskier a venture is, the more resources needed' but that isn't the case.
Some enterprises have significant upside risk, with little downside risk. For example, if you are a 20-something with a great idea for the next Uber, you can work for years, risking very little. Five years after starting, you might quit and take a job with Google, or you might be a billionaire. The downside risk is low, the resources needed are low, but the upside can be huge.
Running a stationery manufacturer or bookshop is likely to work out well without a huge need to manage downside risk. Sure, you won't create the next Amazon, and you'll need a lot of capital, but you're likely to make a steady income. A hydrocarbon plant, by comparison, can generate amazing profits for decades. And then a single incident can bankrupt it overnight.
Figure 5: 'Prudent' is context driven
Figure 5: 'Prudent' is context drivenFigure 5 illustrates the different nature of investment depending on your context. Investment in a gas plant is likely to involve more resources than a bicycle manufacturer or stationary supplier.
Even if the businesses have the same turnover and size, one is more volatile than the other. Which leads us to the concluding point; the more quickly a risk can change, the more resources are needed. If the green and red lines in Figure 1 have a lot of potential ranges, and can change quickly (aka, are volatile) it's going to be expensive to stay within the AHLARP zone. The good news is that your AHLARP zone is based on your unique risk attitude and objectives. Only you can determine its shape and size.
DISCLAIMER
No matter how awesome you are at managing into the AHLARP zone, you will need resources, and it will always feel like you are pushing '**it' uphill. So to speak. There you have it. Risk management in a single graphic. Don't run out of diesel. :-)
