Something I am seeing more of my consulting clients grapple with are what I call Low Frequency/High Severity issues. These are the kind of risks that can be a serious problem for your business. In my volunteer life I work in austere environments sometimes under extremely high consequence circumstances as a Mountain Search & Rescue professional. The rescue team that I am on is constantly assessing risk and putting processes and tools in place to mitigate risks. The best practices we implement can be applied to business easily.
HOT TAKE: NOT ALL RISK IS CREATED EQUAL
So why are these low frequency, high severity challenges the ones to really be concerned with? Because things which are low frequency and high severity you have unlikely dealt with or are truly prepared for, AND have a high severity outcome. You'd think I'd be advising that you should be more worried about high frequency high severity, but I'm not. Most businesses have good visibility into what their HIGH/HIGH risks are and have built SOPs, training and plans to avoid those risks or deal with them when they come. It's the LOW/HIGH risks that make me super nervous.
Of course you can't be prepared for everything. We are all human and can't know everything and predict the future and all possible outcomes. But we certainly can be more deliberate about how we plan for and mitigate risk. In mountain rescue, one of the goals of risk mitigation is proficiency at a tool box of ways to identify and manage risk.
Proactive Risk Planning
Review & Revise
(Be Ready to) Take Action
If you're running a business and have not yet built in a clear risk planning process, you're missing a key element of managing your organization to be successful long term.
Proactive Risk Planning
HAVE A STRATEGIC PLAN & KNOW YOUR OPERATIONS - Knowing what your business’ top priorities and focuses are allows for more easily navigating risk and crisis and re-allocating resources as needed. When you build that plan, build in contingencies and identify any risks that are inherent in your plan. In rescue, we know what we do, we know how to do it, we build a plan, agree to it and identify any risks in our plan,
DEVELOP HYPOTHESES - When launching new things, making organizational decisions and implementing new policies, ask: “What is my hypothesis? What risks are there if I am wrong?”
IDENTIFY, CATEGORIZE & PRIORITIZE RISKS - Use the HIGH/LOW matrix. Assign risk owners and ask for action and contingency plans.
Review & Revise
Creating a risk assessment and mitigation plan or processes is not a one-and-done thing. It has to happen regularly on a cadence with the right stakeholders. In rescue, before we load a patient onto a rope and get them on the move, we take a tactical pause. This is a deliberate stop at a deliberate time to review our plan and revise it if needed before sending someone over the edge of cliff. In business, I recommend this quarterly for sure, and possibly before any major changes or launching --- before sending your business "over the edge of a cliff" as it were.
WHAT TO INCLUDE:
What risks are we about to be facing?
Why? What is causing the risk?
When? Do we know when this risk becomes real?
How do we categorize this risk? (Frequency/Severity)
How do we mitigate?
(Be Ready To) Take Action
READINESS - You and your teams can’t take action if they are not ready. What is readiness? It means you and your teams are willing and able to respond (not react) to inbound stimulus. In rescue, the situation is incredibly dynamic. Sometimes very important stimulus change in a moment's notice. Weather, the patient's condition, etc. Myself and the team around me have to always be willing and ably to adapt and pull from our toolkit of risk assessment and management.
1 - Talent & Expertise — Having the right talent on your team protects your business. For example an experienced and skilled HR leader is invaluable in protecting your culture, your employees and your company from risk.
2 - Standard Operating Procedures — Writing and having SOPs for your common risk issues is a must. Not only does it give you a standard which you can train people to and hold people accountable to, it also prevents liability later when a lawyer asks if you have SOPs or plans for an injury or for an employee relations issue
3 - Training — Writing and having SOPs does no good if your teams don’t know where they can be found, what they are or how to take action on them in the right way.
4 - Strike Teams — When the risk comes, put together a pre-planned strike team to meet daily, weekly, hourly as necessary to execute on risk mitigation plans.
5 - Communication —
Who needs to hear what message
Via what channels
When
How Frequently
Who is accountable for inbound questions
Consider an FAQ
Don't "Cross that bridge when we get to it". My lessons learned from half a decade of high risk rescue scenarios and my professional career are: take the time to identify and assess risk. Hire talented people and train regularly even if you don’t think you need to, leverage this framework to be able to take action. And lastly, when you DO have something unexpected happen, make sure you build the SOPs and processes to deal with it faster and easier the next time it happens.