What Most People Get Wrong About Risk Management

You start by defining yourself and then look at your environment in search for 'threats' that would 'hurt' you. Now you have a perspective and identification of risks.

If you want to sophisticate it, add the probability of the threat and how much it would hurt if it happened. Now you have your risk assessment.

If you want to own it, look for ways to offset the risks with insurance, diversification, or pure luck in timing, and you have your strategy.

If your strategy is too costly, tone it down to allow some risk at a reasonable cost and you have your policy.

Life goes on and you forget your policy. A threat gets way too close and you react, hoping that it makes sense. You trust your instinct based on your previous analysis.

The time comes to settle, do the math, and see if it worked. Maybe it did, maybe not. Could you replicate it? Well, accidents happen and there is always next time.

Here is the thing. That is a bottom-up approach. It is also defining the world in the first person. Nothing wrong with that when you are building something and need to have control, but those threats out there? Those are not about you.

Let's start over. I will need some of those things, what are they doing now and what could they do when I really need them? Should I wait or get them now? If I get everything now, will the numbers add up? I cannot afford everything, so I'll get some of this now, and at least secure some favorable terms.

And this is what most get RIGHT about risk, and calling it just being proactive. Well, voilà, same intuition, whole different starting point. Which do you choose?