Little Green Men Make the List of ‘Extreme’ Risk Factors

You can really build a huge list quickly when thinking of categories of risk and the more people you ask, the more categories. I have seen risk databases with 1000's of risks. The key is to keep it simple. You might start with "Industry Risks" [Risks that one normally incurs when doing business in an industry - Regulatory, Governmental, Competitors..], Then "Company Specific Risks" [Strategic, Assumed and Operational] These areas will put the meat on the bone. Strategic might include "Decision Quality", Brand/Reputation..appetitie/tolerance..etc] Assumed Risks involve the actual risks you get paid to take as an organization. The Operational risks are the ket policies, processes and procedures in place to conduct and process business [ Business Lines, Technology, HR, Compliance..etc] All should be narrowed down to 10 or 12 "Top Risks" [Risks that cut across the whole organization and create "systemic risks". Bigger is not better - A concise risk Profile, where each risk is clearly defined, ownership assigned and reported on is the key.

1