People like to categorize as I wrote in my prior post. But a question was left hanging — are there categories of risk? That depends on what we mean what we talk about categories.
One way of thinking about categories is to envision a number of “buckets” and every risk must fall into one of these buckets. This was where people think about whether a risk is a “Strategic Risk”, “Compliance Risk”, “Reputational Risk”, “Financial Reporting Risk”, etc. The problem with this approach is that there is an underlying assumption that the risk must be exist in only one category. Unfortunately, no matter how many buckets you come up with, sooner or later you’ll come up with a new item that doesn’t fit neatly into one of the buckets. So you create a new bucket. But then you discover that a risk that you earlier dropped into a different bucket now fits better in this new bucket. In short, this is an approach that simply doesn’t work very well because it is very difficult, probably impossible, to create a complete and exclusive system of categorizing risks in any meaningful way.
A better way of thinking about risks is through “attributes”. Rather than going through a mental process of depositing each risk into a specific bucket (which requires a sense of mutual exclusivity), consider instead what practical questions you might want to answer about your risks. What “knowledge” do you want to create?
Perhaps you will, in the future, want to know which risks occur simply because a computer is used as part of the process (e.g. “garbage in / garbage out”). Or perhaps, you want to know which risks occur simply because you choose to outsource a process to a third party (e.g. “insecure storage of sensitive data”). Or perhaps you want to know which risks might occur because of internal fraud (e.g. “expense reimbursement for the wrong amount”).
Notice that one or more of these attributes might apply to any particular risk. So, you can’t simply drop the risk into the “third party risk” bucket. It also needs to exist in the “IT risk” and “internal fraud” buckets. This is where it becomes necessary to eliminate the idea of “buckets” think of “attributes”. Attributes are like standard sticky notes that you can attach to any risk, or perhaps many risks.
Then, when you want to understand your risks better, this approach allows you to see see those risks that have the “internal fraud” attribute attached. Or, you can see those risks that have an “IT” attribute. Some risks will be in both lists.
This approach provides much more flexibility than going with an exclusive bucket approach.
If you don’t agree, I would love to hear your views.
Charles D. Schrock 