One of the first things Bernstein says is that risk implies that we don’t know what will happen, which could be good things happening too. Risk management, as it is currently understood, gets executives to look at what could go wrong in the uncertain future of the enterprise. (Somehow threats are easier than opportunties to get departmental budget for.) The standard approach is to break risks down into commonly understood threat categories: a typical analysis would illuminated risks posed by technology failure, communications failure, security failure, natural disasters, accidents, or market/reputation risk, liability risk, financial/credit risk, and so on. This negative-outcome identification is typically followed by strategies to monitor, minimize, or control the risk event or its impact.

Doing all this is great, BUT it is just a narrow part of enterprise and industry foresight. Why? First, industry foresight or futures studies for business is focused as much on the opportunities change offers as on threats. Second, foresight tools (when correctly applied) set themselves the task of enlarging perspectives or mental maps so that we can see more things, or more possibilities than the generally expected set (whether good or bad). Set against this, risk management is little more than the catalog of known threats. The unknown or poorly understood threat, or unseen opportunity missed (and grabbed by others) is likely to be more damaging to the enterprise.

Tweet This Post