Risk Management: How-to Manage Risks Made Easy

Podcast: Play in new window | Download

I received a question from a longtime friend of the show, Sheri Martin. Sheri asked: “How does one plan for SHTF with a balanced approach when everything seems most important? I always seem to get hyper-focused on one area at the expense of other important areas.”

Sheri, the short answer is Risk Management.

The long answer is to, through risk assessments, objectively examine the risk of each area or thing you’re trying to protect—your assets. That means looking at what you’re trying to protect and analyzing the impact if it’s lost, the threats which may target it, and your lapses in preparedness, which are known as your vulnerabilities. By quantifying those risk factors, risk managers, such as yourself, can objectively analyze and determine where to focus your preparedness in the form of risk reduction efforts so that you can work NOT to be unnecessarily hyper-focused on one area when you should be addressing another.

That applies during normal times, man-made and natural disasters, and SHTF scenarios. While the impact of losing an asset may shift along with the threats and vulnerabilities, the process of managing your operational risk profile remains the same regardless of the situation.

The Risk Management Process is a Fundamental Key to Preparedness

The risk identification and management process is, in my opinion, one of the fundamental keys to preparedness because it is the tool that prepares us to mitigate risk in a logical, objective, non-hyper-focused manner. It’s so important I included an entire chapter on it in my book, Mind4Survival.

As I write in Mind4Survival, to manage our risk and make our lives safer and less worrisome:

“…we must understand how to objectively (with a minimum of bias and emotion) compare our constantly fluctuating risks and opportunities as equally as possible. We must be able to compare risks equally and objectively with one another to judge which risks are most likely to cause the most significant harm should they happen. Our understanding of which risks are the most problematic in relation to one another allows us to paint the overarching picture.

Our risk profile is an objective view of everything we have to protect, everything we’re protecting it from, and everything we’re protecting it with. Therefore, understanding our profile provides us with the reality-based information we need to make the most effective decisions about managing risk and, ultimately, our lives. That’s not to say we can’t add emotion and bias to the process. What I’m saying, though, is that creating our risk profile provides us with information that we know to be as accurate as possible. How you make use of that information is up to you.”So, what does that mean? It means that to help us not hyper-focus on one aspect of our preparedness over another element that may be more important, we need to look at all of our assets on an equal and level playing field that compares one aspect of our preparedness to another.

The Three Questions

We create an equal and level playing field with which to compare our assets by repeatedly asking ourselves three simple questions:

1. What Do I Have to Protect? (Assets)

These are your assets and include all the things you value. Assets include your family, friends, home, car, and clothing. They also include your preps, such as food, water, medications, cash, etc. And they include your intellectual property, such as your computer files, essential documents, and even your reputation.

2. What Do I Have to Protect it From? (Threats)

The answer “What do I have to protect the things I value from is “threats.” These are the specific threats and hazards which, if and when they happen, can result in harm or loss to our assets. Threats include job losses, home fires, tornados, civil unrest, a pandemic, a corrupt government, and so forth. They each pose a varying degree of threat to your assets—the things you value.

3. What Do I Have to Protect it With? (Vulnerability)

You protect your assets by being prepared. So, when you ask yourself, “What do I have to protect it with” think of your preparedness. For example, when it comes to protecting your important papers, do you have a lock on the front door? What about a fireproof safe to store the important papers?

When it comes to ensuring you and your family eat, do you have a food supply stockpiled? Do you keep your front door locked? How about your food storage closet? Is it locked too? Is your food stored in a temperature-controlled area and inspected for expiration dates and mice?

Everything you do to protect your assets is part of your preparedness. Your level of preparedness is determined by all the efforts taken to ensure survival, minimize unwanted struggle, and live your best possible life.

So, what does that have to do with vulnerability? Vulnerability is everything you don’t do to prepare. Vulnerability is the absence of preparedness. If a threat to your food stockpile is heat that can cause your food to spoil, a vulnerability may be having your air conditioning go out in the summertime.

Therefore, once you know what you have to protect your assets with, you also know where you’re lacking. Yes, you have a lock on the front door, but the door frame is not reinforced, and a motivated threat can easily kick your door in. The unreinforced door frame is a vulnerability.

In the Mind4Surival book, I write, “Vulnerability is our lack of preparedness, and whereas preparedness is a measurement of our capability to mitigate and recover from harm, vulnerability is our inability to prepare for, defend against, and recover from it. Vulnerability can also be thought of as a general weakness or weakness to a specific threat(s).”

The Risk Register

So, now that you have your mind thinking about what you have to protect, what you have to protect it from, and what you have to protect it with, let’s put it all together so that it makes sense.

For this, I’m going to walk you through a sample, objective risk assessment, so you can get an understanding of how your risk management program works.

Let’s start by grabbing a sheet of paper and creating five columns, titled from left to right, Assets, Impact, Threat, Vulnerability, and Risk Score.

Asset Column

Now, I want you to think back to your assets—all the things you value. That’s what typically goes in the left column under Assets. For now, though, let’s make this easy and use the examples of Family, Car, and Food.

Impact Column

Next, we need to quantify the impact of losing each asset. This is comparative, so for example, while most human life is precious, the impact of losing a close family member or a friend is probably more impactful than the loss of a neighbor. Similarly, the loss of a bike that is stolen from your yard has less personal and financial risk than your car being stolen.

And, when it comes to food, costs are higher now due to inflation, and if you’re living paycheck to paycheck, having your food spoil would perhaps be a moderate impact. It might be tough because of your finances, and with effort, you could, in our current environment, rebuild your food pantry.

However, if society has fallen apart, in an SHTF event, perhaps the criticality, the impact of losing your food to spoilage is extremely high. In other words, if there is nothing to replace your food stockpile if it spoils, the impact of that loss is high, if not extremely high.

To capture the range of the possible impact (and the other risk factors), we’ll use the following:

• 0 for no impact
• 1 for low impact
• 3 for moderate impact
• 5 for high impact

With that, your impact scores for our example are:

Threat Column

With the impact quantified, it’s time to quantify the threat. For our example, Risk Register (that’s what we’re making), the threat you’re quantifying is a rise in local crime. So how likely are each of your assets to be affected by local crime? When we look at local crime, the facts tell us the story. We can see from the metrics that when it comes to criminals, no one is robbing home food pantries. Likewise, assaults are down, and in their place, non-violent car thefts are on the rise.

Let’s assume a local car theft ring has created a new app for breaking into cars, and they are expert lock pickers as well. They are on the prowl anywhere cars are left unattended for more than 5 minutes at a time. So, by ranking threats by their severity, similar to how we ranked impact, our threat scores are:

Vulnerability Column

Now, let’s take a look at our vulnerability. Again, vulnerability is the degree to which we are unprepared to deal with and recover from the effects of the threat. In this case, our family members are very proactive regarding their security, and the local criminal element is avoiding encounters with people. So, they’re not very vulnerable to local crime. Likewise, our home has excellent physical security features and, as such, is not very vulnerable to having our food stolen.

Finally, our car is one of the car types that the local criminals specialize in stealing from area parking lots. Therefore, despite our best efforts, our car is moderately vulnerable whenever we park at work, the store, or any nearby public lot.

Therefore, using the same scale as before, our vulnerability scores are:

That’s it. We know our assets and the impact of their loss. We also know the severity of the threat to our assets. Lastly, we know how prepared we are or aren’t and have assigned a value based on our vulnerability.

The Risk Formula

So, what do we do with that information—those data points? We apply the risk formula to each asset. In turn, the risk formula, based on our inputs, will provide us with a holistic and objective based assessment of our risk. It will show us what are our greatest and lowest identified risks.

With that, the Risk Formula is:

Risk = Impact x Threat x Vulnerability

That means multiplying Impact, Threat, and Vulnerability together, with the result being each asset’s Risk Score. Because we’re using a scale of 0 to 5, the total range is 0 to 125, with zero being the lowest possible risk and 125 being the highest possible Risk Score.

So, using the risk formula, what does our risk register show us? It shows us that while most of us are inclined to focus on our family (and I’m not saying you shouldn’t), something else may be at greater risk. Therefore, objectively speaking, based on this risk assessment, you’d be best served by either decreasing the impact of losing your car or decreasing the vulnerability to the car being stolen.

Perhaps a friend tells you they have an extra car. Therefore, if your car is stolen, it’s not as consequential as not having a backup vehicle. Next, maybe you live within walking distance of work, so you park your car in the garage for a while. That decreases your vulnerability.

As the situation evolves, you can adjust your asset’s individual risk factors up and down accordingly. In doing so, you’ll create an evolving risk profile that keeps you informed as to what your most and least significant risks are.

That doesn’t mean you have to use the information the Risk Register provides.

What it means is that you have the information available to you as a tool to weigh your courses of action and the allocation of your resources. Chief amongst your resources is how and where you allocate your time and money.

Most of us have a finite amount of both, and as such, they are often our greatest resource.

Spurious Risk Management

Rather than using the objective data of the Risk Register, you can practice what Ed Clark refers to as spurious risk management. Spurious risk management happens we disregard or minimize the objective data. In its place, we rely on emotion to guide our choices. And, in some places, it has its moment.

At times it may be beneficial to hyper-focus on one aspect of preparedness. However, referring back to our example, hyper-focusing on food over your family and car may not be the best course of action to follow. That’s not to say that you shouldn’t seize an incredible opportunity to level up your food preparedness if it comes along. However, is it worthwhile to take resources away from lowering the risk to your family and car, which the Risk Register shows to be at greater risk?

To quote my good friend, Darrian, “Yes, no, maybe so.” If the answer is yes, then hyper-focusing may be warranted. If not, then maybe it’s not warranted. The point is that if you don’t use some form of quantitative risk management, everything you do is spurious risk management.

And when that happens, when there is no objective information, every decision is based on a subjective perspective. In other words, everything is either an emotional decision or the best guest.

The Bottom Line to Risk Management

Sheri, I’m not sure if that makes sense in answering your question, “How does one plan for SHTF with a balanced approach when everything seems most important? I always seem to get hyper-focused on one area at the expense of other important areas.”

As I said, the short answer is effective risk management.

The long answer is to perform an objective risk analysis on each area or thing you’re trying to protect—your assets. That means looking at what you’re trying to protect and analyzing the impact if it’s lost, the threats which may target it, and your lapses in preparedness, which are known as your vulnerabilities. By quantifying those risk factors, you can objectively analyze and determine where to focus your preparedness efforts so that you can work NOT to be unnecessarily hyper-focused on one area when you should be addressing another.

The longer answer is to manage risk for yourself or have it done for you. Then take that information into account as much as you feel is appropriate to determine your overall best risk mitigation strategy. As you do and as you become better prepared, your overall vulnerability will likewise decrease. And as we know, as your vulnerability is the inverse of your preparedness, anytime your preparedness increases, your vulnerability decreases. In turn, a lower vulnerability means a lower overall risk and improved risk avoidance.

And that, my friends, via objective fact, is proof that preparedness not only decreases one’s risk. It is also proof that NOT preparing, is the emotional course of action and that preparing is purely logical.

Wrap Up

Lastly, I’d love to hear from you if that all makes sense. Likewise, post a comment if it doesn’t make sense. As a preparedness-minded community, we can help expand and level up each other’s preparedness.

So, share your thoughts in the comments, and good luck managing your risk.

Additional Resources:

• M4S 084: Risk Assessment Principles and Threat Mitigation
• M4S 070: What Are Your Personal Risk Assessment Components?
• M4S 002: How to Create a Risk Profile
• Risk Management on Wikipedia

 

Stay safe,