There will always be risks in business. That is not pessimism, it is physics. Every project, every company, every product launch moves into the future, and the future is unknown by definition. So risk management is not an attempt to make sure nothing bad happens. It is having a plan B for when something bad does happen.
Many entrepreneurs treat risks like a superstition: if you do not think about them, they will not come. For a long time I was an optimist in that sense too, until several projects taught me otherwise. The most painful blows came not from unexpected catastrophes but from things that could have been foreseen with five minutes of thought. Nobody spent those five minutes.
Lessons from mountaineers
I like how mountaineers deal with risk, because for them the cost of a mistake is the highest possible. An experienced expedition never goes for the summit without a plan. It sets up base camp, acclimatises, climbs roped together on belay, hammers in anchors at regular intervals. And most importantly: in advance, still down below, it sets a turnaround time. If the summit has not been reached by two in the afternoon, the group turns back, no matter how close the goal seems.
This rule exists because people make bad decisions at altitude. Fatigue, lack of oxygen and excitement take their toll. "Another half hour and we're there" sounds very convincing when the summit is in sight. And that is exactly how people die. Climbers know the decision to turn back must be made with a clear head, not at the moment when emotions are stronger than reason.
Business works the same way. Decisions about when to stop a failing project, when to stop investing in a hypothesis, when to change a contractor must be made in advance, at the start. Otherwise you will keep investing "just a little more" until the money runs out.
A simple algorithm for working with risks
You do not need complex methodologies to begin. Three steps are enough.
- Identification. What can go wrong? Gather the team for an hour and write down everything that comes to mind. A key client leaves. A supplier raises prices. The lead developer quits. The service everything is built on shuts down. Tax rules change. Do not filter at this stage, even absurd options.
- Assessing probability and impact. For each risk, estimate two things: how likely it is to happen and how painful it will be if it does. Precision is not needed, "low, medium, high" is enough. Risks with high probability and high impact are your main enemies.
- A plan for prevention or mitigation. For the main risks, decide what to do. You can reduce the probability (diversify clients, document the key developer's knowledge). You can reduce the impact (keep a cash reserve, have a backup supplier). You can transfer the risk (insurance, a contract with penalties). You can consciously accept it if protection costs more than the potential damage.
After that the list does not go into a drawer, it is reviewed monthly. Risks change. Some disappear, others appear, and some go from unlikely to almost inevitable.
Unknown unknowns
There are risks you can list. And there are those you do not even suspect. A pandemic that closes offices worldwide. A new technology that makes your product worthless within a year. A regulator banning what was normal yesterday. They cannot be put on a list because nobody sees them in advance.
Against such risks it is not a plan that works but resilience. A company with a cash reserve for several months will survive almost any shock. A company that depends on one client, one supplier or one person can collapse from any of them. So the best protection against the unknown is having no single points of failure and having reserves.
System architects, and I count myself among them, think about this constantly. A good software system is built so that the failure of one component does not bring down everything else. A server goes down, the backup takes over. The database is corrupted, there is a fresh copy. A business should be designed the same way. If any single element disappears tomorrow, can the company still work?
Small bets instead of big ones
Another principle I have learned from practice: under uncertainty it is better to make many small bets than one big one. Instead of developing a big product for a year and then discovering nobody needs it, build a prototype in a month and test the reaction. Instead of immediately opening an office in a new country, test demand with advertising and a few sales.
A small bet may lose, and that is fine. You lost a little but learned the truth. A big bet that loses can bury the company. That is exactly why we at Ingello love fast prototypes so much: the Fractal generator lets us assemble a working model of a system in days and show it to real users before serious money has gone into development. That is risk management too, just in engineering form.
And distinguish reversible decisions from irreversible ones. Reversible ones (trying a new ad channel, changing the meeting format) can be made quickly. Irreversible ones (signing a long contract, letting go of a key team, rewriting a system from scratch) require a pause, calculation and, ideally, a second opinion.
What to do this week
Set aside an hour and write down ten risks for your company or project. Rate each one by probability and impact. For the three most dangerous, come up with a concrete plan B and assign an owner. And define your own "turnaround time": by what signs you will know that the current project or direction should be stopped.
This does not guarantee that nothing bad will happen. But when it does, you will not be a lost person in a blizzard, but a climber on belay who knows where the next anchor is.
