Abstract

There are two ways organizations deal with risk: identifying potential risks with a big impact but low chance of occurrence, and identifying known risks. The question becomes: Should organizations try to prevent potential risks, even if the chance of occurrence is low? The author outlines a risk management approach that doesn’t consider the chance of occurrence and subjects all potential risks to risk measures. Omitting the chance of occurrence creates an opportunity to manage incidents, so risks are prioritized not by calculated risk, but by potential risk. The result is an organization with a high risk maturity level.