Paul McGinley
Regional Loss Prevention Mgr
Dollar Financial Group

I, like many of you, still watch too many reruns of Seinfeld. One of my favorite moments is when George is learning about (or attempting to learn about) risk management. A narrator for a book on tape begins: "In order to manage risk we must first understand risk. How do you spot risk? How do you avoid risk and what makes it so risky?" I find this entertaining on many more levels than the writers intended, but it also got me thinking (a dangerous thing, according to my wife).

We all have our own methods that we use to identify risks. We can, most likely, off the top of our heads tell our management which locations keep us up at night and why they do. But is that enough?

I ask that question because of the varying characteristics of how we respond. We can audit, train, utilize technological countermeasures (reporting, cctv, alarm upgrades, etc.), and physically be present. Excluding installation new equipment, all these are easy and seemingly free. In reality, they all have a cost.

Those costs can be definable (ex. fuel to get to the site), or undefinable (ex. your time auditing at site A rather than training at site B). Though we may not see it, it is highly likely that those costs are being calculated somewhere in your organization. Critically, they may not be calculated by someone that understands your true operational environment.

Let's consider a possible equation to bridge this gap.

Risk = (Threats x Assets) - Mitigation

Using an equation (such as the above), lets you present risk in a way that may be easier for those that do not view risks everyday to understand. For example, let's consider a scenario where we have a plate of fresh baked cookies that we will leave in a room of toddlers, alone. First, our threat is (obviously) a room of hungry toddlers. Our assets are cookies. We have no mitigating factors.

Risk = (Hungry toddlers x Cookies) - 0 mitigating factors

Looking at it this way, we know exactly what will happen. When we come back in the room there will be a room of toddlers sitting quietly... and a plate of empty cookies. It makes the risk clear and obvious, even to someone that may not be familiar with cookies or children. It also makes it clear that the mitigating factor of an adult in the room might be worthwhile, depending on the value of the cookies.

The larger point is the one I made earlier: it is critical to be able to clearly communicate risk to those that have no basis or grounding to understand in your field environment. If you cannot effectively communicate that risk, in whatever fashion you choose, chances are you will lose access to your mitigating factors or techniques.