Risk is also the opportunity you miss: weighing threats, upside and the cost of standing still

Most risk management looks one way. Owners ask what could go wrong. Managers list threats. Advisers look for gaps in controls. Lenders and insurers ask about losses, non-compliance and failure. All of this is necessary, and a business that ignores it will eventually be hurt.

But there is another kind of risk that rarely appears on a risk register: the chance that the business becomes so good at protecting what it already does that it consistently underinvests in what it will need next. New products, new capabilities, new ways of working and new markets are uncertain by nature. If uncertainty automatically lowers an idea’s priority, those ideas lose to safer work whose value is easier to defend. The business looks well controlled while its future position quietly weakens.

This article is not an argument for recklessness. It explains how a one-sided view of risk can distort decisions, why standing still carries risk too, how to set out where the business is and is not prepared to accept uncertainty, how to separate learning from scaling so that opportunities can be explored cheaply, and a simple test that weighs threats and opportunities together.

Uncertainty has two sides

The same change can be a threat or an opportunity, depending on how it is viewed. New technology may threaten an existing service while making a lower-cost way of working possible. Automation may change some roles while improving safety and capacity. A supply disruption may raise costs while revealing an opportunity to redesign a product or build a more reliable supply chain. A new regulation may look like a compliance burden or a chance to build a capability before competitors do.

Research on how managers handle uncertainty in project portfolios suggests that framing matters. A 2014 study by Martinsuo, Korhonen and Laine, examining ten research and development portfolios, found that managers tended to frame uncertainties as threats more readily than as opportunities, and that the framing influenced which responses they considered. Facts matter, but so does the lens through which the business looks at them.

Common misreadings

The purpose of risk management is to reduce risk. A better purpose is to improve the quality of the risks the business takes in pursuit of its goals. A business that eliminates all significant uncertainty may also eliminate its ambition.

Threats and opportunities are separate events. Often they are two sides of the same change.

Cautious choices are more resilient. A business concentrated on mature, predictable activities can become fragile if its environment changes faster than it can adapt. Resilience includes the ability to create new options, not just protection from variation.

Innovation should be exempt from risk discipline. The opposite is true. Where uncertainty is high, clear assumptions, staged commitments, small experiments and agreed stop points matter more, not less.

The status quo has risks too

A risk review usually compares a new proposal with continuing as before, and treats continuing as before as safe. It rarely is. Two questions deserve equal attention:

What could destroy value if we act?
What value could we fail to create, or lose, if we do not act?

The second question is usually underdeveloped. Some examples:

A business that waits until a new market is fully proven may find competitors have already learned how to serve it.
A manufacturer that defers automation because the case is not certain may find labour, quality or capacity constraints become more damaging than the investment risk would have been.
A business that keeps an ageing system because it knows how it behaves may be accepting rising security, maintenance and key-person risks it has stopped noticing.

The real comparison is not between a risky option and a risk-free present. It is between two sets of risks, one of which is simply more familiar.

Familiar problems feel safer than unfamiliar opportunities

When proposals are discussed mainly in terms of what could go wrong, people focus on control, loss and reasons not to proceed. Sometimes that is right. Some proposals should be rejected.

The difficulty arises when this scrutiny falls more heavily on unfamiliar work than on existing activities. Existing activities seem safer partly because their risks are known. The old machine, the long-standing supplier, the established product and the familiar system escape examination because everyone is used to them, while every new idea faces intense questioning because its uncertainty is visible.

The result is an imbalance: known problems are accepted while unknown opportunities are penalised. Over time, the business rewards familiarity rather than value.

Say where you will accept uncertainty

Risk appetite is a statement of how much and what kind of risk a business is prepared to accept in pursuit of its goals. It is usually written as a list of things the business will not tolerate. It is more useful when it also says where the business is deliberately prepared to accept uncertainty. For example:

Area	Appetite	What it means
Small experiments in a technology important to our future	High	We will fund bounded trials without requiring proof of return first
Entering a related market through a partner	Moderate	We will try it with limited commitment and clear review points
Large, irreversible capital spending before customer evidence	Low	We will not commit until customers have shown willingness to pay
Safety, legal or ethical compromise	Very low	We will not accept it for any expected return

A statement like this gives managers permission to explore within limits and makes clear where the limits are. Without it, people tend either to take risks nobody has agreed to or to avoid risk altogether. For a small business, the statement can be a short page agreed by the owners and reviewed once a year.

Separate learning from scaling

One of the most effective ways to avoid both recklessness and paralysis is to separate the decision to learn from the decision to scale. A business does not need to make a full investment to explore an uncertain opportunity. It can:

run a small pilot with one customer or one site;
fund a short technical investigation;
test an offer with a few customers before building it;
build a prototype;
launch in one area first;
partner with another business rather than building alone;
rent or borrow equipment before buying it.

Each of these buys information. The spending may not produce a commercial return directly. Its value lies in reducing uncertainty enough to make the next decision better.

That does not mean every experiment should continue. Each needs a clear hypothesis, an agreed measure of success and a point at which it will stop if the evidence is not there. Otherwise, the language of innovation becomes another way of protecting weak projects. The article on finding and testing a business idea describes practical ways to test an offer with customers before building it.

Options cost money to keep open

Keeping options open has a cost. Running several experiments, maintaining alternative suppliers or holding spare capacity uses money and attention. Too many options spread a small business thin.

So be selective. A useful question is: what would be expensive to discover too late? If the answer is a technology your customers will soon expect, a regulatory capability, a shift in customer behaviour or a dependence on a single supplier, an early, small investment in learning may be justified even if its short-term return is weak. If the answer is “not much”, the option probably is not worth the carrying cost.

The threat and opportunity test

For each significant uncertainty the business faces, work through six questions together:

Threat: what could materially damage value, safety, reputation or delivery?
Opportunity: what value might become available because this condition is changing?
Status quo: what happens if we do nothing?
Reversibility: can we test the opportunity without a large commitment that is hard to undo?
Appetite: is this a kind of uncertainty we have said we are willing to accept?
Evidence path: what would need to become true before we scale, stop or change direction?

The symmetry matters. It stops a risk review from becoming automatically defensive, and it equally stops enthusiasm from passing over real threats.

Welcome uncomfortable views in both directions

Businesses rightly encourage people to raise concerns. They should equally welcome people who raise opportunities that challenge current assumptions. A staff member who says a new technology could make the main product obsolete is raising both a threat and an opportunity. A supplier suggesting a very different process may disrupt established plans. A frontline worker may see a new service that does not fit any existing category.

If the business only rewards information that supports its current plan, it loses both early warnings and early opportunities. The aim is honesty in both directions: threats should not be suppressed because they are inconvenient, opportunities should not be dismissed because they are uncertain, and neither should be exaggerated because someone is personally invested.

A worked example

This is an illustration. A joinery business with 20 staff makes custom kitchens and cabinetry for homeowners and small builders. Over two years, the owners notice that several builders are buying flat-pack cabinetry from large suppliers for their standard homes, and builder work has fallen from about 40% of revenue to about 30%.

The owners’ first instinct is to treat this as a threat and respond defensively: cut prices for builders and focus harder on custom homeowner work. They apply the threat and opportunity test instead:

Threat: builder revenue continues to fall, and price cuts reduce margin on the work that remains.
Opportunity: builders want speed and predictable installation. A pre-assembled, standardised range, delivered ready to install, might suit them better than flat-pack and better than fully custom work.
Status quo: on current trends, builder work could fall to around 20% of revenue within a few years, leaving the business dependent on homeowner demand, which is more seasonal.
Reversibility: a full move into standardised production would need a new CNC machine costing around $400,000. A pilot could use existing equipment and some overtime.
Appetite: the owners agree they have high appetite for a bounded trial and low appetite for buying the machine before builders have committed to volumes.
Evidence path: the pilot is a success if one builder takes ten pre-assembled kitchens at an agreed price, installation time on site falls noticeably, the margin is at least as good as current builder work, and the builder commits to a further order of at least 40 kitchens.

The pilot costs about $35,000 in design time, jigs and extra labour. Installation time falls sharply, the margin is slightly better than existing builder work, and the builder places an order for 45 kitchens over the next year. A second builder asks for a quote. Only then do the owners consider the CNC machine, and they decide to lease rather than buy, keeping the commitment reversible while volumes build.

The same review prompts a second look at an existing risk the business had stopped noticing: its 18-year-old edge-banding machine, which only one employee knows how to keep running. That risk had never been on a list because it was familiar.

How this applies to a small Australian business

Small businesses often lack the money to take big risks, which makes the discipline described here more useful, not less. Practical steps:

Ask both questions: what could go wrong if we act, and what could we lose if we do not?
Examine the status quo with the same rigour as new proposals.
Write a short risk appetite statement that says where you will and will not accept uncertainty.
Separate learning from scaling, and fund small, bounded experiments with clear stop points.
Be selective about options, focusing on what would be expensive to discover too late.
Use the threat and opportunity test for significant uncertainties.
Welcome people who raise uncomfortable opportunities as well as uncomfortable risks.
Keep non-negotiables firm: safety, legal obligations and ethical standards are not areas for experimentation.

The articles on proving a new technology is ready to depend on and the best technology may not be the next investment cover related decisions.

Signals worth watching

Nearly every risk discussion ending with avoidance.
New ideas required to meet the same evidence standard as mature investments before any learning is funded.
Old systems, equipment and suppliers escaping scrutiny because their risks are familiar.
Opportunities repeatedly deferred until things are “more certain”.
A clear list of threats but no list of opportunities.
A failed small experiment treated as a failure rather than as information.
The opposite signal: every threat described as an opportunity, which suggests risk is being rationalised rather than managed.

Common mistakes

Treating the status quo as risk-free.
Scrutinising new ideas more harshly than existing activities.
Writing risk appetite only as a list of things to avoid.
Demanding certainty before funding any learning.
Funding experiments without stop points.
Keeping too many options open at once.
Using the language of opportunity to justify ignoring a real threat.

Frequently asked questions

How much should a small business spend on experiments? There is no fixed figure. Decide an amount the business could lose without serious harm, spend it on a small number of well-designed tests and review the results before spending more.

What if an experiment fails? If it was designed well, it produced information. Record what was learned, decide whether the opportunity is still worth exploring in a different way and stop if it is not.

How do we stop people protecting pet projects as experiments? Agree the hypothesis, success measure and stop point before the experiment starts, and have someone other than its champion review the result.

Should risk appetite be written down? Yes, even briefly. A written statement makes it easier for managers and staff to know what they may try without asking, and what they must never do.

How often should we review our biggest uncertainties? At least once a year as part of planning, and whenever something significant changes in the market, technology, regulation or the business itself.

Questions to ask

Which opportunities are we rejecting mainly because their uncertainty is visible while the risks of standing still are not?
Which changes could be both a major threat and a major opportunity?
Where should we buy information through a small trial rather than demand certainty?
Does our risk appetite say where we are willing to accept uncertainty?
Which existing activities seem safe only because we are used to them?
What would be expensive to discover we needed only after competitors have it?

Bringing it together

Risk management should make a business wiser about uncertainty, not simply more cautious. Weigh threats and opportunities together, examine the status quo as carefully as new ideas, say where the business is prepared to accept uncertainty, and separate cheap learning from expensive scaling. Keep options selectively, welcome uncomfortable ideas in both directions and hold firm on the things that should never be at risk. The goal is not to be fearless. It is to make sure that fear is not quietly setting the business’s direction.

Source: KEVOS notes, drawing on M. Martinsuo, T. Korhonen and T. Laine, “Identifying, framing and managing uncertainties in project portfolios”, International Journal of Project Management (2014), and on guidance on risk appetite published by the Committee of Sponsoring Organizations of the Treadway Commission. Examples and figures in this article are illustrations.