Performing a Risk Analysis
Risk analysis isn’t as cut and dry as one might think. By definition, risk analysis is the process of identifying and analyzing potential issues that could negatively impact key business initiatives or critical projects in order to help organizations avoid or mitigate those risks. However, one must consider what risk entails to do this effectively.
Let me quickly state that this is not something that only impacts organizations. These principles herein can be used in your own home as well. If you have an asset of any kind, considering possible risks to such assets can help you better protect them.
Risks can vary in nature, and they tend to depend greatly on what a potential threat can be. This is important to note because what one organization or home defines as a threat may differ greatly from another organization or home. This will likely also differ greatly depending on location. I often suggest that people ask themselves a somewhat abstract question: “What threats or potential hazards can impact our assets?”
So what are assets? Essentially, an asset is a property owned by a person or company. For this exercise, though, I want you to think of an asset as a “useful or valuable thing” because it broadens your list substantially. These “things” can be either tangible or intangible as well. What do you own, operate, lease, design, create, produce, use, maintain, sell, buy, store or rely on that you would like to protect?
That could be a lot of different things. Most will automatically assume we are talking about equipment, goods, or cash. But doesn’t it include phone numbers, jewelry, trade secrets, trademarks, or even customer lists? Again, I want you to think about it in terms of “useful or valuable things.” It could be anything for you. It could be a car, a proprietary recipe, a server, an old baseball card your grandpa gave you, or something sentimental that your child made for you.
Begin by writing out your list of useful or valuable things. This could take a while for some of you, but it’s definitely worth your time. Once you have a comprehensive list before you, we have to figure out the “exposure.”
Exposure is the exploration of possibility. The goal here is to evaluate the potential for any damage, theft, or destruction of the asset. But don’t stop there because it might even be any kind of activity that might cause harm to someone. An abstract example here might be having the kids play outside in the backyard, but you know that the awning is in bad shape and the potential for its collapse becomes greater with every gust of wind. If you know that the windy season is upon you, you could be looking at a lawsuit or even the death of a child if it’s not fixed properly.
Something to note about exposure is that it can be hard to identify potential threats when we are unaware of a possibility or are naïve to certain threats. Don’t be the person that says, “It won’t happen to me!” If that is your attitude, know it can, and if you’re not taking steps to protect it, it likely will.
A decent way to overcome this mindset is by examining the losses others in the area or industry have had to deal with. For instance, if the frequency of garage break-ins has increased in the area in recent months, but you’ve been lucky enough not to be hit yet, that doesn’t mean you’re out of the woods. Instead, it likely means that you just haven’t been targeted yet. Or how about package thefts? This has become a big problem in recent years. Ask around and find out what those with similar situations or locations have had to deal with.
I also want you to know that these are just examples. Understand that threats come in many different shapes and forms. Natural disasters are a threat. A tornado, hurricane, earthquake, winter storm, flood, or even tidal wave can take everything you own and destroy it – if it’s not properly protected. Crime is, of course, an easy threat to consider because theft, arson, fraud, shoplifting, embezzlement, murder, and so on are seemingly daily occurrences anymore. But what about fires, industrial disasters, power outages, riots, active shooters, or even terrorism? Couldn’t these impact or destroy something you deem valuable? Or better yet, what about hard drive or server crashes, hackers, and data corruption? And if you want to get into the weeds, what about something as simple as someone eavesdropping on a conversation as you talk about something important? These are all potential threats you must consider in protecting your valuable things.
Of course, none of this factors in the idea that many often put themselves and their valuables at risk by doing something as simple as posting their habits on social media. A while back, I wrote an article about the dangers of social media posts, and I would encourage you to read it because it may provide some insight into your risk analysis. At the very least, it will provide some needed attention to the things you do that could potentially put you or your valuables at risk. In my opinion, the more comprehensive your analysis is the better your chance of achieving a decent level of security.
The point is that risk analysis is not so cut and dry. This is why an entry-level risk analyst will earn an average salary of $59K annually. But you CAN do a decent job yourself if you just write it all out and try to be as detailed as possible. Think outside of the box!
So let’s say you’ve written your list and identified several potential threats. Now what? Well, now you can take steps to mitigate the threats. Know that there is no such thing as “total protection,” but there are plenty of ways to mitigate potential risks. Solutions might include something as simple as upping your insurance, fixing potential hazards, using better or different locks, hiding things, constructing barriers such as higher walls, fortifying doors, locking certain items into a fire-proof safe, keeping valuables out of your car or even having sensitive conversations behind closed doors without your phones.
Again, there is an endless number of ways to mitigate potential risks. The solution for you might be different than the house down the street. However, that’s not the point of this article. Just know that you cannot solve a problem without first identifying the problem, and proper risk analysis will help you do that.