Introduction
Risk information is useful to a strategic decision only when it helps decision-makers choose among actions. A list of risks can identify what might go wrong, but it does not by itself show whether to proceed, change the plan, add a control, or accept the exposure. Likewise, a business case can look persuasive while concealing how much its result depends on uncertain assumptions.
Three recurring failures are especially consequential: treating a risk register as if it were decision analysis, burying uncertainty behind a single forecast, and escalating a concern without stating what decision is needed. The remedy is not a more elaborate risk report for its own sake. It is a clear connection between the decision, the evidence, the uncertainty, the relevant constraints, and the action requested.
Failure 1: Treating a Risk Register as a Decision Analysis
A register helps establish that a team has considered important exposures. It may also help assign ownership and track follow-up actions. However, entries such as “supplier disruption: high,” “customer response: medium,” or “regulatory change: low” do not tell a decision-maker what the alternatives are or how they compare. A rating is a summary judgment under a chosen scale; it is not automatically a measure of value, probability, or the best action.
For a decision to be risk-informed, the analysis should make the choice visible. State the alternatives, the material outcomes associated with each, and the criteria used to compare them. These criteria can include expected financial value, a limit on a severe downside, consistency with risk appetite, or a combination of considerations. If a constraint rules out an otherwise attractive alternative, say so directly.
Worked Example: A Register Entry Is Not a Launch Recommendation
A hypothetical insurer is considering a new digital distribution channel. All amounts below are net present values in thousands of dollars; the scenario values already include the estimated launch costs. The team estimates these outcomes:
- Full launch: a 30% chance of 900, a 45% chance of 300, and a 25% chance of -600.
- Limited pilot: a 50% chance of 220, a 40% chance of 100, and a 10% chance of -80.
- Hold: an outcome of 0 for comparison.
The stated risk appetite does not permit an alternative whose modeled severe downside is below -500. The probabilities for each alternative sum to 100%. Use the expected net present value as one comparison, then apply the stated downside constraint.
Method. Calculate each expected value as the probability-weighted sum of its scenario outcomes. For the full launch:
The full launch has an expected net present value of 255. Its worst stated scenario is -600, which is below the permitted -500 threshold. It therefore fails the stated constraint even though its expected value is positive.
For the pilot:
The pilot has an expected net present value of 142. Its worst stated scenario is -80, which is not below -500. Holding has an expected value of 0 and no modeled loss in this comparison. On the stated information, the pilot is the highest-valued alternative that meets the downside constraint.
Decision implication. The calculation supports considering the pilot, not an unconditional full launch. Before acting, decision-makers should confirm that the scenario estimates and the downside limit are suitable for this choice. The arithmetic checks: each set of probabilities totals 1, and the expected values lie between the respective smallest and largest scenario outcomes.
Common mistake avoided. A register might label launch risk “high” and pilot risk “medium,” then treat those labels as the recommendation. That skips the comparison. Here, the expected value favors full launch, but the explicit downside constraint excludes it; the pilot is preferred among the alternatives that satisfy that constraint.
Failure 2: Burying Uncertainty in a Business Case
A business case often needs a central forecast, but a central forecast is not a complete description of uncertain outcomes. If a presentation highlights only a favorable base case, decision-makers may mistake a conditional estimate for a dependable result. This is especially risky when the result depends on adoption, pricing, claims experience, implementation timing, or other assumptions that could vary materially.
A decision-useful business case identifies the assumptions that matter, shows plausible alternative outcomes, and explains how those outcomes affect the choice. When probabilities are available and appropriate, a weighted expected outcome can be calculated. When probabilities are not credible, scenario comparisons and sensitivities can still show what changes the conclusion. Uncertainty should not be hidden by assigning unsupported precision.
Worked Example: A Favorable Base Case Conceals Downside
A hypothetical insurer is reviewing a product expansion. Its business case reports a base-case net present value of 14 million dollars. The team has also documented three mutually exclusive outcomes, all in millions of dollars of net present value: the base outcome of 14 with probability 0.50, a constrained outcome of 4 with probability 0.30, and an adverse outcome of -20 with probability 0.20. The decision-makers require explicit review of any scenario with a loss greater than 15 million dollars in magnitude.
Method. First check the probabilities: \(0.50+0.30+0.20=1.00\). Then calculate the expected value:
The modeled expected net present value is 4.2 million dollars, not the 14 million dollars shown by the base case alone. The adverse outcome is -20 million dollars, and its probability is 0.20. It crosses the stated review threshold, so the business case requires explicit downside review even though its expected value is positive.
The appropriate conclusion is not simply “approve because expected value is positive” or “reject because there is a loss scenario.” The analysis identifies what the decision-makers need to resolve: whether the assumptions and adverse exposure are acceptable, whether a mitigation or revised design is available, and whether the decision criteria permit proceeding. If the probabilities are judgmental, that limitation should also be stated rather than presented as if the expected value were exact.
Check. The expected value of 4.2 lies between the lowest outcome, -20, and the highest, 14. The adverse scenario has a 20% probability, so the probability of a negative outcome in this three-scenario model is 0.20.
Common mistake avoided. Reporting 14 million dollars as if it were the expected result confuses the base scenario with the probability-weighted result. The correction is to show the scenario set, calculate 4.2 million dollars from the stated assumptions, and separately disclose the 20% adverse-scenario probability and threshold breach.
Failure 3: Escalating a Risk Without a Decision Request
An escalation can fail even when the underlying concern is important. “Cyber risk is increasing” tells senior leaders that someone is worried; it does not tell them what they are being asked to decide. A useful escalation states the decision needed, the available choices, the consequences of acting or not acting, the relevant constraint, and the date by which a decision is required.
The request should also identify who owns the analysis and who is accountable for the risk or action. Escalation is not a substitute for ownership: the person raising an issue should make the requested decision clear, while the appropriate decision-maker retains authority to accept, reduce, transfer, or avoid the exposure.
Worked Example: Turning a Cyber Escalation into a Decision
A hypothetical insurer’s claims platform could suffer one major disruption during the next year. Assume at most one such event in the year, and assume the impact of an event is 2 million dollars. The current annual event probability is estimated at 8%. A basic control costs 100,000 dollars and would reduce the probability to 3%. An enhanced control costs 300,000 dollars and would reduce it to 2%. The decision criterion is to keep the annual probability at or below 4%. Treat the control cost and expected disruption cost as amounts over the same one-year horizon, and assume the stated impacts and probabilities are suitable for this comparison.
Method. For each option, calculate expected disruption cost as event probability multiplied by impact, then add the control cost. With no new control, the expected disruption cost is:
The current option has an expected one-year cost of 160,000 dollars, but its 8% event probability exceeds the 4% criterion.
With the basic control, expected disruption cost is:
Adding the 100,000-dollar control cost gives a total expected one-year cost of \(60{,}000+100{,}000=160{,}000\) dollars. The 3% probability meets the criterion.
With the enhanced control, expected disruption cost is:
Adding the 300,000-dollar control cost gives \(40{,}000+300{,}000=340{,}000\) dollars. The 2% probability also meets the criterion. Among the options that meet the stated probability limit, the basic control has the lower expected one-year cost: 160,000 dollars versus 340,000 dollars.
Decision implication. A decision request could ask the authorized executive to approve the basic control’s 100,000-dollar cost by a stated date, identify the accountable implementation owner, and confirm whether the 4% probability limit is the governing criterion. The request should disclose that the no-control option misses that limit and that the enhanced control costs more under the stated expected-cost comparison.
Check. Each expected disruption cost is less than or equal to the 2 million dollar impact, as it must be when the event probability is at most 1. The basic-control total includes both the 60,000-dollar expected disruption cost and the 100,000-dollar control cost; omitting either would misstate the comparison.
Common mistake avoided. An escalation that says “the platform could cause a 2 million dollar loss” may be misread as a 2 million dollar expected cost. Under the stated model, that is the event impact; the current expected disruption cost is \(0.08(2{,}000{,}000)=160{,}000\) dollars. The event impact still matters for severity, but it should not be confused with the probability-weighted cost.
A Practical Diagnostic Before a Decision
Before presenting a strategic choice, check whether the analysis answers the following questions. A “no” does not necessarily invalidate the work, but it signals what must be clarified before the information can support a decision.
State what is being decided, by whom, and by when. Avoid presenting a risk concern without identifying the choice it affects.
Include the relevant actions, such as proceeding, changing scope, piloting, adding a control, or waiting. A list of exposures without alternatives is not a comparison.
Show material scenarios, assumptions, and sensitivities. Distinguish a base case from an expected value, and identify where probabilities or estimates are uncertain.
Compare outcomes using the criteria that govern the choice, including explicit risk-appetite constraints. Do not assume that one summary measure answers every decision question.
State the recommended action or the specific judgment required, the owner, the decision deadline, and any follow-up monitoring or conditions.
Why These Failures Matter
These failures can distort strategic choices in different ways. A register mistaken for an analysis can create false confidence that risks have been “accounted for” when alternatives have not been compared. A business case with uncertainty buried in its assumptions can make a conditional forecast look like a dependable outcome. An escalation without a decision request can delay action or leave responsibility unclear.
A disciplined review does not require every uncertainty to be converted into a precise probability or a single monetary value. It does require an honest account of what is known, what is assumed, which outcomes could change the decision, and what authority is being asked to do. If estimates are weak, state that limitation and show how it affects the conclusion. If no option meets the stated constraint, make that conflict explicit rather than quietly relaxing the constraint.
A common exam and practice trap is to treat a high risk rating, a positive expected value, or a severe scenario as sufficient on its own to determine the action. Each is information, not a universal decision rule. The decision follows from the alternatives, evidence, assumptions, and criteria taken together.
Check Your Understanding
For each problem, identify the relevant decision issue and work through the stated calculations or recommendation.
- A hypothetical insurer compares two initiatives, with all outcomes in thousands of dollars of net present value. Initiative A has outcomes of 800, 100, and -400 with probabilities 0.20, 0.50, and 0.30. Initiative B has outcomes of 250, 150, and -50 with probabilities 0.40, 0.40, and 0.20. A downside constraint excludes any option with a modeled outcome below -200. Calculate both expected values and identify the highest expected-value option that meets the constraint. (Answer: A has expected value \(160+50-120=90\); B has expected value \(100+60-10=150\); A fails the constraint, so B is the highest expected-value option that meets it.)
- A business case shows a base outcome of 9 million dollars but also has a 25% probability of a 3 million dollar outcome and a 15% probability of a -15 million dollar outcome. The remaining probability is assigned to the base outcome. Calculate the expected value and the probability of a negative outcome. (Answer: The base probability is \(1-0.25-0.15=0.60\); expected value is \(0.60(9)+0.25(3)+0.15(-15)=5.4+0.75-2.25=3.9\) million dollars, and the probability of a negative outcome is 0.15.)
- A team reports “supplier failure: high” in a register and asks for approval to proceed with a major expansion. Name two items needed before that rating can support a decision. (Answer: At minimum, state feasible alternatives and compare their outcomes; also clarify the material scenarios or assumptions and the decision criteria, including any relevant appetite constraint. The rating alone is not a recommendation.)
- A hypothetical control costs 80,000 dollars and reduces a one-year disruption probability from 6% to 2%; the event impact is 1.5 million dollars. A decision criterion requires probability no greater than 3%. Calculate the expected one-year cost with and without the control, including its cost, and state whether it meets the criterion. (Answer: Without control, \(0.06(1{,}500{,}000)=90{,}000\) dollars; with control, \(0.02(1{,}500{,}000)+80{,}000=30{,}000+80{,}000=110{,}000\) dollars. It meets the 3% probability criterion, although its stated expected cost is 20,000 dollars higher.)
- A senior committee receives a report that describes a material exposure but does not identify an owner, deadline, or requested action. What should an actionable escalation add? (Answer: Specify the decision or judgment requested, the feasible options and material consequences, the accountable owner, and the date by which a decision is needed; state any relevant constraint or uncertainty.)