Risk assessment and the business case

Risk belongs in the strategic decision

A strategy commits resources today for results that are uncertain. Risk assessment asks how those results could differ, what the consequences would be and whether the organisation could cope. Uncertainty can create opportunities as well as losses. Avoiding every uncertain option may itself leave the business unprepared for change.

Assess risk while comparing options, rather than after choosing a favourite. A promising return does not compensate automatically for an unacceptable safety, ethical or survival risk. Risk management should influence the choice, the resources committed and the way delivery is organised.

Concept sources: ISO — ISO 31000: Risk management — Public overview of risk, opportunity and integration with organisational decisions.

Appetite, tolerance and the effect of controls

Risk appetite

The kinds and amount of uncertainty the organisation is prepared to accept when pursuing its objectives.

Risk tolerance

More specific boundaries that translate appetite into operating decisions and escalation limits.

Inherent risk

Exposure assessed without the controls used to manage it.

Residual risk

Exposure remaining after the controls in the assessment are considered. A proposed control is not evidence that it already works.

Concept sources: Australian Department of Finance — Element 2: Risk Management Framework — Appetite, tolerance, inherent risk and residual risk; original comparison cards.

Always state whether a rating describes exposure before existing controls, after existing controls, or after planned improvements. Comparing different bases can make the least controlled proposal look deceptively attractive.

Find the risks that could change the recommendation

Look beyond immediate financial loss. The prompts below help challenge an option; they are not an exhaustive or standardised classification.

Concept sources: Australian Government — Business risks — Business risk categories and opportunity trade-offs; the investigation prompts are original applications.

Describe a risk as a connection between a cause, an uncertain event and an effect on an objective. “Demand risk” is too vague to guide action. “If employer demand weakens, course enrolments may fall below the viable cohort size, preventing recovery of delivery costs” is more useful. Distinguish the cause from the loss itself.

A practical assessment and response cycle

Concept sources: HM Treasury — The Orange Book — Risk identification, analysis, evaluation, treatment and review; original learning sequence, not a reproduced framework diagram.

Consider consequences for cash, delivery, people and reputation. Estimate likelihood over a stated period, using available evidence and recording uncertainty. Assess interactions: several manageable risks may share one cause and occur together. Keep the assessment open to challenge from people who understand the work.

A risk register should connect each significant exposure to its owner, current controls, proposed response and review trigger. Reviewing a register means checking what has changed and whether controls work, not merely updating a date.

Read a risk matrix with care

A likelihood–consequence matrix helps prioritise attention. Define each category before applying it. Labels such as rare, unlikely, possible, likely and almost certain need a common time horizon; consequence labels need thresholds relevant to the organisation.

This compact teaching matrix shows one possible escalation policy. It is not a universal rating scale.

Concept sources: APM — Project risk analysis and management — Probability–impact prioritisation; matrix entries and escalation wording are original teaching choices.

A colour or label is a prompt for judgement. It does not measure money lost, prove a probability or justify ignoring a severe event. Use quantitative analysis where it will improve the decision.

Select a response that addresses the cause

Concept sources: APM — Project risk analysis and management and ACCA — Business forecasting and strategy — Response concepts; original comparison table.

Use analytics to improve the evidence

Risk analysis can use order histories, supplier delivery records, complaint patterns and external demand indicators. A model can test how changed assumptions affect outcomes. It cannot make unreliable input data reliable.

Check whether observations represent the customers and operating conditions of the proposed strategy. Explain missing data, assumptions and the range of plausible results. For AI-assisted forecasts, test performance on appropriate data and monitor whether changing conditions undermine the model. Human review remains important when errors could materially change an investment decision.

Concept sources: NIST — AI RMF Playbook: Measure — Data representativeness, model evaluation and uncertainty in AI systems; business applications above are original.

Separate what-if, sensitivity and scenario analysis

Concept sources: ACCA — Business forecasting and strategy — Forecast uncertainty and sensitivity; Office of Impact Analysis — Cost Benefit Analysis — Testing assumptions and uncertain impacts. Original comparison.

Expected value is a weighted average

Expected monetary value adds each possible outcome multiplied by its probability. The scenarios must be mutually exclusive and cover the outcomes being modelled; their probabilities must sum to one. A weighted average is not a promised result; inspect the downside as well.

Concept sources: ACCA — The risks of uncertainty — Probability-weighted outcomes; original laboratory calculation.

Quantify benefits without counting them twice

Start with the difference between implementing the option and a credible baseline. Include effects over the relevant life of the investment. An organisation’s financial appraisal considers its cash flows; a social cost–benefit analysis considers wider effects on affected groups. State the perspective clearly.

Do not add a benefit twice under different names. If improved retention generates additional contribution, counting both that contribution and a separate dollar estimate for the same retention effect would overstate value. Record important non-financial effects even when a defensible monetary value is unavailable.

Concept sources: Office of Impact Analysis — Cost Benefit Analysis — Baseline comparison, appraisal perspective, non-financial impacts and double counting; general methods, not current regulatory submission requirements.

Bring different cash-flow dates onto one basis

Net present value discounts future net cash flows and subtracts the initial investment. Use relevant future incremental cash flows. Spending that cannot be recovered regardless of the decision is a sunk cost. Keep assumptions about inflation and the discount rate consistent.

Concept sources: ACCA — Investment appraisal — Relevant cash flows, discounting and inflation consistency; all figures and the equipment example are original.

Timing and approval conditions

Early commitment can capture an opportunity but may leave little time to test assumptions. Delay can improve information while sacrificing sales or allowing competitors to respond. A staged commitment can preserve choices, provided later stages have explicit criteria and stopping remains practical.

Concept sources: ACCA — Business forecasting and strategy — Staging decisions and project gateways; timing trade-offs are original applications.

The business case brings the recommendation together: why change is needed, which alternatives were considered, expected benefits, whole-life costs, affordability, risks and delivery arrangements. Identify the sponsor responsible for its continued validity. Revisit it at decision gates as better evidence becomes available.

Rather than “approve because NPV is positive”, a stronger recommendation might be “approve a limited first stage, subject to evidence of demand and adequate cash reserves; release the next investment only when the agreed conditions are met”. This connects analysis to an accountable decision.

Concept sources: APM — What is a business case? — Appraisal, affordability, delivery arrangements, sponsorship and decision-gate review.

Sources and further reading

• ISO — ISO 31000: Risk management: public overview of risk-based decisions.
• Department of Finance — Risk Management Framework: appetite, tolerance and assessment terminology.
• Australian Government — Business risks: sources of business exposure.
• HM Treasury — The Orange Book: integrated risk assessment and review.
• APM — Project risk analysis and management: qualitative assessment and responses.
• NIST — AI RMF Playbook: Measure: evaluating data and AI models.
• ACCA — Business forecasting and strategy: sensitivity, uncertainty and staged decisions.
• ACCA — The risks of uncertainty: expected monetary value.
• Office of Impact Analysis — Cost Benefit Analysis: general appraisal methods and common errors.
• ACCA — Investment appraisal: relevant cash flows and NPV.
• APM — What is a business case?: evidence supporting an investment decision.