John Weathington, President & CEO of Excellent Management Systems, Inc.
  • John Weathington
    John Weathington

    Top companies seek out John's expert insights, including: Visa, Paypal, Cisco, Hewlett-Packard, Dell, Sun Microsystems, HDS, Silicon Graphics, MCI, and CBS Interactive.

  • Behavioral Science
    Behavioral Science

    "I find it fantastic how I can just throw you into almost anything and you use your knowledge of process and technical organizations to do the job well." --Jennifer Selby Long, Owner, Selby Group

  • Customer Loyalty
    Customer Loyalty

    John helped Visa evolve its cardmember loyalty platform to enhance credit market adoption and attract large financial institutions to its loyalty offerings.

  • Big Data Analytics
    Big Data Analytics

    "We appreciate your ability to quickly model the client’s landscape, and provide insightful data investigation, discovery, and statistical analysis." --Michael F. Mason, Partner, Hogan and Hartson

  • Relationship Strategy
    Relationship Strategy

    "John has been a pleasure to work with on the board and in the Executive Committee. The more I’ve gotten to know John, the more I appreciate his skills." --Brett LaDove, Past President, Institute of Management Consultants

Things Just Keep Getting Riskier

How to Handle Compound Risk--When Risk Begets Risk

Compound risk happens when the impact of a risk event produces another risk. Before your head explodes, let me give you an example. Suppose your company faces the risk that a tired night watchman will fall asleep on the job. What’s the real business impact of this? Well, somebody might sneak in and steal your inventory. The operative word here is might.

This should tip you off, that another risk is involved. Carrying the example forward, what’s the impact of somebody stealing your inventory? This is more tangible. If, on any given night, you stock $100K worth of inventory, then that’s the real impact of the theft, which happened because the night watchman was asleep. This is what I call a compound risk.

To understand how to handle compound risk, let’s review how normal risk is handled. You deal with an important risk, by introducing a control. For instance, the risk of an inexperienced processor entering in the wrong data could be controlled by a manager’s review and approval of the data. This is called a contingent control because you proactively address the impact of the risk. Out of respect for risk, astute managers build contingency reserves into their processes. This is time and money set aside to absorb the impacts of process risks when they show up. Compound risk happens when the impact of one risk results in another risk, such as in our night watchman example above.

Contingency Reserve:

Contingency reserve is the amount of time and money set aside to absorb the impacts of risk. This is a very important concept to embrace for management of any kind: including program, project, and operational. Novice managers who don't allocate and adjust for contingencies constantly run out of money and push delivery times--not great for stakeholder relationships.

To determine the contingency reserve contribution for a simple (i.e. non-compound) risk, multiply the probability of the risk by the impact. For example, let’s say your operation runs the risk of network failure. If the network goes out, you’re estimating 1 days’ worth of lost work. On any given day, the probability of the network going out is 5%. So, if your project is scheduled for 150 days, you would allocate 7.5 days in your contingency reserve to handle network outages.

Now, let’s take a compound risk example. Let’s say there are rumors of a layoff announcement. The chances of this announcement actually happening are about 30%. If the announcement happens, there will be layoffs, but the layoffs might not affect your operation. In fact, there is only a 20% chance that any layoff announcement would have any impact on the operation. If the layoff announcement does affect your operation, it’s estimated that it will cause a 30 day delay in outputs as you scramble to readjust. In your qualitative analysis, you deem this compound risk as important, so you will make a contribution to your contingency reserve. But how much is appropriate?

To handle this situation, simply multiply the probability of the first risk (30%) by the probability of the second risk (20%). In our example, this gives us a combined compound risk of 6% (0.3 x 0.2). Now apply this 6% to the impact (30 days), and you arrive at 1.8 days (0.06 x 30) of contingency reserve. One thing to realize about risk and contingency reserve, is that the impact doesn’t show up the way you calculate it for your reserve. If the 6% probability actually shows up, you won’t have 1.8 days of impact, you will have 30 days of impact! The idea of reserve is, provided your estimations of probability and impact are accurate your aggregate reserve should normalize with enough risk opportunities. Although the idea of a 30 day delay is unappealing, there’s also a 94% chance that you’ll be able to use this amount of your reserve somewhere else.

Understanding risk is vital to your operational excellence; however, understanding compound risk will demonstrate your savvy and give you greater visibility into your uncertainty. Compound risk in an enterprise can be handled through a mitigating control, and compound risk on a program, project, or process is handled by simply multiplying the respective risk probabilities together. Revisit your operational portfolio today to uncover hidden compound risks, and adjust as necessary with your new found knowledge.