A simple risk-driven decision technique

Even as a youth, I was told to consider my options when I was making an important decision.

My parents taught me to take a piece of paper, draw a line down the middle, and write down the “pros” on one side and the “cons” on the other.

This simple tool can be very effective.

Imagine we are considering opening an office for our business in Poland.

There are both risks (bad things that might happen and their effects) and opportunities (good things and their effects).

We fill in the table:

• The Pros might include additional revenue over the first year, with a springboard built for continued growth in Eastern Europe over the following years. We might also include the possibility of hiring additional talent in cybersecurity that could help us with some global challenges.
• The Cons could include risks related to cyber, trade compliance, ethics, reputation, and more.

But before we make a decision, we need to have more than a description of each of the Pros and Cons. We need some form of measurement.

We also need clarity on our overall objective: what we are trying to achieve. Let’s say that the overall objective is to increase enterprise revenue by 5% and that opening a new office in Poland is one option, one strategy we are considering.

We could add traditional measures of forecast revenue dollars for the first year and subsequent years to the Pros, and put some value on the possibility of hiring cyber talent.

We could add traffic light (high – medium – low) ratings to the risks in the Cons column.

But those measures are not really helping us with our decision.

So we add a likelihood estimate to the revenue forecast numbers. If we are sophisticated, we change the single point revenue numbers to revenue ranges with associated likelihoods.

We also change the risk ratings to some valuation of the potential effect and indicate the likelihood – again, upgrading from single point effects to ranges if we are sophisticated.

We are now getting close, but how do we weigh the Pros and Cons?

Maybe everything is now quantified so you can determine whether there is a net positive (Pro) or negative (Con) to opening the office.

The next question is whether that net is sufficient for you to achieve the overall enterprise objective.

Maybe there is a positive return, but is it sufficient? How does any ROI compare with other uses of the necessary funds?

Are there better options?

What would happen if you accelerated the opening, perhaps increasing some Cons but also increasing the Pros?

…and so on.

I suggest that this simple technique is one we should always consider when making important decisions.

A risk register or heat map simply doesn’t come close to adding the same value to a decision-making process.

The risk practitioner can help with the Pros and Cons in many ways, from facilitating the identification of the Pros and Cons, to assessing each of them in a way that enables them to be aggregated and compared, and then with tools and techniques to weigh everything together and determine whether they are likely to satisfy enterprise objectives.

In fact, the sophisticated practitioner can take a simple Pros and Cons list and transform it using models and tools like Monte Carlo.

What do you think?

• About
• Latest Posts

Norman D. Marks, CPA, CRMA

Norman has led large and small internal audit departments, been the Chief Risk Officer and Chief Compliance Officer, and managed IT security and governance functions.

He retired in early 2013. However,he still blogs, writes, trains, and speaks – and mentors individuals and organizations when he can.

Latest posts by Norman D. Marks, CPA, CRMA (see all)

• How effective are your systems of governance, risk, and control/compliance (GRC)? - October 19, 2021
• Delivering value from IT audit - September 22, 2021
• Selecting software for risk management - August 18, 2021