Oct 13, 2026 · 15 min · 6 segments
I used to be responsible for assuring the communications plans for each risk in the UK's National Risk Register. The risks it catalogues range from the hair-raising (“nuclear miscalculation”), to the…
Simon BaughHost
Almost every organization will have a risk register and a regular review process.
In fact, I think they may obscure some of the most important risks to prepare for, give organizations a false sense of security, and cause people to do less on crisis preparedness than they really should.
So why is that? Well, as in most organizations, government risks start with a matrix which shows the plausible worst-case scenario for each risk assessed by likelihood and impact.
And the likelihood axis assesses the probability that the risk will occur at least once over the next five years.
And my first piece of advice is to immediately reject any risk register that fails to describe the time period during which a risk will happen.
Describing the risk of something happening as a ten percent chance without also specifying the time period makes it completely meaningless.
There's a massive difference between there being a ten percent chance of something happening in the next a hundred years versus it happening in the next ten minutes.
Even worse might be risk registers that assess risks using words such as likely or unlikely without defining what that means.
Describing something as unlikely might be heard by one person as a forty percent chance of something happening, while another person might interpret it as less than ten percent.
That's why government uses precise frameworks for describing risk events with a number attached, even where the risk itself is difficult to quantify.
If you categorize an event as a one percent chance of happening this year, it might feel easy to ignore.
But low likelihood catastrophic events might be among the most important to prepare for.
Is preparing for flooding more important than preparing for the next pandemic just because it is more likely to happen soon? And besides, ten risks, each with a one percent annual chance, still add up to an average of one event per decade.
To take a real example, over the last twenty years, Heathrow Airport has been hit by unusually severe winter weather, a global pandemic, and a power outage.
But the problem is there's a lot of different once-in-a-hundred-year events that might hit an airport.
Likelihood of an occurrence shouldn't be the only measure of whether preparation is worthwhile.
A rare event, but one that would see your company go out of business if it crystallized, may still be worth preparing for if that preparation makes the risk survivable.
Almost every organization will have a risk register and a regular review process.
In fact, I think they may obscure some of the most important risks to prepare for, give organizations a false sense of security, and cause people to do less on crisis preparedness than they really should.
So why is that? Well, as in most organizations, government risks start with a matrix which shows the plausible worst-case scenario for each risk assessed by likelihood and impact.
And the likelihood axis assesses the probability that the risk will occur at least once over the next five years.
And my first piece of advice is to immediately reject any risk register that fails to describe the time period during which a risk will happen.
Describing the risk of something happening as a ten percent chance without also specifying the time period makes it completely meaningless.
There's a massive difference between there being a ten percent chance of something happening in the next a hundred years versus it happening in the next ten minutes.
Even worse might be risk registers that assess risks using words such as likely or unlikely without defining what that means.
Describing something as unlikely might be heard by one person as a forty percent chance of something happening, while another person might interpret it as less than ten percent.
That's why government uses precise frameworks for describing risk events with a number attached, even where the risk itself is difficult to quantify.
If you categorize an event as a one percent chance of happening this year, it might feel easy to ignore.
But low likelihood catastrophic events might be among the most important to prepare for.
Is preparing for flooding more important than preparing for the next pandemic just because it is more likely to happen soon? And besides, ten risks, each with a one percent annual chance, still add up to an average of one event per decade.
To take a real example, over the last twenty years, Heathrow Airport has been hit by unusually severe winter weather, a global pandemic, and a power outage.
But the problem is there's a lot of different once-in-a-hundred-year events that might hit an airport.
Likelihood of an occurrence shouldn't be the only measure of whether preparation is worthwhile.
A rare event, but one that would see your company go out of business if it crystallized, may still be worth preparing for if that preparation makes the risk survivable.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
