![](http://www.d-ddaily.com/people/PaulMcGinleyonpad.jpg)
Paul McGinley Regional Loss Prevention Mgr
Dollar Financial Group
I, like many of you, still watch too many reruns of
Seinfeld. One of my favorite moments is when George is
learning about (or attempting to learn about) risk
management. A narrator for a book on tape begins: "In order
to manage risk we must first understand risk. How do you
spot risk? How do you avoid risk and what makes it so
risky?" I find this entertaining on many more levels than
the writers intended, but it also got me thinking (a
dangerous thing, according to my wife).
We all have our own methods that we use to identify risks.
We can, most likely, off the top of our heads tell our
management which locations keep us up at night and why they
do. But is that enough?
I ask that question because of the varying characteristics
of how we respond. We can audit, train, utilize
technological countermeasures (reporting, cctv, alarm
upgrades, etc.), and physically be present. Excluding
installation new equipment, all these are easy and seemingly
free. In reality, they all have a cost.
Those costs can be definable (ex. fuel to get to the site),
or undefinable (ex. your time auditing at site A rather than
training at site B). Though we may not see it, it is highly
likely that those costs are being calculated somewhere in
your organization. Critically, they may not be calculated by
someone that understands your true operational environment.
Let's consider a possible equation to bridge this gap.
Risk = (Threats x Assets) -
Mitigation
Using an equation (such as the above), lets you present risk
in a way that may be easier for those that do not view risks
everyday to understand. For example, let's consider a
scenario where we have a plate of fresh baked cookies that
we will leave in a room of toddlers, alone. First, our
threat is (obviously) a room of hungry toddlers. Our assets
are cookies. We have no mitigating factors.
Risk = (Hungry toddlers x
Cookies) - 0 mitigating factors
Looking at it this way, we know exactly what will happen.
When we come back in the room there will be a room of
toddlers sitting quietly... and a plate of empty cookies. It
makes the risk clear and obvious, even to someone that may
not be familiar with cookies or children. It also makes it
clear that the mitigating factor of an adult in the room
might be worthwhile, depending on the value of the cookies.
The larger point is the one I made earlier: it is critical
to be able to clearly communicate risk to those that have no
basis or grounding to understand in your field environment.
If you cannot effectively communicate that risk, in whatever
fashion you choose, chances are you will lose access to your
mitigating factors or techniques.
|