Companies face a number of pitfalls when deciding how much risk to bring into their day-to-day operations.

Many companies forget about volatility as a key factor in risk management. They figure that if they are doing well, they are in good shape and don’t need to adjust their plans. Even if they track various losses within the company—from a single product to the whole bottom line—and work to manage loss, they fail to account for the fact that loss levels can rise or drop unexpectedly.

Think of risk as a barge and volatility as a river. That river can rise or fall significantly, depending on how much water is entering or exiting the river. Although a company might identify risk and understand how it works in a stable economy and market—the barge floating on a placid river—it might not be ready for the fluctuations that volatility presents—those times when water levels rise or fall unexpectedly, leaving the barge in danger of floating off course or even hitting bottom.

Ultimately, although managing to an anticipated loss level is good practice, it is not the core of risk management. The core of risk management is being able to plan for unanticipated rises and falls.

An alternative title for this section might be “Too Much of a Good Thing.” Some companies think that diversifying into many different product or service lines—some even serving customers of wide-ranging income levels—is the way to go. “It minimizes risk,” they say. “It guarantees that something will sell—no matter how bad the economy is,” others add. They are right: diversification does lower risk, up to a point.

Diversification is a double-edged sword. The risk shoots the wrong way—higher—when the areas of diversification do not match the business plan. Diversification can create more risk by forcing a company to adopt techniques or use materials that are new and unfamiliar. This increases the risk of creating services or products that do not meet the high quality standards that the company is known for.

And even if the diversification is consistent with the business plan and up to company standards, it can create more strain on management and resources by setting up operational and financial risks. Diversification works best when it is rolled out slowly and managed carefully.

Every time a company grows or diversifies, the number of potential risks increases. These can add up to become overwhelming for owners, managers, and others tasked with managing risk.

Many companies are only outwardly focused, worried about competitors, customers, and the bottom line and unaware that they are creating risks each time they offer a new product or service. They may attempt too many strategies or projects at once. Or they may think that they have tackled all of the big issues—and they probably have—and that everything else is solid. However, they may have failed to notice little issues that have snuck between the cracks, issues that can add up and create a messy situation; in fact, they can lead to risk concentration.

Sometimes, owners and managers make the mistake of thinking that their risks are so highly diversified across the broad spectrum of the business that they will never converge with one another. Managers might also assume these risks’ potential to cause problems is diluted by the strength of the rest of the company.

Unfortunately, no matter how far such risks are spread across the company, they can become too numerous to handle. Too many is too many, and then owners can’t get their arms around them. This also increases the risk of contagion, which will certainly affect every aspect of the company.

Everyone wants to be Superman. Every business owner wants to feel invincible, on top of the market, their customers’ needs, the bottom line, … the world. It’s especially easy for business owners to begin to feel invincible when they’ve racked up one great quarter after another of profitable sales. The banter is painfully common: “What? What risk? We’ve got it covered. It can’t happen to us!”

This attitude is very common, particularly with successful companies. They might be more strategic and timely than their competitors. Because of their astute business planning, they might have studied and learned from the mistakes of current and past competitors and improved accordingly.

However, no one in business is invincible. Every company has strengths and weaknesses, and every company overlooks something that can become a risk. When this happens, even the mighty can fall.

History has a funny way of tricking people. It is simple (but not always easy) to improve upon past mistakes, because they have happened and have been evaluated. We have experienced the mistake; we know what to look for. However, it is much more difficult to plan for something that has never happened before. That’s because you don’t know what to plan for and you might not have any reason to anticipate your company would encounter such a problem.

The “it’s never happened before” mistake could easily serve as the introduction to a talk about the subprime mortgage crisis, the simultaneous bailout and eventual bankruptcy of two automakers, or any number of economic events of the last few years. Try not to let it become the epitaph to your company, the company you spent years building only to have it come crashing down because of potential risks you ignored.

It is very important to plan for a variety of these unexpected occurrences. When you get right down to it, that’s really what risk management is all about. If risk was routine and predictable, it wouldn’t be risk!