Countless things can be measured as part of a risk assessment. In the end, the law of simplicity is the best for this potential jungle: a few basic types of measures apply to most of the enterprise.

When considering a risk event, it is important to understand when it is likely to happen, how big it will be, and its probability, or likelihood, of occurring. You will also want to make these estimates as accurate as possible. (Remember that it is the variance around predictions that causes the most concern in risk.) Try to focus on measuring one risk or group of risks at a time—and understand the distributions of those events.

Distribution is one of the most common mechanisms for measuring uncertainty. It is the range of events that may occur—their frequency of occurrence and their range of impact. It is generally shown as a chart with frequency (or likelihood) on the vertical axis and impact on the horizontal axis. This produces a distribution.

Two common loss distribution curves, normal distribution and beta distribution, which illustrate the behavior of risks.

Distributions foster a clearer understanding of the behavior of risks, and risk managers make frequent use of them to aid in measurements. Some distributions are symmetrical (called normal distributions); there’s a roughly equal chance of uncertainty above and below the most common result. Some distributions are skewed, with long tails (for example, one called a beta distribution is common); this generally means that, although overall risk may be lower, there is a small chance that something very, very bad might happen. There are many other types of distributions, but these are the most commonly used in risk management.

It is helpful to become familiar with the basic concept of distribution and its key qualities. Distributions are used to describe the way risks behave and how they may change over time. Distributions are also used to demonstrate the relationships between the core measures of risk that will be discussed later in this book.

Every business owner knows that higher risks yield higher returns or greater losses. That’s the risk of going for it. Ask yourself the following questions:

The answers come as a “risk-adjusted return,” another critical measure (also referred to as risk versus return). This allows owners to understand and compare products, customers, and even projects and strategies as they relate to risk and return. What type of return will they bring to the company? How much risk comes with them? Is the risk worth it?

Many people ask, “Why not take lots of risk as long as we are adequately compensated for it?” Often true, but with a caution: in the high-octane world of higher risk, one risk will start to intertwine with other risks and present more opportunity for contagion effects. Most likely, none of those costly extra zeros were factored into your initial risk-adjusted pricing. It is easy to get the overall evaluation wrong and wind up being undercompensated for risks you take, even though you thought you covered them.

With risk versus return, the focus on money causes many owners to forget about other possible fallouts, including reputation and stakeholder risks down the entire spider web of company contacts. When things go wrong, they can draw a lot of unwanted attention—creating unforeseen issues that can bring the company down. A perfect example is Enron, just a decade ago one of the most successful companies in the world. When media and regulators began to believe that something was awry, the company lost market confidence. Its bonds were called, nervous investors stepped forward, and Enron was unable to support its obligations.