Why "What keeps you up at night?" is the wrong question

When identifying risks, the question often asked is "What keeps you up at night?". Let me explain why this is a, well... risky question to ask.

Consider that the principle goal of risk management is to ensure that an organization performs as expected.  In other words, it achieves its objectives.  Therefore the risks that you identify need to be directly related to your organizations objectives.  Risks not related to the achievement of corporate goals are off strategy - a distraction.

"What keeps you up at night?" is a disembodied question that will result in both relevant and irrelevant risks.  Here is the question to ask...

"Considering the objective to... (describe a key objective), what events may prevent the organization from achieving this objective?".

The result will be risk events that are well aligned with management's goals.  Feel free to present your interviewee with a list of potential risk internal and external risk categories to refer to when answering the question.  For example, economic, competitive, strategic, HR, financial, technology, information, and corporate integrity are some of the major categories.  There are up to 100 subcategories that fall under these major categories as well (business is complex!).

This objectives-focused question will ensure that your risk management process is strategic and focused on corporate performance.

[Rich]
richard.m.wilson@ca.pwc.com