A Risk You Can Explain Is a Risk You Can Manage

Start with the sentence, not the spreadsheet

Before I look at the numbers on a risk, I try to write one sentence about it. What is the exposure, what would cause it to turn into a loss, and who would feel that loss first. If I cannot write that sentence, I do not understand the risk yet, and no amount of analysis on top will fix that.

The sentence also becomes the thing everyone else can test. A business head, an auditor and a technology team can all read it and say whether it matches what they see.

Numbers support the story, they do not replace it

Quantitative work matters. It tells you how big a risk is and whether it is getting bigger. But a number without context invites the wrong conversation. People argue about the decimal point instead of the decision.

Pairing each number with what it means and what action it should trigger keeps the discussion on the decision.

Good controls are boring

A control that people understand gets followed. A control that only its designer understands gets worked around, usually with good intentions. The best controls I have seen are simple enough that the people running them could explain them to a new joiner on their first day.

Where AI fits

Building AI products in the Curious PM cohort made me think about how much of risk work is reading and summarising: policies, findings, exceptions, past reviews. A model can help gather and draft that material quickly. The judgement about what the risk is, and what to do about it, still belongs with people who can be held accountable for it.