Risk

“A risk register reveals what an organisation is prepared to notice. ”

Risk is the organising language of modern management. Organisations identify risks, score them, assign owners and colour them red, amber or green. The process can create discipline. It can also narrow responsibility to whatever threatens the organisation's own objectives. ISO 31000 defines risk as the effect of uncertainty on objectives.

The definition is deliberately broad: effects may be positive or negative, objectives may exist at different levels and risk arises because knowledge of events or consequences is incomplete. It encourages integration with governance and decision-making rather than treating risk management as a separate compliance exercise. Sustainability introduces a second perspective.

Human-rights and environmental due diligence focuses on risks to people and nature, not only risks to the enterprise.

A purchasing practice may create severe wage or safety risk for workers even when the buyer faces little immediate financial exposure. Deforestation may remain commercially invisible until regulation, customer pressure or supply disruption turns it into business risk. The absence of enterprise risk is not the absence of harm.

The coffee leaf-rust epidemic that spread through Central America from 2012 illustrates interacting risk. Climate conditions, pathogen pressure, susceptible varieties, ageing farms, limited finance and livelihood vulnerability combined. The consequence was not only reduced production. Labour demand fell, household income declined and producers with the fewest resources had the least capacity to renovate.

Treating the event as a single agronomic hazard would miss the system that made it damaging. Risk analysis usually considers likelihood and consequence.

The simplicity is useful but dangerous. Scores can hide different combinations: a frequent minor disruption and a rare catastrophic impact may receive the same number. Multiplying subjective ratings creates apparent precision. Human-rights frameworks therefore emphasise that severity should guide prioritisation, particularly where potential harm would be grave or difficult to remedy. Time horizons matter.

Quarterly risk processes tend to favour events visible within budgets and contracts. Climate, soil, water and demographic risks may accumulate slowly before crossing thresholds. A low annual probability can become a high cumulative probability over twenty years. The relevant horizon should match the asset, ecosystem, community relationship or strategic commitment at risk.

Dependencies also challenge conventional registers. Agriculture depends on pollination, soil function, stable rainfall, labour and community legitimacy. These may not appear as owned assets, yet their degradation can undermine the business. Nature-related and social risks often emerge through dependencies and impacts that sit outside direct control.

Risk treatment should follow the hierarchy of response: avoid where possible, reduce likelihood or consequence, share or transfer where legitimate, prepare for response and recovery, and accept only with informed authority. Insurance can transfer financial loss; it does not transfer responsibility for preventable harm.

Supplier termination can transfer exposure to another buyer while leaving workers or ecosystems worse off. Scenario analysis helps where probabilities are unreliable.

Instead of pretending to forecast one outcome, organisations can test whether strategy remains viable under different climate, regulatory, price or social conditions. Stress testing should include operational and human consequences, not only financial ratios. Risk appetite is often invoked as though organisations can choose any exposure they are willing to bear.

They cannot set an appetite for violating rights held by others. Legal duties, scientific limits and ethical responsibilities constrain what can legitimately be accepted. Governance should distinguish risk the organisation may choose to retain from harm it has a responsibility to prevent or address. Risk appetite needs similar precision.

An organisation may choose to tolerate financial volatility within agreed limits; it cannot use that appetite to redefine severe harm to people as acceptable.

Enterprise risk tools and responsible-business due diligence can share information, but their decision rules are different. One protects objectives chosen by the organisation. The other also asks what the organisation may do to people and nature, including impacts that are immaterial to short-term enterprise value. A credible system therefore uses more than a heat map.

It identifies risk holders as well as risk owners, examines systemic causes and interactions, records uncertainty, uses affected-stakeholder evidence and reviews whether controls reduce real exposure rather than improve the score. The objective is not to make the register green. It is to make decisions more responsible under uncertainty.

Practical application

Maintain connected views of enterprise risk and risks to people and nature. Define objectives, affected parties, hazards, pathways, existing controls, likelihood, consequence, severity, uncertainty and time horizon. Use scenarios for complex or long-term risks and document interactions rather than scoring each issue in isolation. Test whether treatment reduces the underlying risk or transfers it.

Escalate severe impacts regardless of short-term financial materiality, and involve affected stakeholders in understanding consequence and control effectiveness. Review emerging signals, near misses and grievances alongside historical loss data.

Why it matters

Risk language determines what receives resources before harm occurs. A system focused only on threats to the organisation can legitimise externalising risk to workers, farmers, communities and ecosystems. A broader approach supports resilience, due diligence and more credible strategy.

Common misconception

Risk is often treated as the probability that something bad will happen. It concerns the effect of uncertainty on objectives and may include opportunities, but sustainability practice must also ask whose objectives and whose harm are represented. Probability alone does not capture severity or legitimacy.

Connections

Uncertainty is the condition from which risk arises. Due Diligence identifies and addresses adverse impacts. Severity and Salience shape human-rights prioritisation. Climate Resilience concerns the capacity to function through disturbance, while Double Materiality connects sustainability risks and opportunities to financial consequence.

A question worth asking

Which serious risks remain absent because they threaten someone else's objectives before they threaten ours?

Selected references

ISO 31000:2018. Risk Management - Guidelines. IPCC. 2020. Guidance on the Concept of Risk in IPCC Assessments. OECD. 2018. OECD Due Diligence Guidance for Responsible Business Conduct. Avelino, J. et al. 2015. The Coffee Rust Crises in Colombia and Central America. Food Security 7: 303-321. Renn, O. 2008. Risk Governance: Coping with Uncertainty in a Complex World.