Plan deviations as a concept of risk: sensible, but not sufficient In many companies, risk management is historically anchored in controlling. That shapes the concept of risk: risk = deviation from plan. From controlling's point of view, that makes sense. Controllers are measured by whether the company is drifting: whether revenue, costs, or cash flows deviate from the group plan. Accordingly, one of their core tasks is to spot plan deviations early and flag them. But this concept of risk has limits, especially when we talk about risk-bearing capacity. 1. Not every plan deviation threatens risk-bearing capacity There are plan deviations that trigger major strategic and operational discussions, but do not consume any risk capital. A practical example: Many investors work with deliberately ambitious growth plans. If that growth is missed: • a major plan-deviation problem arises, • but from the perspective of risk-bearing capacity, possibly nothing happens at all. 👉 Unmet plan targets do not automatically mean risk in the capital-related sense. 2. Conversely: where there is no plan, there is no risk Every concept of risk automatically contains a concept of freedom from risk. If risk means “plan deviation,” then everything is risk-free wherever there is no plan. A practical example: Group planning is short-term, often 1 to 3 years. Risk-bearing capacity, ideally, is long-term. It answers questions such as: • How long can I survive a crisis before capital has to be injected? • How much risk can I bear over several years without threatening the company's existence? Many serious risks act beyond the planning horizon. A concept of risk tied to the reach of the plan therefore quickly runs into a void. 3. Practical problem: risk owners often don't even know the group plan A plan-based concept of risk assumes that risk owners know the group plan in detail. In many companies, that is not the case for all risk owners. This leads to false precision and misinterpretation. For risk-bearing capacity, we need a different principle: 👉 Risk is anything that consumes risk capital. Whether it affects the plan or not does not matter, it simply gets used up. Conclusion Plan deviations are a valuable concept of risk, but primarily for controlling. For risk-bearing capacity, we need a capital-based, long-term concept of risk that also takes into account what is not planned and what reaches beyond the planning horizon. How do you answer these questions?
This post was originally published on LinkedIn. View and join the discussion there