Many existence-threatening developments are not event risks, but erosion risks. Many risk inventories are dominated by event-driven risks: Cyberattack. Supplier failure. Fire. Litigation. Machine breakdown. Bad debt. These are important risks. But they describe only part of reality. Because many companies do not fall into an existential crisis because “the one big risk” materializes on a particular day. They get into trouble because their ability to adapt declines over years. Rising energy costs are not offset. The workforce transformation does not succeed. New competencies are built up too slowly. Bureaucratic and regulatory requirements become harder and harder to manage. Investments are postponed. Margins decline. The organization loses strength step by step. These are not classic event risks. These are erosion risks. They do not occur suddenly. They act gradually. They often do not produce a single clear point in time when the loss occurs. And that is why they are frequently underestimated in risk management. The problem: classic risk inventories often ask: “What could happen?” For erosion risks, the question would need to be different: “Which capability are we gradually losing if we do not adapt fast enough?” For example: “Energy price risk” becomes the question: Is our business model permanently too energy-intensive? “Skilled labor shortage” becomes the question: Are we managing the organization's skills transformation in time? “Succession risk” becomes the question: Is the company actually capable of being handed over at all? “Regulatory risk” becomes the question: Are our processes structurally capable of meeting regulatory requirements? “Revenue decline” becomes the question: Is our offering losing relevance over the years? The crucial difference lies not only in the wording. It lies in the risk logic. Event risks are usually assessed via probability of occurrence and loss severity. Erosion risks additionally require other perspectives: How does the strain develop over time? Which capability of the company is being tested by it? How long can the company withstand this development? Which early indicators show that the erosion has already begun? At what point does it turn into an existence-threatening development? This is exactly where, in my view, one of the biggest gaps in today's risk management lies. Many risk inventories contain numerous nameable individual risks. But they capture too little of the processes that actually weaken a company over the years. Yet companies rarely fail because of just one event. Often they fail because they built up too little adaptability over years, and the triggering event merely makes this weakness visible. Modern risk management should recognize gradual crisis dynamics, examine their significance, and derive scenarios for action planning from them.
This post was originally published on LinkedIn. View and join the discussion there