About Risk

Basic Risk Management Principles

The classic definition of risk is the uncertainty of or the amount of variation in, the possible outcome of a given situation. More succinctly, it is the chance of loss.

Joel Edward Gross, RSI Principal, has a more fundamental definition. It is "the possibility that an incident could result in the loss, theft, compromise of, or damage to, a critical asset or process," and adds that "risk can and should be managed, not avoided, as it is an integral part of any organizational process. It is not a silo issue that is compartmented into one function."


Risk Analysis ensures that there is "Diagnosis before Prescription!"


There are always uncertainties in risk, but they can be eliminated, reduced or controlled, thereby minimizing the chance of loss. The initial and most critical step is conducting a Risk Analysis, a management diagnostic tool that is used by senior management to analyze and evaluate the degree to which an entity is organized to deal with risk, to identify critical control points in the organization's process so that scarce resources are focused at these points rather than being diluted along the entire process.



Mr. Gross believes that "managing risk is a discipline of habits and exercises that are intended to improve an area of competence, almost religious in nature because they require repetition, ritual and a way of life. "The American Heritage dictionary defines "discipline" as "training that is expected to produce a specific character or pattern of behavior, especially training that produces moral or mental improvement; also, a branch of knowledge or of teaching.



A discipline is a branch of knowledge or teaching. The Greek word for "disciple" is mathetes, a learner, specifically, learning by use and practice. A discipline, therefore, increases our practical knowledge of something."


While serving in the U.S. Navy, Mr. Gross lived in Japan for 4 years. Between missions he trained in the martial arts, studying Budo, the way of the warrior, and Bushido, the code of the Samurai. He believes that managing risk requires disciplined thought and practice; good defensive and offensive habits; the constant practice of honing skills; sensing things that others don't or can't; anticipating events; and developing a sensitivity to ones' surroundings. He spent his lifetime as a disciple of risk, identifying, analyzing, evaluating and resolving issues.



Mr. Gross spent the last 30 years, not just working on risk assignments, but carefully studying other serious incidents that were carried by the news media or discussed by fellow practitioners. He analyzed them, discussed them with others to identify and isolate contributing factors to determine what preventive steps could or should have been taken. He believes that the difference between a catastrophic and non-catastrophic event is not just the element of chance but sound planning and management control. This may not only eliminate or reduce the possibility of an incident, but should an incident occur, it will control its impact.



The difference between an incident and a disaster lies in planning and managing the uncertainties of risk – which is why he founded RSI. Risks should be managed, not avoided!



Hisapproach is non-theoretical and practical. RSI resolves issues using traditional and non-traditional, innovative approaches. RSI identifies and solves problems, not symptoms. "Symptoms are indicators of management control issues. Misdiagnosis leads to incorrect solutions that can be costly, and most certainly ineffective. They can also be fatal. That is why a sound risk analysis and its diagnostic approach is so critical to the business process."



Mr. Gross found that while there are common threads, there is no single common answer to resolving risk. "A cookie cutter approach is for cookies. Risks are dynamic, not stable, not static and always variable. Each organization is unique and requires a custom approach. This is what we provide!"