Managing risk

Once you’ve spotted a risk, you have a few choices. You can accept it because the reward is worth it, like the shop leaving its fruit outside. You can reduce it, making it less likely to happen or less harmful if it does. You can hedge it, which means placing a bet that pays off if the bad thing happens, or transfer it to someone else, for example by buying insurance. Or you can avoid it completely by not doing the activity.

The tools you use to reduce a risk are called controls, and they come in two kinds. A preventive control stops a problem before it happens. Think of an online form that only accepts five numbers in the zip code box, so customers can’t type a wrong zip code by mistake. A detective control spots a problem after it happens, so you can fix it fast. Think of a daily report that flags any order with a missing address before it ships.

Good risk management uses both, because no preventive control catches everything. In digital assets, a preventive control might require two people to approve every transfer. A detective control might compare the firm’s records with the blockchain every day to catch anything that doesn’t match. And like the shop’s fake camera, every control has a cost, so it’s always worth asking whether it saves more than it costs.