“Progress always involves risk; you can’t steal second base and keep your foot on first.”

—Frederick Wilcox

As a long-time gambler addict, I’ve developed a bit of a fascination with risk over my years. For the right odds, I’d take either side of a bet. These days, though, I focus on organizational risk. In this post, I’ll compare two terms often mistaken for synonyms: risk and uncertainty.

On his blog, asset manager Barry Ritholtz makes the following distinction between the two terms:

• Risk: We don’t know what is going to happen next, but we do know what the distribution looks like.
• Uncertainty: We don’t know what is going to happen next, and we do not know what the possible distribution looks like.

For example, let’s say that you’re playing craps. How often will you roll a 7? Here, we know the precise distribution of outcomes. (When you roll the dice, each time you’ll see one of 36 possible combinations. Six of those combinations add up to 7. Hence, the odds are one in six.)

The entire set of odds is presented below:

Now, consider the concept of uncertainty. What were the odds in 2007 of a housing meltdown? We just didn’t know–the very definition of uncertainty. In hindsight, they were pretty high, but relatively few people realized it at the time. (And many of those that did made a fortune in the process.)

Is Your Organization Prepared? Do You Know?

Risk and uncertainty are hardly confined to the casinos. A few weeks ago, I wrote about the Netflix streaming service going down on Christmas of 2012. I’ve not read the EULA for Amazon AWS, but I’ll bet you a steak dinner that you won’t find the words “100 percent up-time guaranteed.” Put differently, companies like Netflix assume a certain amount of risk when they enter into agreements with technology vendors. Netflix management understood the risk of AWS, but obviously didn’t know when snake eyes would turn up.

Don’t make the mistake of confusing risk and uncertainty.

Your employer probably has probably never experienced the public outage that Netflix did last Christmas. Few have. Still, it’s folly to assume that every organization doesn’t face both risk and uncertainty. Consider Balancing Risk and Performance with an Integrated Finance Organization, a 2008 IBM Global CFO Study. The results are nothing if not eye-opening:

In a 2008 IBM study performed before the recent financial troubles really took hold, nearly two-thirds (62 percent) of corporations with revenues over $5 billion reported they had experienced at least one material event in the past three years, and that almost half (42 percent) of these same corporations admitted that they were not well prepared for it. Smaller corporations were barely better: Some 46 percent of enterprises with revenues experienced a material event, and 42 percent of those acknowledged that they, too, were not well prepared for it.

So, what’s the worst thing that can happen to an organization? It is not that the company cannot recover from a discrete incident. Rather, it’s that its senior management didn’t know that the risk existed in the first place—and the gravity of that risk.

Simon Says: The Question Is If, Not When

Risk and uncertainty two entirely different things. Don’t make the mistake of confusing them. Try to reduce uncertainty and quantify risk–and be prepared for unlikely outcomes.

What is your company doing to maximize its system up-time?

This post is sponsored by the Online VMware Forum 2013. To learn more, register for a VMware webinar on this subject: Unleash the Power of Virtualization to Simplify IT.