Risk Management: Identify, Analyse, Respond, Monitor
Risk versus issue
A risk is an uncertain future event with a probability and an impact. An issue is already happening and needs action now. Mature practice runs a continuous cycle: identify (brainstorming, checklists, historical post-event reports, site inspections), analyse qualitatively with a probability-by-impact matrix, quantify where it is worth the effort, then plan responses and monitor triggers.
Response strategies
For threats: avoid (change the plan), reduce or mitigate (lower probability or impact), transfer (insurance, contract clauses) and accept (active acceptance funds a contingency; passive acceptance simply notes it). Opportunities get exploit, enhance, share and accept.
Traps to expect
"Transfer eliminates risk" is false; the financial exposure may shift but reputational damage stays with you. Do not confuse the risk register with the issue log, and do not treat business continuity (keeping critical functions running) as identical to crisis communication (protecting trust and informing audiences). Insurance is never a substitute for a safety plan. Responses written as vague sentiments score nothing.
Rule of thumb
Write each response as owner + action + trigger + date.
Worked example
An outdoor reception has a 40% chance of rain and an impact rated 4 out of 5, scoring 1.6 on a 5×5 matrix. That ranks high, so the response is to reduce: contract a tent with sidewalls, decision made by a stated date, triggered when the 48-hour forecast exceeds 50% probability of rain. The venue operations manager owns it.