IT’s A Risky Business


When delivering IT Service Management courses, I am often asked how ‘appetite for risk’ relates to a business case.

Let’s imagine it’s a little over ten years ago, and the Millennium Bug has safely passed and not caused the end of civilisation and I’ve just invented the concept of internet banking. I know that the bank’s customers don’t want to keep going into the actual bank and seeing people and queuing up and paying for parking; they don’t even want to phone the bank and speak to people. They just want to access the information directly.

I outline the case to a group of senior bank executives, in a scenario not unlike a TV programme which, for the sake of potential copyright issues, we might call Lizard’s Lair. I tell them about the concept, and they are reasonably interested, although somewhat alarmed at the security risk involved in customers accessing their systems directly. This is a sensible response, but after some talk about passwords and firewalls they relax enough to start being interested in the potential rewards (more customers, fewer staff, fewer premises and a channel with which to promote various products. I advise them that there is also a large risk involved in doing nothing (losing customers to rivals, being seen as out-of-touch), so we discuss options. In the business case, it’s not just a choice between ‘do it’ and ‘never do it’ but a consideration of ‘what things shall we do this year, next year, or later?’

If they are a large banking institution, they might be cautious, not wanting to upset their large customer base, so they might initially roll out this brave new world to be tested on a select few customers, then more, and eventually to all that want it. In order to further mitigate this risk, we often advise that the first people they offer it to are their own employees.

If they are a small start-up bank, they don’t have many customers yet. They might see this as their chance to win a lot more customers (especially from more ponderous institutions) and deploy with a more aggressive timescale. They are willing to take more risk for more reward. This is a higher appetite for risk.

There is another kind of risk in this situation, where something new is being contemplated. A market risk. Maybe none of the customers wants to use internet banking, or even worse, only a small percentage do, and the bank now has the additional costs but no real benefits.

So there is not just the risk of doing something, or not doing something, but doing the right thing Remember HD vs blu-ray? DVD+R vs DVD-R? Betamax vs VHS?

As usual, what is the ‘right’ appetite for risk? Altogether now: “Quamvis in hoc situ”. It depends on the situation!


Alan Nixon
Director of Training
Fox IT