Risk, Resilience, and Crisis

Every business runs on assumptions that can break: that suppliers will deliver, that customers will keep buying, that the product is safe, that the systems will stay up. Risk is simply the recognition that these assumptions have a chance of failing, and that some failures would hurt far more than others. Ignoring risk does not remove it; it only removes your chance to prepare.

A crisis is what happens when a serious risk arrives, often faster than anyone expected. In that moment a firm largely spends what it built beforehand — its plans, its relationships, and above all its reputation. This lesson separates the quiet work of managing risk from the loud work of handling a crisis, and shows why the response that protects people usually protects the business too.

Identifying and assessing risk

Risk is exposure to a possible loss you can, at least roughly, estimate; uncertainty is exposure you cannot yet quantify. Businesses face many kinds — operational (a plant fails), financial (a customer defaults), supply-chain (a key input stops), reputational, regulatory, and more. The basic discipline is to list them and rank each by two questions: how likely is it, and how bad would it be? A rare but catastrophic risk and a frequent but trivial one demand very different attention.

From risk management to resilience

Managing a specific risk means reducing its likelihood, softening its impact, transferring it (insurance), or accepting it consciously. Resilience is the broader capacity to absorb shocks you did not specifically predict — through redundancy (a second supplier), slack (cash reserves, spare capacity), and flexibility (the ability to switch quickly). Resilience costs money in calm times, which is exactly why under-prepared firms look efficient right up until they fail.

Responding to a crisis

When a crisis hits, speed, honesty, and priority matter more than polish. Good responses share a pattern: acknowledge the problem quickly, put safety and affected people first, communicate clearly and truthfully, and fix the underlying cause. Bad responses share the opposite pattern: deny, delay, minimise, and protect short-term profit — which usually deepens the harm and destroys the trust the business depends on.

Consider a small café assessing its risks. It lists: a freezer failure (moderately likely, moderate impact), a key supplier closing (unlikely, high impact), a bad food-safety incident (unlikely, severe impact), and a slow week (very likely, low impact). Ranking by likelihood and impact, the food-safety incident dominates: rare but potentially fatal to customers and the business. So the owner invests there first — strict hygiene routines, staff training, and clear procedures — rather than spreading effort evenly. She lines up a backup supplier for the high-impact supply risk, and simply accepts the slow-week risk as a normal cost of trading. The matrix did not remove any risk; it told her where to spend her limited attention.

Picture the opposite of good practice. A manufacturer hears early reports that a product may be unsafe. Rather than investigate and warn, it disputes the reports, blames customers for misuse, and quietly hopes the issue fades — because a recall would be expensive. The delay lets more people be harmed, regulators and journalists uncover the internal doubts, and the eventual forced recall arrives alongside a collapse of public trust. The financial loss the firm tried to avoid arrives anyway, now multiplied by the reputational damage of having concealed the danger. Bad crisis response rarely saves money; it defers and enlarges the bill.

In the autumn of 1982, seven people in the Chicago area died after taking Extra-Strength Tylenol capsules that had been laced with potassium cyanide. The tampering occurred after the products left Johnson & Johnson's control, and the culprit was never caught — the company was, in a real sense, a victim. Yet its response became the textbook model. Rather than downplay the threat, Johnson & Johnson, led by chief executive James Burke, pulled roughly 31 million bottles of Tylenol from shelves nationwide, at a retail value of around 100 million dollars, halted production and advertising, and worked openly with police, regulators, and the press to warn the public. When it relaunched the product, it did so in new tamper-evident packaging with triple seals, helping to establish an industry standard that persists today. The recall was hugely expensive in the moment, but by putting public safety unmistakably first, the company preserved the trust on which the brand depended and recovered its market position. It is widely taught precisely because the safety-first choice and the business-survival outcome pointed the same way.

• "Managing risk means eliminating it." Most risk cannot be eliminated, only reduced, transferred, or knowingly accepted.
• "The scariest or most recent risk is the most important one." Vividness is not likelihood times impact; rank risks deliberately, not by gut feel.
• "Resilience is wasted money because the shock may never come." Redundancy and reserves look inefficient until the day they are the only reason a firm survives.
• "A crisis is about clever public relations." Spin without substance backfires; the durable move is to act honestly and fix the real cause.

You are given a business and a list of things that could go wrong. Place each on a grid of likelihood against impact, decide whether to reduce, transfer, or accept it, and name the single risk that deserves attention first.

Think Like a Maester: In a crisis, the response that honestly protects the people affected is usually the same one that protects the business — the two only seem to diverge if you look no further than next quarter.

1. In your own words, what is the difference between risk and uncertainty?
2. What two dimensions are used to rank risks, and why do you need both?
3. Name three ways a business can build resilience against shocks it did not specifically predict.
4. List the shared features of a good crisis response and of a bad one.
5. Why is the 1982 Tylenol recall taught as a model even though Johnson & Johnson did not cause the tampering?

Risk is the estimable chance that an assumption fails, and businesses manage it by listing exposures and ranking each by likelihood and impact, then reducing, transferring, or accepting it. Resilience goes further, building redundancy, slack, and flexibility to absorb shocks no one predicted — a cost that looks like waste until the shock arrives. When a crisis does come, good responses act fast, put safety and affected people first, and tell the truth, while bad ones deny and delay and pay more in the end. Johnson & Johnson's 1982 Tylenol recall endures as the model because prioritising public safety, though enormously costly at the time, was also what saved the business.

• Strategy and Growth
• The Future of Work and Business