Do you understand your risks? 

CRJ’s advisory panel member Amanda Coleman examines why organisations need to look beyond the obvious, with lessons from FIFA’s 2026 World Cup and the importance of preparing before a crisis unfolds for Under Pressure.


Image by Dar ius | Pexels

‘Do you understand your risks?’ is an interesting question. We generally get the operational risks that will stop the business or organisation functioning: fire, flood, or machinery breakdown. 

I am sure the International Federation of Association Football (FIFA) organisers considered all those things before the start of the World Cup 2026. I wonder whether they considered the President of the United States interfering in on-pitch decisions and the further deterioration of FIFA’s reputation.

Risk identification is often a thing we have on a ‘nice to do if we have time’ list. When I speak to communicators, they are often so stretched to deal with today’s real problems that are hitting them in the face that they have no capacity or inclination to start to consider what could possibly happen at some time in the future. But, this means they are missing opportunities to mitigate some risks before they emerge.

It doesn’t have to be an additional chore or task on top of everything else. Just a couple of hours can put you on the right path towards being more risk-aware and prepared. Once the work is done and the seeds are sown, it can grow and develop. There are some simple steps that you can take, but it is definitely work that needs to be done with as many voices internally or feedback from external sources as possible.

For starters, consider the operational and business context of the organisation, where it is and what it is doing at that point in time. Think of what reputation you have and what changes may be affecting the business. Then, identify risks by considering all the potential problems and issues that could happen. If you are struggling, look at it through these categories: people, process, policy, perception, finance and external events.

Moreover, go through the risks and consider which are most likely to happen and, from a reputational and communication perspective, what effect it could have. Rate them from one to five (low to high risk), multiply the two, and you have a risk. It doesn’t end there; you need to consider what mitigation can be taken to minimise, reduce or prevent the risk. 

With the complexity of the world now, this work should be a priority, as risks and crises are no longer individual; they are multiple and interwoven. But, complexity can be helped with a simple look at the areas of challenge or concern. When we see problems and crises occur, you can always track it back to a risk that slipped by or wasn’t recognised, just like the start of the disaster recovery graph.

Read the full piece here.