External – this dimension, as the name implies, is a risk that arises due to external factors.
Internal – this dimension will be a risk that arises internally within the business or organization.
Controllable – this dimension recognizes that the risk can in some way be controlled, managed or mitigated. This can be partial or full mitigation.
Uncontrollable – this dimension, as the name implies, reflects that the risk cannot be controlled by the business or organization. To lessen the impact (if possible to) or to mitigate the risk usually requires the firm or organization to adapt or change what it does.
Primary – this dimension is where a risk is the primary cause of adverse outcomes.
Consequential – this dimension is where a risk arises due to the occurrence of another adverse risk outcome (a primary risk).
The approach toward a particular business risk or risk category needs to be developed, taking into account the nature and characteristics of each risk. Many business risks will be both external and uncontrollable. The resultant operational and financial risk profile needs to be shaped by these insights.
