Risk and Investment - Mortal Enemies?

Reframing the Conversation

When we treat every potential negative event purely as a “risk,” we unconsciously bias our decision-making toward avoidance. But businesses don’t grow through avoidance - they grow through intentional, well-understood investments.

The language we use shapes the behaviours we adopt:

• Calling something a risk frames it as a threat to be controlled.
• Calling it an investment frames it as a choice about how we allocate time, money, and attention.

This isn’t about being blindly positive or pretending everything is an opportunity.
It’s about recognising that:

• Every opportunity contains risk (you might lose).
• Every risk contains opportunity (you might win).

They are two sides of the same coin: uncertainty plus choice. The real work is to evaluate that uncertainty with clarity rather than fear.

One practical way to think about it:

Risk is what could be lost.
Investment is what you’re choosing to stake for a potential gain.

Healthy organisations need to be fluent in both sides of that conversation.

Why We Default to “Risk” Language

Most of us don’t wake up in the morning excited to be blamed. Our psychology and our organisational systems both encourage defensive thinking.

A few forces overlap here:

• Human negativity bias – We are wired to notice and remember bad things more than good ones. Historically, that kept us alive. Your brain is a superb “danger detector,” not an “opportunity maximiser.”
• Accountability fear – In many organisations, the person associated with the incident or failed change becomes the story. Even if the decision was reasonable at the time, nobody wants to be the name on the post-incident review.
• Compliance and audit pressure – Risk frameworks, controls, and checklists are often written in the language of avoidance: prevent, mitigate, restrict. The easiest way to pass an audit is not to do anything new.

So we build mechanisms like risk registers. On the surface, they are logical and necessary. Underneath, they can quietly encourage behaviours like:

• Pushing risks onto someone else (“Can we assign this to another team?”).
• Inflating risk ratings so nobody can say you missed something.
• Designing controls that make change harder than staying still.

It’s all perfectly rational - and it’s all avoidance-driven.

The old joke applies: if we’re being chased by a bear, I don’t have to outrun the bear, I just have to outrun you.
In service terms: it doesn’t mean the service is great; it just has to look slightly less risky than the alternative.

What Happens When Everything Becomes a Risk

When every uncertain event is captured only as a risk, several things tend to happen:

1. The horizon shrinks. Teams optimise for the next quarter’s audit or the next board report, rather than the next 3–5 years of capability.
2. Innovation is quietly discouraged. New ideas are born as risk items: “Risk: new platform may be unstable.” That risk is real - but the upside rarely makes it into the same conversation with the same weight.
3. People play not to lose. Decisions are judged more harshly by outcomes than by the quality of reasoning. So the safest move is often to say no, defer, or ask for one more review.

The result is a kind of organisational drift.
Services may remain “safe,” but they get older, more brittle, and less relevant.
We prevent outages but also prevent progress.

Seeing the Investment Inside the Risk

Reframing doesn’t mean ignoring downside. It means bringing both sides of the equation into view.

Take a simple example:

“Risk: Migrating our core service to a new cloud platform may cause instability and outages.”

That’s true. But what’s the investment decision hiding inside it?

“Investment: Allocate capital and capacity to modernise our platform so we can scale, deliver features faster, and reduce long-term operating costs.”

Same situation, different framing. Once we treat it as an investment, better questions become possible:

• What are we actually staking? (Budget, reputation, customer trust, people’s time.)
• What is the potential upside, and over what timeframe?
• What scenarios exist between “complete success” and “total failure”?
• What small bets or experiments could give us more information before we commit fully?

We can now talk in terms that boards and executives understand intuitively: return on investment, portfolio, options, and time horizon, rather than only red-amber-green risk ratings.

A Simple Pattern: From Risk Item to Investment Thesis

Here’s a lightweight pattern you can use with your existing risk register.

For any risk item, ask the team to complete four steps:

1. Name the situation neutrally.
   Strip away the fear-laden phrasing. Instead of “Risk of catastrophic outage due to legacy database,” try “Choice: continue on legacy database vs. invest in modernisation.”

2. Write both sides explicitly.

   • Downside (risk): What might be lost if we act or don’t act?
   • Upside (opportunity): What might be gained if this plays out well?

3. Describe the stake and horizon.

   • What are we putting at risk?
   • Over what timeframe does this pay back - or hurt us?

4. Choose a posture.
   Not every situation deserves the same response. For each one, decide if you will:

   • Avoid – The potential loss is too great relative to the upside. We consciously choose not to make this investment now.
   • Insure – We’ll go ahead, but we’ll offset or share the risk (contracts, architecture, contingency plans).
   • Experiment – We’ll make a small, reversible bet to learn more before committing.
   • Commit – We believe the upside justifies a significant, visible investment.

Documenting this doesn’t need a new tool. It could simply be new columns in your existing register:

• Opportunity / upside
• Investment posture (avoid / insure / experiment / commit)
• Smallest next bet

The goal is not more process; it’s better conversations.

Why This Matters for Modern Service and Technology Management

Traditional ITSM thinking has hardwired us into defensive postures: prevent incidents, reduce outages, eliminate vulnerabilities. These are all important - and they will always matter.

But if that’s the whole story, we drift into a world where:

• Change is guilty until proven innocent.
• The safest service is the one that never evolves.
• Technology teams are seen as cost centres to be controlled, not strategic partners to be backed.

Modern service organisations need a more balanced model.

Instead of maintaining only a risk register full of “things to avoid,” imagine maintaining an investment register full of “choices to consider.” For each significant risk item, there is a paired investment entry asking:

• What capability might this give us if we lean into it?
• How would we know it was paying off?
• What’s the minimum viable stake we could put down to test the idea safely?

This encourages teams to think like portfolio managers:

• Some investments will be low-risk, low-return (improving stability, removing toil).
• Some will be higher-risk, higher-return (new products, new platforms).
• The job is to shape the mix - not to avoid every possible loss.

Toward an Investment-Oriented Practice

Reframing risks as investments shifts accountability. It:

• Encourages ownership rather than avoidance.
• Invites strategic thinking rather than fear-driven reactions.
• Connects operational decisions with business outcomes and value.

Over time, this can change how governance works.

Risk boards and change advisory forums can start asking:

• What investment are we making here?
• What return are we seeking - financial, strategic, experiential?
• What have we done to limit the downside without destroying the upside?

This doesn’t abolish traditional risk language. It simply refuses to let it dominate.
We still care about confidentiality, integrity, availability, safety, and compliance. But we also care about momentum, relevance, and impact.

Practical Prompts for Teams

If you want to experiment with this in your own context, here are a few prompts you can start using in meetings and reviews:

• “If we treated this as an investment, what are we actually buying?”
• “What’s the smallest safe bet we could place to learn more?”
• “If we don’t act, what risk are we implicitly accepting?”
• “What would make this risk worth taking?”
• “In two years, will we regret being too cautious or too bold here?”

Used regularly, these questions shift the tone of conversation from “How do I avoid blame?” to “How do we create value, safely enough?”

From Outrunning the Bear to Choosing the Path

Our psychology will always nudge us toward the bear story: if something dangerous is chasing us, we just need to run a bit faster than the person next to us. Many organisations operate exactly like that - trying to look slightly less risky than the alternative.

But that’s a very limited notion of success.

A more useful image is this: we are not just running from a bear; we are choosing which path our organisation will take through uncertain terrain.

Risk thinking helps us see the cliffs and the loose rocks.
Investment thinking helps us see the vantage points, the shortcuts, and the places worth reaching.

We need both.

In future posts, I’ll explore simple tools and frameworks for making this shift concrete - so that teams can stop merely running from danger and start deliberately choosing where they want to go, and what they’re willing to stake to get there.