I feel like a lot of conversations and articles recently speak to an inadequate understanding of risk, and planning for risk. Risk is made up of at least 2 or

I feel like a lot of conversations and articles recently speak to an inadequate understanding of risk, and planning for risk. Risk is made up of at least 2 or 3 components: what is the probability something will happen? And, if it does happen, what is the impact and how will you mitigate that impact? For example, you may believe that a change to a website you are deploying has a low probability of taking the website offline. If it is taken offline, it may cost £X per hour in lost revenue, but you’ll leave the old version running on a standby server, so it only takes a few minutes to switch back. That’s a much more thorough understanding to 1 aspect of risk than “this rollout is low risk”. Once you have that understanding, it’s reasonable to discuss how to reduce the probability of an outage (better testing?), as well as how to reduce the impact (staged rollout?) or to speed up the fix if it were to happen (practise?). In COVID terms, we should be discussing the impact of decisions in the light of future pandemics. Could we invest now in reusable PPE, so that next time we don’t have a global rush on the disposable stuff? Do we need to educate the public more readily about reducing disease transmission to reduce the likelihood of a pandemic in the first place? I’m not a doctor, so I have no idea on the specifics, but the likelihood of any given pandemic will always be low, so what is the impact of the decision if there is one and does that impact need to be mitigated? (even if it is less efficient to do so...)