Skip to content

Risk Card

The work that product teams do is very complex. And, given the complexity, there are always risks. It does not help anyone to sweep the risks under the carpet and to hope nobody notices. Instead, risks should be brought up to the surface, so that we can discuss them and possibly identify solutions to mitigate them.

Risk Card

Risk management is the process of identifying, assessing, and controlling threats to an organization’s capital, earnings, and operations. Risks can come from many sources, including financial uncertainties, legal liabilities, technology issues, strategic management errors, accidents, natural disasters, and access to resources.

The Risk Card

Risks should be evaluated on their impact (for example, are they Tigers, Paper Tigers, or Elephants?) and on the likelihood of them happening (can we expect this to happen very likely, or is it a rare occurrence?). To help with the identification of risks and the analysis of their impact and likelihood, teams can use the Risk Card template.

The Risk Card provides a deeper understanding and some additional information, compared to a plain red sticky.

For example, it provides a description of the risk, an estimate of the likelihood of the risk to happen, and an estimate of the impact if the risk happens. And it also allows you to start thinking about what possible path can resolve the risk or to control its impact.

Here are a few examples:

  • We may not be able to complete the work because of [insert xyz reason].
  • What we do, may not work out for our customers.
  • There could be a cyber security risk with hackers disrupting our network.
  • If we have suppliers, the supply chain may not work or we may not get the supplies that we need in order to do the work on time.
  • We have a dependency on [xyz team] and that team may not be able to complete its work for us on time.
  • The U.S. market may hit a recession and that will affect our business because of [xyz reason].

Find your Tigers

Tigers are magnificent animals. And they represent terrible dangers for anyone venturing into the jungle.

In risk management, a “tiger” is a significant risk that may derail or harm an initiative or a project. Therefore, identifying the tigers is a critical step in the management of risks.

However, not all tigers are real risks. So the “Tiger, Paper Tiger, and Elephant” approach can help identify and rank the risks. In risk management, these terms are used to categorize potential threats based on their perceived severity and difficulty to overcome:

  • Tiger: A significant and imminent threat that, if not addressed, will likely cause major harm. It requires immediate attention and substantial resources to mitigate.
  • Paper Tiger: A threat that appears significant but is ultimately unsubstantiated or easily overcome. This may be something that someone else may worry about, but it does not worry you. It may require some investigation but shouldn’t cause major concern.
  • Elephant: This is the so-called elephant in the room that no one is talking about. It may be a large and complex threat that is difficult to address directly. It requires careful planning, long-term solutions, and may involve breaking down the issue into smaller, more manageable pieces.



Please enable JavaScript in your browser to complete this form.
Would you like to receive updates?