4.2.1 Defining the problem
It is vital that the problem is identified correctly. If the risk management system is working properly, the problem should not have hit you completely out of the blue, and you should already have some idea what it is about. But, although there is often a temptation to skip the definition phase and go straight to causes and solutions, it is important to be as clear as possible about the nature of the problem as seen from different perspectives, by answering questions such as those below.
What? – Can the problem be broken down into smaller parts? Is any one of these smaller parts more significant than the others?
Why? – Why has the problem arisen now? Why wasn't it noticed before?
When? – Is this a recurring problem? Is it part of a pattern? Might the timing be significant in some other way?
How? – What was it that drew your attention to this problem? How have problems like this been dealt with before?
Where? – Is the location of the problem significant? Does it also occur elsewhere?
Who? – Are there particular people who need to be consulted about the problem or who would benefit most from solving it?
Time spent collecting information at this stage is time well spent, because it helps to ensure that later decisions have a sound basis.