What are three types of risks?


Editorial team Published on

Organizations and projects typically face three primary categories of risk based on Robert Kaplan and Anette Mikes’ widely recognized Harvard Business Review framework: preventable risks, strategic risks, and external risks.

The 3 Types of Risk

  • Preventable Risks (Internal): These are internal risks arising from within an organization from everyday operational breakdowns or human error. They offer no strategic upside and should be monitored or eliminated.
    • Examples: Employee fraud, IT system failures, or safety violations.
  • Strategic Risks: These are voluntary risks that a company willingly accepts in exchange for higher potential profits and market value. They require active management rather than strict avoidance.
    • Examples: Launching a new product, entering an unproven foreign market, or shifting business models.
  • External Risks: These are threats originating from outside the organization that are completely beyond direct control. Mitigation relies on early identification, scenario planning, and emergency preparedness.
    • Examples: Natural disasters, sudden economic recessions, or unexpected new government regulations.