Risk Management: Definizione, scopo, ed esempi

Risk management, in Italian gestione del rischio, is the systematic process of identifying, analysing, evaluating and treating the uncertainties that can affect the achievement of an organisation’s objectives. The international reference standard, ISO 31000:2018, confirmed in October 2023 and valid for the following five years, defines it as “a systematic, transparent and customisable process that makes it possible to address uncertainty and improve an organisation’s decision-making capability.” The word “rischio” (risk) comes from the medieval Portuguese risco, which in turn derives from the old Italian risicare, to dare, to tempt fate, a root that points back to navigation: to risk was the act of the sailor venturing beyond known routes, accepting uncertainty as a condition of the voyage. This etymology is not decorative: risk is not the certain threat, but the uncertainty of the outcome. Risk management does not eliminate risk, it eliminates surprise.

In Italy, “risk management” is still perceived as a specialist discipline, reserved for compliance officers in banks, large listed companies and investment fund managers. Which explains why 90% of Italian SMEs have no formalised risk management process, and why the most significant risk category for mid-sized companies, brand risk, is systematically absent from the risk management plans of those that do have one. In its Global Risks Report 2026, the World Economic Forum finds that 50% of the 1,300 leaders and experts surveyed expect a turbulent environment over the next two years, with geopolitical risks, cyber insecurity and disinformation at the top of the list of short-term threats (WEF, Global Risks Report 2026, 21st edition). Disinformation, which erodes consumer trust and damages corporate reputation, is the risk that most directly affects the brand, and the one to which Italian SMEs are most exposed and least prepared.

In this guide, written by the strategy team at Bliss Agency on the basis of international risk management standards, the leading risk reports of 2025–2026 and direct experience in Brand Advisory for premium companies and family businesses, you will find:

• the complete definition of risk management, with its history, etymology and fundamental distinctions;
• the six main categories of business risk, with a comparison table;
• the five-stage ISO 31000 process, operational and applicable to businesses of any size;
• brand risk as a specific strategic category, and the most underestimated in Italian SMEs;
• real examples verified with 2025–2026 data;
• the trends for 2026, from AI risk to disinformation as a systemic risk;
• an FAQ answering the questions most frequently asked by business owners and managers.

1. The history of risk management: from medieval banks to Enterprise Risk Management

Risk management is older than its formalisation as a discipline. As early as the 13th century, Italian medieval bankers from Florence, Genoa and Venice were managing credit risk through bills of exchange, marine insurance contracts and diversification of their loan portfolios. The principle was the same one that governs modern risk management: not to eliminate risk but to spread it and make it governable. The first insurance policy in history is Genoese, dated 1347.

Risk management as a formalised business discipline emerged in the 20th century, initially in the financial and insurance sectors. The systemic turning point came in the 1990s with Enterprise Risk Management (ERM): for the first time, risk management concerned not only financial areas but the entire organisation, integrated with corporate strategy. The COSO ERM framework, developed by the Committee of Sponsoring Organizations of the Treadway Commission, became the reference model for large American corporations. In 2009, all the concepts of risk management were formalised in the international standard ISO 31000, updated in 2018 and confirmed in October 2023, which extends the discipline to any type of organisation, whether private, public or non-profit, regardless of size and sector.

2. The six categories of business risk: an operational map

Business risk is not monolithic. There are distinct categories, with different origins, natures and management tools. The taxonomy most widely used in management practice and in structured risk management frameworks identifies six main categories.

3. The five-stage risk management process: the ISO 31000 model

The ISO 31000:2018 standard defines the risk management process as a continuous five-stage cycle: not a procedure carried out once, but a system that becomes part of the organisation’s ordinary decision-making processes.

1. Risk identification. Systematically listing all events, internal and external, that could affect the achievement of objectives. At this stage, probability and severity are not assessed: the scope of uncertainty is mapped. For family-owned SMEs, this stage often reveals risks no one had ever named: the brand’s dependence on the founder as a person, the absence of a documented narrative, the lack of a succession plan.
2. Risk analysis. For each risk identified, the probability of occurrence and the magnitude of impact are estimated. Multiplying the two variables produces a risk matrix that prioritises interventions. Not every risk requires the same level of oversight: the matrix allows resources to be concentrated on the risks with the highest residual exposure.
3. Risk evaluation. The risks identified and analysed are compared against the tolerance threshold set by the organisation. Those above the threshold require action; those below it are monitored. Setting the tolerance threshold is a strategic decision, not a technical one, and requires the involvement of top management.
4. Risk treatment. For each priority risk, one of four strategies is chosen: avoid the risk (do not enter the territory that generates it), reduce the risk (actions to lower likelihood or impact), transfer the risk (insurance, contracts, outsourcing), accept the risk (knowingly, with contingency reserves). The choice depends on the organisation’s risk profile and on the relative cost of each option.
5. Monitoring and review. Risk management is not a snapshot: it is a continuous process. Risks change with the context: new regulations, market shifts, unexpected events, technological developments. Continuous monitoring and periodic review of the risk map are the difference between a living risk management system and one that exists only in the corporate policy document.

4. Brand risk: the most underestimated category in Italian SMEs

Reputational and brand risk is systematically absent from the risk management plans of Italian SMEs. Not because it does not exist, but because it is not recognised as a quantifiable risk, and is therefore not included in governance processes. The Willis Reputation Risk Readiness Report 2026, based on a survey of 500 senior executives in 20 countries between January and February 2026, reveals that only 30% of organisations have robust tools to estimate the financial impact of reputational damage, up from 11% two years ago, but still insufficient. The conclusion of David Bennett, head of reputational risk management at Willis, is blunt: organisations that continue to treat reputation as a communications or public relations function “will be overwhelmed” (Willis, Reputation Risk Readiness Report 2026).

In terms of economic impact, the consequences of an unmanaged reputational crisis are well documented: brand reputation takes an average of 3.7 years to rebuild after a critical event, with an average loss of brand value of 22% during the crisis period (Forbes / Brand Finance, 2024). For a company with significant brand equity, these figures translate into lost revenue, eroded margins and difficulty in maintaining key commercial relationships.

The five brand risks specific to Italian companies in 2026

1. Biographical concentration risk

In family-owned SMEs and in companies founded by a recognisable entrepreneur, the brand often coincides with the founder as a person: customer trust, market reputation and competitive positioning are built around a physical figure. When the founder leaves the stage, by choice, through illness or a personal crisis, the brand disperses the value it has accumulated unless founder-independent branding has been put in place beforehand. Founder-independent branding is the process that separates the identity of the company from the identity of the person, transferring values, vision and narrative from the founder to the institution.

2. Generational risk

Handing leadership to the next generation is the moment of greatest exposure to brand risk for family businesses. A brand perceived as “the father’s” does not transfer automatically: it dissipates, unless a system of continuity in values has been built, with a documented narrative, active brand governance and a communications transition plan. Brand generational continuity is not a chapter of corporate succession: it is a separate discipline that safeguards market perception before, during and after the change of leadership.

3. Digital reputational crisis risk

In 2026, a reputational crisis can emerge in hours and spread in minutes. Disinformation, with over 50% of digital users unable to tell truth from falsehood and deepfakes spreading rapidly, has become a structural amplifier of reputational risks (WEF, Global Risks Report 2026). A company without a Brand Recovery Program, a pre-built crisis response plan with approved messages, a defined decision-making chain and response protocols for each channel, faces the crisis by improvising, at a significantly higher cost in time, consistency and brand value than a company that was prepared.

4. Brand risk in M&A and capital transactions

When a company opens its capital to external shareholders, takes part in a merger or is acquired, the brand undergoes due diligence. A brand without documented governance is discounted in the valuation, because a rational buyer perceives the risk of biographical dependence and of post-transaction inconsistency. Bliss Agency’s Brand Advisory M&A supports companies in preparing their brand for capital transactions: from documenting the identity to the transition narrative, through to protecting brand equity during negotiations.

5. Communication inconsistency risk

The inconsistent brand, one that communicates different values on different channels, changes tone depending on who it is addressing and fails to keep over time the promises it has made to the market, erodes brand equity silently: there is no visible crisis, but the long-term effect is the same. Brand consistency is measurable: companies with rigorous brand consistency grow 23% more than inconsistent ones (Lucidpress, cited by Amra & Elma, 2026). Its absence is a brand risk that builds up for years before it becomes visible in the numbers.

5. Real examples of brand risk management

Johnson & Johnson, Tylenol 1982: the global reference case

The 1982 Johnson & Johnson case, with seven deaths from contaminated Tylenol, the immediate recall of 31 million packs and an immediate cost of 100 million dollars, is the world’s benchmark case on reputational risk management. J&J had a documented value system, the “Credo” written in 1943, which explicitly set out its responsibilities towards customers, employees, communities and shareholders, in that order. That system enabled management to take, within hours, a decision that cost hundreds of millions but preserved the brand equity. The result: 98% of Tylenol’s market share recovered within a year of the crisis. Risk preparedness, having a documented value system and a pre-built response plan, is what made that recovery possible.

Brand risk in Italian SMEs: the work of Bliss Agency

Within the scope of Bliss Agency’s brand consulting, brand risk management becomes a structured process that always starts with diagnosis, a brand audit that maps how perceived value is distributed between the institution and the individual, and results in a brand governance system that reduces exposure to the main brand risks. The Risivi & Co case, with revenue growing from €145,740 (2022) to €556,850 (2024), verified against CCIAA filed accounts, documents how an integrated brand management system reduces the risk of inconsistency and biographical concentration, producing demonstrable growth. The Profumum Roma case, a ROAS of 17.1 on Google Ads e-commerce, shows how brand equity governed with method delivers not only protection from risk but amplified performance. For details: Bliss Agency case studies.

6. The 5Ws of corporate risk management

• Who: Any organisation pursuing objectives under conditions of uncertainty, from start-up to multinational, from family-owned SME to public body. Risk management is not proportional to size: it is proportional to the organisation’s complexity and exposure. Italian family-owned SMEs are often the most exposed and the least protected.
• What: The systematic process of identifying, analysing, evaluating and treating the uncertainties that can affect the achievement of business objectives, across all risk categories, including brand risk.
• When: Before events, not during them. The value of risk management lies in preparation, in the decisions taken under normal conditions that determine the response under crisis conditions. A Brand Recovery Program built while the brand is solid costs a fraction of one built during a crisis.
• Where: In all of the organisation’s decision-making processes, not as a separate function, but as a dimension integrated into day-to-day operational choices, strategic plans and investment decisions. Risk management that exists only in a corporate policy document is not risk management: it is an archive.
• Why: Because 50% of global leaders expect a turbulent environment over the next two years (WEF, 2026); because disinformation is becoming a structural multiplier of reputational risk; because brand risk builds up silently for years before it becomes visible, and when it does, the cost of managing it is many times the cost of preventing it.

7. 2026 trends: risk management in the age of systemic complexity

Disinformation as a systemic risk for the brand

The WEF Global Risks Report 2026 identifies disinformation, amplified by deepfakes and by loss of trust in traditional media, which stands at 44%, as one of the most urgent short-term risks for organisations. For brands, this translates into a new category of exposure: false narratives, fabricated reviews, decontextualised quotes and AI-generated content attributing positions never taken. The response is not reactive, it is structural: brands with a documented identity, a verifiable history and a consistent presence in the media and in AI Search answers are structurally more resistant to disinformation than brands with an implicit identity and a fragmented digital footprint.

AI as a risk and as a risk management tool

AI has entered the risk landscape as a two-sided variable. As a risk: the WEF 2026 identifies “adverse outcomes of AI technologies” as one of the fastest-rising risks in the ten-year ranking, moving from 30th place in the short term to 5th place in the long term. For brands, the specific risk is the use of generative AI to produce communications content without quality and consistency controls, resulting in inconsistency of values at scale. As a tool: AI systems applied to brand monitoring make it possible to identify weak signals of reputational deterioration in real time, the difference between prevention and crisis management. Corallo AI, the artificial intelligence division of Bliss Agency, integrates AI monitoring into brand advisory processes as an early-warning tool for reputational risk.

Political risk as a new dimension for Italian brands

In a context of growing political and social polarisation, documented by the WEF 2026 as a structural force that amplifies all other risks, brands are exposed to a new risk: being dragged into political controversies without a clear response strategy. Political Brand Governance is the discipline that defines the brand’s stance on political and social issues: not necessarily taking a position on every question, but having a deliberate strategy on what to address and what not to address, in what tone and with what consistency of values.

Risk management FAQ: the most frequently asked questions

What is risk management in simple terms?

Risk management is the systematic process by which an organisation identifies, analyses, evaluates and manages the uncertainties that could affect the achievement of its objectives. It does not eliminate risk, no process can, but it reduces surprises, increases responsiveness and turns the handling of uncertainty from improvised reaction into a structured system. The international standard ISO 31000:2018 defines a five-stage process applicable to any type of organisation, regardless of size and sector.

What are the main business risks in 2026?

According to the WEF Global Risks Report 2026, based on 11,000 business leaders in 116 economies, the most urgent short-term risks (2025–2027) include: geoeconomic instability and armed conflict, cyber insecurity (with new regulatory pressure from NIS2), disinformation and the erosion of trust in institutions, extreme weather events, and long-term AI risks. For Italian SMEs, the most relevant risks in day-to-day practice are credit risk, operational risk and, the least managed, brand reputational risk, amplified by the speed of social media and the spread of digital disinformation.

What is reputational risk and how is it managed?

Reputational risk is the possibility that events, internal or external, real or fabricated through disinformation, damage how stakeholders, media and consumers perceive the brand, with consequences for commercial performance and company value. It is managed through four levers: documented brand governance (identity and values codified, not implicit), continuous reputation monitoring across media and digital channels, a pre-built crisis communication framework (approved responses, a defined decision chain), and a brand recovery programme for the post-crisis phase. Brand reputation takes an average of 3.7 years to rebuild after a major crisis (Forbes / Brand Finance, 2024); the cost of prevention is a fraction of the cost of rebuilding.

What is the difference between risk management and crisis management?

Risk management is proactive: it identifies and addresses uncertainties before they materialise, under normal conditions. Crisis management is reactive: it handles critical events when they occur, under pressure and urgency. The two processes are complementary: effective risk management reduces the probability and magnitude of crises; structured crisis management reduces the damage when a crisis occurs despite prevention. Those with only crisis management, without preventive risk management, improvise in every crisis. Those with only risk management and no crisis management find themselves unprepared when the crisis comes anyway.

How does risk management apply to a family business?

In family businesses, risk management must cover specific risk categories that non-family companies do not face with the same intensity: the risk of biographical concentration (a brand dependent on the founder as a person), generational risk (loss of brand equity during the leadership transition), and the risk of family conflict affecting governance and external communication. The starting point is always a brand audit that maps how perceived value is distributed between the institution and the individual, and from there the mitigation system is built: founder-independent branding, documented brand governance, a generational continuity plan. With 50% of Italian family businesses facing generational succession in the next decade (Fondazione Sviluppo Sostenibile, 2026), preventing these risks has become an urgent priority.