Laurent Bossavit was talking about risk on his blog.

He arrives at a final definition of:

"Risk consists of future consequences, arising from present causes or foreseeable events, which - if they materalize - will exceed our normal capacities for coping."

This actually forsees an interesting point: there are actually two ways to avoid risk.

The first is to avoid or transfer the future consequences. This is the standard plan - either attempt to manage the risk, or transfer it to another party (e.g. buy insurance).

Bossavit hits on an interesting ability, however, which is tightly coupled to the comments I made recently on this blog: risk can be averted by increasing your ability to cope. That is, by creating more value.

This is where one can look at security processes as a value creation engine. If the process of securing your business process can also implement process efficiency enhancement at the same time as it actually is used for loss prevention, you will create a situation whereby value is added at the same time.

In this way, you're not only avoiding loss, you're also enhancing the value of your process at the same time - you're creating a situation by which your ability to cope with future loss is enhanced by a better utilization of your current resources.