Risk Management Framework

Risk is often treated as either “safe” or “unsafe.” That framing fails immediately in complex environments like capital markets or enterprise strategy.

Risk is not the presence of danger. It’s the range of possible outcomes and your exposure to them. As with the topics of “Fear” and “Failure”, the best risk-takers I know have the best ‘relationship’ with risk.

Risk becomes actionable when you define:

• What outcome variability looks like
• What level of risk is acceptable
• What return justifies taking it

This forces a more disciplined question:

Are you chasing yield, or are you optimizing for risk-adjusted return?

That distinction separates strategic leaders from reactive ones.

When I think about Commercial Real Estate, I think about the three cycles that ebb and flow like sine waves:

1. The economy
2. The local brick-and-mortar markets
3. The capital markets

When mapped over one another, when the waves converge, we have opportunity; when they diverge, we have risk.

One of the simplest but most effective models of risk comes from the “3 Rings” concept:

Leaders, transactional specialists, and salespeople tend to be confident people. They live in that first ring where they know what they know. Maybe they have been deluded into believing that if they expand their knowledge base (expand the area of the first ring), they can ‘consume’ the area of the second ring. However, the mother of all risks is the so-called “Black Swan” event. As such, definitionally, this third ring is where we need to consider what we don’t know we don’t know.

When it comes to the commercial real estate industry, there are three major roles you can play: principal, agent, and advisor. For me, I define each role in terms of their risk tolerance, where their focus should likely be, and how they get paid. Each individual has their clear preference, and there’s no right or wrong answer.

The distinction between the three roles matters more than most acknowledge:

• When you evaluate risk as a principal, you prioritize protecting YOUR capital.
• When you operate as an agent, the risk is working on a transaction that ultimately isn’t financeable, leaseable, or saleable.
• When you work as an advisor, you optimize for client outcomes; however, your risk is your brand and long-term credibility.

This framework forces alignment between incentives and risk tolerance. A principal can’t afford to think like an agent, and on the flip side, an advisor can’t ignore reputation risk in pursuit of short-term gains.

Most flawed risk strategies stem from role confusion. Leaders (especially) assume they’re optimizing for one outcome while operating under a different set of incentives. A disciplined risk management framework begins by clarifying your position in the equation (principal, agent, or advisor). Only then can you assess whether the level of risk taken aligns with the expected return.

This four-part structure mirrors how experienced investors underwrite decisions in real time. In a broader business perspective, a risk management framework identifies, assesses, mitigates, and prices risk in decision-making.

Identification starts with a full inventory. Strengths and weaknesses must be explicitly listed; in CRE, this includes, but is not limited to, location, tenant quality, sponsor capability, capital markets, available government programs, and the overall economy.

Assessment is really a judgment call. Data informs, but it’s ultimately experiences that sharpen it. Don’t just default to your spreadsheets; put them in the perspective of the overall situation. This is where ‘group think’ is beneficial. Seek out other subject matter experts and thought partners.

Mitigation is where strategy shows up. Adjusting leverage, structuring deals differently, or selecting partners can materially shift the overall risk profile. Your goal is better alignment amongst all parties to outcomes.

Pricing is the final filter. If the return does not justify the exposure, the decision is simple: you walk away. Sometimes the best deals are the deals you don’t take.

If you’re making high-stakes decisions without a structured risk framework, you’re relying on instinct where discipline should exist. Let’s chat about the decision-making process and put together a risk framework.

Context Gives Meaning to Content

Most leaders assume more data leads to better decisions. In practice, it often leads to more noise.

Data, by itself, is just content: isolated facts, metrics, and inputs. It only becomes useful when placed in context, which defines how that information should influence a decision. Data alone does not reduce risk; interpretation does. All businesses evolve from having no data to having (proprietary) data, to converting that data into information, to building knowledge from what the information tells you, to the actual delivery of products and services.

This distinction shows up clearly in the framework: context is what gives meaning to content.

For example: If you’re reviewing a deal, a metric like a 7% return means nothing on its own.

• Is that 7% in a stable market or a volatile one?
• Is leverage amplifying risk behind the scenes?
• Is that return above or below what similar risk profiles demand?

Without context, you’re not evaluating risk; you’re reacting to numbers. Interpreting the numbers relies on experience (pattern recognition), perspective (your role, incentives, and past experiences), relative value and opportunity costs, and environment (market cycles, capital conditions, timing, and the overall economy).

Risk gets reduced when you understand what matters, what doesn’t, and what’s missing entirely. Strong leaders don’t just ask, “What does the data say? They ask, “What does this data mean right now given everything else in play?” AND, “Based on what we have gained from the knowledge, what are we considering doing next (and why)?”

Risk vs Opportunity

Risk and opportunity are not opposites. They are reflections of the same variable: uncertainty.

Every opportunity exists because the outcome is not guaranteed. If it were guaranteed, it wouldn’t be an opportunity; it would already be priced perfectly, with no upside left.

This ultimately reflects the bigger question from the beginning: What level of risk are you willing to take for a given return?

That question ties risk and opportunity together. You can’t evaluate one without the other.

For example: A deal offering a high return is not inherently a strong opportunity. It may simply reflect higher uncertainty or a hidden downside. You have to ask yourself: does the opportunity adequately compensate you for the risk?

You don’t eliminate risk to create opportunity; you structure and price risk correctly to unlock it.

A note about “Expected Value”: When we consider taking a risk, we are evaluating the price of failure or at least an unexpected outcome. What’s missing is the probability of that failure occurring and the severity of the event should it occur.

The experts on Failure suggest not only ‘failing fast’ but ‘failing light’ by taking small bets first to test a thesis (thus reducing severity). While “Intelligent Failure” isn’t the topic of this article, the idea of expected value is worth mentioning.

One of the most consistent mistakes in CRE is ignoring how cycles interact. Property markets, capital markets, and the overall economy rarely move in isolation.

• When they diverge, risk increases.
• When they converge, opportunity emerges.

Another critical error is misunderstanding leverage. Leverage can amplify outcomes positively, negatively, or neutrally, depending on the structure and cost of capital. Executives who ignore this dynamic often mistake growth for performance.

Here are some other mistakes when it comes to risk management:

• Confusing volatility with permanent loss
• Chasing yield without adjusting for risk being taken
• Ignoring macro cycles (property, capital, economy)
• Failing to define acceptable risk thresholds
• Over-relying on models without context (content vs. context)
• Misaligning incentives across stakeholders
• Ignoring probability and severity of loss, and expected value

• What is risk (to you)?
• What is risk to your team?
• What is an acceptable risk you’re willing to take (and for what return)?
• Does your team have alignment about how much risk is worth taking? Or is everyone capitulating to the person on the team who is most or least comfortable taking risks? Does the TEAM itself have a ‘risk score’ they will accept (taking into consideration everyone’s risk comfort zone)?
• How do you account for varying risk tolerances within your team?

Everyone has a different definition and tolerance for the risk they’re willing to take for a given return. There’s no right or wrong answer.

If you’re operating at a level where decisions carry real consequences, you don’t need more data. You need sharper judgment.

A disciplined risk management framework gives you that advantage.