Risk & Controls / Insight
Objectives First: Define Success Before Listing Risks
A fictional online retailer makes delivery, order economics and customer trust explicit before connecting possible events, causes, consequences and responses.
Return to your library resultsA useful risk discussion begins with a business question: what are we trying to achieve?
Without that answer, a list of risks can become a collection of alarming words. “Courier,” “discount” and “customer complaint” may all appear on the page, but they do not yet explain what success means or how it could be disrupted.
A small online retailer
Consider a fictional online retailer preparing its next operating plan. The founder wants dependable delivery, sustainable order economics and customer trust. The warehouse lead wants parcels dispatched quickly. Marketing wants an attractive promotion. Customer service wants promises the team can actually keep.
Assume the retailer uses an external courier, offers delivery commitments at checkout and can trace orders from acceptance to delivery. These assumptions need checking in a real business. No actual results or industry benchmarks are implied.
“Grow successfully” is a direction. It is too vague to tell these teams which decisions fit together.
Make success clear enough to discuss
Start with delivery: fulfil accepted orders within the delivery commitment communicated to the customer, while keeping the correct items and agreed condition in scope. The team needs to define the population, the promise and the start and end events before it can assess performance. State how cancellations and failed deliveries are treated; excluding difficult orders after the fact can make the measure misleading.
For order economics, the team wants promotions that remain sustainable after the costs caused by fulfilling those orders. For this lesson, contribution means order receipts after discounts less the direct costs included in the decision model. The model must state which costs it includes; this is a decision measure, not a complete financial statement profit figure. Positive contribution alone does not establish business profitability: fixed, shared or additional capacity costs may remain.
For trust, the team wants accurate promises and fair handling when something goes wrong. Complaint counts can help, but they are incomplete: customers who do not complain are not necessarily satisfied. A measure should help evaluate an objective rather than replace its meaning.
Connect a possible event to an objective
Now consider an uncollected batch of parcels. If the courier misses collection after the retailer has accepted orders against a delivery promise, those orders may arrive late and customers may lose confidence.
The missed collection is a possible event. A capacity shortfall could be one cause. Late delivery and loss of trust are possible consequences. The objective makes clear why the event matters.
A second example concerns the promotion. If the checkout applies a discount outside the authorised offer rules, receipts may be lower than the order economics assumed. A configuration mistake is a possible cause; a margin shortfall is a possible consequence. None of these possibilities proves that an error has actually occurred.
“Courier risk” and “discount risk” are shorthand labels. The fuller statements give the business something it can investigate and act on.
Keep the response separate
A collection-status alert, a backup-carrier arrangement or an offer-configuration check might help address these exposures. Each is a possible response to evaluate, not evidence that the risk has disappeared.
A response needs an owner and workable conditions. For example, a backup courier is not useful merely because its name is on a list; the retailer needs to understand availability, service terms and how the handover would work.
Choosing the cheapest carrier might support one cost measure while weakening the delivery promise. A promotion could increase order volume while creating fulfilment pressure. Objectives should therefore be considered together rather than optimised in isolation.
Decide what still needs agreement
The founder and responsible managers need to clarify targets, acceptable variation and the point at which an exception must be escalated. This lesson does not prescribe a percentage or imply that an internal tolerance can override a legal or contractual obligation.
Ask which information is missing before scoring the risk. Does the team know courier capacity, actual fulfilment costs and which customer promise applies? An attractive risk score cannot repair an unclear objective or unreliable inputs.
The map is also a starting point. Changes in products, promotions, customer expectations or delivery arrangements may require the objectives and risks to be revisited.
Practice: build an objective-led map
Choose delivery as the centre. Add the promised outcome, one possible disruptive event, one possible cause and one consequence. Then add a proposed response, its owner and one limitation.
Self-check: is “check the courier portal every afternoon” the objective? No. It is an activity that may support a control. The outcome is the delivery commitment the business is trying to fulfil.
Define success first. Then explain what could prevent it, why that matters and what the business can reasonably do about it.
Put the perspective to work.
Use these questions to connect the resource to your own business context.
What could prevent the objective from being achieved?
How does the control respond to that failure?
What evidence shows its design and actual operation?
Who owns exceptions, escalation and corrective action?
References & context.
COSO — Internal Control: further reading — https://www.coso.org/internal-control
U.S. GAO — Green Book (2025): objective clarity; U.S. federal context — https://www.gao.gov/greenbook
Use the framework and jurisdiction applicable to your work. Original examples and templates do not imply endorsement by the referenced organisations.
A question, correction or missing source?
The resource link will be included in your message form.
