Why many founders stay stuck in the risk cloud
Till Blania and Peter Münstermann dedicated Risk Radar episode 21 to a question from the Beraterium community: you have looked at risk, maybe asked ChatGPT for 20 or 30 hazards — and now you face a cloud. What next? Prioritise? Ignore? Research more?
The pattern is familiar to startups, solo self-employed people and mid-market companies alike. At some point delivery failures, lost customer emails or unreliable partners appear — and it becomes clear that "we'll get to risk eventually" is not the same as clarity. The impulse to act often comes only after damage has already happened. Not from laziness, but because quiet risks stay invisible in day-to-day operations.
What a ChatGPT list delivers — and what it misses
Asking ChatGPT can be a valuable first impulse. It provides perspective, names hazards you might overlook and helps with brainstorming. What it does not provide: the spirit inside the company, the current transition, the warehouse worker's experience or the gap in an insurance policy.
Peter Münstermann puts it sharply: AI often returns answers that have solidified over years — sometimes "80 percent important" without anyone checking the context. Industry statistics are not the same as "what has already happened here?" Those who only look outward build expensive crystal-ball forecasts. Those who learn from internal experience usually hit the core more often.
Why risks stay quiet — and insurance alone rarely suffices
Loud risks make the news. Quiet risks hide in everyday work: the technician waiting a week for a spare part; the customer who switches to a competitor after two months without delivery; the reputational damage no policy replaces.
Till Blania uses the example of a production fire: insurance may pay the time value of the machine — but not automatically a new line, not the customer base and not the reputation as a reliable supplier. "I'm covered" is therefore often a misjudgement, not bad faith. Risk management starts where you ask: what really applies — and what else is attached?
Why employees often stay silent — and what that costs
Peter Münstermann is convinced: employees see problems first. They sense overload, know customer dissatisfaction and experience daily where processes stall. What reaches leadership is usually only a slice.
Why do people stay silent? Hierarchy plays a role — especially in mid-market companies. A warehouse worker who raises fire-safety or occupational-health gaps sometimes expects pushback instead of dialogue. Add the fear of blame: risk is quickly confused with failure. Beraterium therefore lifts these conversations to a neutral level: not "who is at fault?" but "what is the impact — and how likely is it?"
More on why trust and open communication are the foundation is in People, trust and risk management.
What leaders actually gain: time, not just loss prevention
"We don't need it", "we already have it", "doesn't it cost more than it saves?" — three classic objections to risk management. Till Blania answers with an often overlooked benefit: time.
Risk management is not only IT, insurance or supply chain. It is also processes where hours disappear every day — the managing director as firefighter, the solo founder losing a third of working time to admin. Anything that costs money and has a probability of occurring is a risk. Lose a third of ten hours at 100 euros and you feel it at month end — even without a classic damage event.
Clarity rarely brings immediate revenue. It reduces loss, sharpens priorities and cuts reaction time. Those who know where processes stall can act structurally instead of permanently extinguishing fires. The link between time loss and entrepreneurial risk is explored in Time as a risk factor.
Why checklists and ISO alone rarely create clarity
ISO standards and checklists have their place — regular listeners know the limits. "We already do it internally" sometimes means: someone optimises processes while the boss believes risk management is running.
Peter Münstermann warns against ticking boxes: paper is patient. One question, one cross, done — theoretically correct, practically ineffective. Checklists know neither a family-business generational handover nor coffee-break truth in a gym. That is why Beraterium relies on risk dialogue and the 3-level hazard catalogue: people share what they have already experienced — and diffuse fears become shared assessments.
How a hazard catalogue works as the foundation
The first concrete step: choose categories — IT, HR, production, machinery, supply chain, reputation, environment, utilities. From that comes a hazard catalogue with about 80 to 100 entries. AI can help with collection if you ask for 10 to 20 hazards per category. Less becomes imprecise, significantly more unwieldy.
Peter Münstermann points to the scale: Germany's BSI alone lists around 1,500 hazards — with measures for each. Nobody should copy that one to one. The art is tailoring: a three-person startup needs different priorities than a family business sourcing tools from Asia. The same hazard may be dominant in technology, process or human action — so place each hazard in one dominant spot and weight it.
| Step | Goal | Typical mistake |
|---|---|---|
| Define categories | Completeness without chaos | Only industry top-of-mind |
| Collect 80–100 hazards | Broad coverage | Too few or 500 items without priority |
| Dominant placement | Clear ownership | Duplicating the same hazard five times |
| Tailor to the company | Relevance | Adopting a BSI catalogue unfiltered |
How team dialogue surfaces blind spots
The hazard catalogue is the map — dialogue is the expedition. Bring in three to five employees from different areas, walk through scenarios, ask openly: does this happen here? How often? What would it cost?
That requires trust. Without a feedback culture you get polite or vague answers — then the workshop wastes time. Till Blania is direct: if you know employees will not speak openly, do not pretend the step. Long term, culture work pays off; short term, an externally moderated view sometimes helps.
Those who involve employees early — in identification, assessment and measures — lower the hurdle at implementation. Ideas the team co-develops are lived more than rules handed down from above.
Why euro assessment makes risks comparable
"That happens all the time" and "oh God, huge damage" — neither alone is enough. Peter Münstermann insists on euro amounts: downtime from a power cut, missing tools, lost revenue, dismissal costs — much can be quantified if you invest the effort.
From damage and probability comes the portfolio: the further top-right, the more urgent. Neutral, factual, without blame — impact on the index first, then causes and measures. That separates Beraterium's method from a mere risk list: clarity on magnitude first, then action.
What comes after assessment: causes, measures, external help
Identified risks need causes and measures — ideally again as a team, not alone at the boss's kitchen table on Sunday. Sometimes internal know-how is enough: a motivated employee, a long-standing IT partner, a fire-safety provider with history in the business.
Where internal capacity is missing, a budget from the risk assessment helps: how much may a measure cost to reduce the risk sensibly? External expertise — insurance review, process digitisation, leadership coaching — becomes an investment, not a leap in the dark.
Till Blania stresses: you can do this yourself if time is available. AI makes research and structure easier. The added value of professional moderation lies in involving people, asking follow-up questions and bringing routine — not in a locked secret.
Conclusion: from cloud to a workable picture
Clarity in risk management does not come from more unfiltered lists, but from a thoughtful hazard catalogue, honest team dialogue and euro assessment. Those who move from ChatGPT risks, ISO boxes or gut feeling to this triad see which risks truly count — and regain time that previously went into reaction and uncertainty.
Next step: Set five categories for your company and collect ten hazards per category — in a workshop or with AI as sparring partner. Then bring in two employees and ask for three entries: "Has this already happened here — and what would it have cost?"
