I had a great summer. Among other things, I spent a week at a guest ranch in Colorado with my 13-year old son.

The ranch, Sylvan Dale, located just outside Loveland, is an old fashioned Western ranch. Meaning you better be ready to ride horses. Up mountain sides. Through rock gorges. Across endless cattle pastures. Under a blazing high altitude sun, with Longs Peak, one of the Colorado Fourteeners, looming in the distance.

(Editor's Note: Sylvan Dale Guest Ranch sustained extensive damage in the recent Colorado flooding. Presently the ranch is shut down and accessible only by foot. The Jessup family which owns Sylvan Dale is committed to rebuilding. For more information please go to www.sylvandale.com.)

I am not a cowboy. I am a middle aged lawyer from the East Coast. You can tell just by looking at me. If I get up at the crack of dawn, it's for a Starbucks latte, not to mend barbed-wire fence.

There's something deeper that separates people like me from cowboys and cowgirls, though. For them, living the life they want to live means facing risks every day. I don't mean the kind of abstract risks we in-house lawyers worry about, like patent infringement or false advertising. I mean bodily harm, the kind of risks that can send you to the hospital. Or worse. For wranglers, getting thrown off a horse is something you laugh about at dinner that night. Ropers and horse breakers can rattle off a list of their broken bones over the years and tell you in vivid detail the story behind each one.

Cowboys and cowgirls have to know how to deal with flash floods, hail storms, angry bulls, poisonous snakes, tetanus, rustlers and everything else that goes along with raising cattle on big ranches in the American West. And they do it with calm and collectedness and even some humor. Cowboys and cowgirls don't call what they do risk management. They would call it common sense. Some people use the term “cowboy” to describe recklessness. Nothing could be further from the truth. Cowboys and cowgirls are expert risk managers.

The concept of risk and how to manage it has slowly but steadily made its way into the legal profession over the last several years. Back in 2009, I contributed a chapter to a book published by the National Contract Management Association (NCMA) that was the first ever application of risk management techniques to services contracts. Since then, I've written and spoken on applying risk management to contracts and to in-house practice in general for both the NCMA and the Association of Corporate Counsel (ACC). I firmly believe, and have predicted for a while, that risk management will eventually become a core competency for all in-house lawyers. (If you learn more about risk management, you can search the web and find a good amount of free material describing the basics.)

In-house lawyers are perfectly positioned to manage risk in companies because we are, by nature, analytical. But we are also, by nature, very averse to risk. If we can't come up with some clever, lawyerish maneuver that will avoid risk altogether, we stop dead in our tracks. That's a broad generalization about our profession, I know, but one to which there is a lot of truth. It's not all our fault. The current legal education system doesn't train lawyers on how to manage risk. While law school teaches cause and effect, it doesn't teach us to proactively address risk, only to react. After all, aren't problems the grist of the lawyer's mill?

Incorporating risk management into an in-house legal department also runs into the practical constraints of time and resources. The attendees at the several risk management seminars I've led didn't need convincing about the value of risk management to their companies or careers. Their questions mostly centered on how they could implement risk management practically and cost effectively. Risk management is not something that is done off the cuff. To be done effectively, risk management requires the practitioner to follow a formal methodology and to employ tools to identify, prioritize, assess and treat risks. At the same time, there is nothing that says effective risk management can't be done in a sensible manner.

On the Thursday during our week at Sylvan Dale, my son and I mounted our horses, Ricochet and Ben, and left on a day long ride from the ranch along the Big Thompson River, up Alexander Mountain, to an old cabin called the Cow Camp. As I rode the trail with the other guests and the wranglers, taking in the magnificent view (and secretly freaking out about the 50 foot sheer rock face drop off to my right), I thought about how we in-house lawyers might adopt the common sense approach cowboys and cowgirls use in managing a broad range of risks, some with potentially devastating impacts. What I came up with is the following guideline, which I call the “Cowboys' & Cowgirls' Guide to Risk Management.” The list takes some traditional bits of cowboy and cowgirl wisdom and translates them into rules of risk management for the rest of us greenhorns:

• The hardest thing about ridin' a horse is the ground. In business, as in life, nothing worthwhile comes without some risk, and taking risk requires assessing risk. The more formal and objective and tool driven the risk management, the better the results.
• Don't interfere with somethin' that ain't botherin' you none. Where novices often get bogged down in risk management is in the initial stage of risk identification, because they don't limit the risks to ones that impact their stated business objectives. A risk is not a risk to you unless the occurrence of the risk impacts your objectives.
• When a runnin' horse gets to the edge of a cliff, it's too late to say “whoa.” Risk management is meaningless unless it is done up front and proactively, typically during business case development, project planning, RFP review, etc.
• Timing has a lot to do with the outcome of a rain dance. Another novice mistake in risk management is to confuse the impacts of risks with their causes. Risks can only be managed by treating their causes.
• If you're ridin' ahead of the herd, make sure you look back now and then to see if it's still there. Effective risk management must be done on a cross functional team basis. For example, lawyers are qualified to identify compliance risks, but not product/service delivery or financial risks.
• Sometimes you eat the bear, and sometimes the bear eats you. Assessing individual risks isn't just about identifying causes and impacts. The multiplier often forgotten by novices is probability. Risk = Impact x Probability.
• Know when to hold 'em and when to fold 'em. When the potential risks outweigh the potential reward, company's need to know when to end pursuit of a business opportunity.
• When you draw your gun, quick is good, but accurate is better. Risk management tools are just like six shooters, they need the right balance. For example, a color coded risk map is a simple x-y axis diagram that, when filled out thoughtfully, provides a very powerful tool for prioritizing risks.
• Ride for the brand. Risk management should always be done with an enterprise level view, or better yet as a part of an enterprise risk management plan, taking into account executive management's risk appetite.

I had a great summer. Among other things, I spent a week at a guest ranch in Colorado with my 13-year old son.

The ranch, Sylvan Dale, located just outside Loveland, is an old fashioned Western ranch. Meaning you better be ready to ride horses. Up mountain sides. Through rock gorges. Across endless cattle pastures. Under a blazing high altitude sun, with Longs Peak, one of the Colorado Fourteeners, looming in the distance.

(Editor's Note: Sylvan Dale Guest Ranch sustained extensive damage in the recent Colorado flooding. Presently the ranch is shut down and accessible only by foot. The Jessup family which owns Sylvan Dale is committed to rebuilding. For more information please go to www.sylvandale.com.)

I am not a cowboy. I am a middle aged lawyer from the East Coast. You can tell just by looking at me. If I get up at the crack of dawn, it's for a Starbucks latte, not to mend barbed-wire fence.

There's something deeper that separates people like me from cowboys and cowgirls, though. For them, living the life they want to live means facing risks every day. I don't mean the kind of abstract risks we in-house lawyers worry about, like patent infringement or false advertising. I mean bodily harm, the kind of risks that can send you to the hospital. Or worse. For wranglers, getting thrown off a horse is something you laugh about at dinner that night. Ropers and horse breakers can rattle off a list of their broken bones over the years and tell you in vivid detail the story behind each one.

Cowboys and cowgirls have to know how to deal with flash floods, hail storms, angry bulls, poisonous snakes, tetanus, rustlers and everything else that goes along with raising cattle on big ranches in the American West. And they do it with calm and collectedness and even some humor. Cowboys and cowgirls don't call what they do risk management. They would call it common sense. Some people use the term “cowboy” to describe recklessness. Nothing could be further from the truth. Cowboys and cowgirls are expert risk managers.

The concept of risk and how to manage it has slowly but steadily made its way into the legal profession over the last several years. Back in 2009, I contributed a chapter to a book published by the National Contract Management Association (NCMA) that was the first ever application of risk management techniques to services contracts. Since then, I've written and spoken on applying risk management to contracts and to in-house practice in general for both the NCMA and the Association of Corporate Counsel (ACC). I firmly believe, and have predicted for a while, that risk management will eventually become a core competency for all in-house lawyers. (If you learn more about risk management, you can search the web and find a good amount of free material describing the basics.)

In-house lawyers are perfectly positioned to manage risk in companies because we are, by nature, analytical. But we are also, by nature, very averse to risk. If we can't come up with some clever, lawyerish maneuver that will avoid risk altogether, we stop dead in our tracks. That's a broad generalization about our profession, I know, but one to which there is a lot of truth. It's not all our fault. The current legal education system doesn't train lawyers on how to manage risk. While law school teaches cause and effect, it doesn't teach us to proactively address risk, only to react. After all, aren't problems the grist of the lawyer's mill?

Incorporating risk management into an in-house legal department also runs into the practical constraints of time and resources. The attendees at the several risk management seminars I've led didn't need convincing about the value of risk management to their companies or careers. Their questions mostly centered on how they could implement risk management practically and cost effectively. Risk management is not something that is done off the cuff. To be done effectively, risk management requires the practitioner to follow a formal methodology and to employ tools to identify, prioritize, assess and treat risks. At the same time, there is nothing that says effective risk management can't be done in a sensible manner.

On the Thursday during our week at Sylvan Dale, my son and I mounted our horses, Ricochet and Ben, and left on a day long ride from the ranch along the Big Thompson River, up Alexander Mountain, to an old cabin called the Cow Camp. As I rode the trail with the other guests and the wranglers, taking in the magnificent view (and secretly freaking out about the 50 foot sheer rock face drop off to my right), I thought about how we in-house lawyers might adopt the common sense approach cowboys and cowgirls use in managing a broad range of risks, some with potentially devastating impacts. What I came up with is the following guideline, which I call the “Cowboys' & Cowgirls' Guide to Risk Management.” The list takes some traditional bits of cowboy and cowgirl wisdom and translates them into rules of risk management for the rest of us greenhorns:

• The hardest thing about ridin' a horse is the ground. In business, as in life, nothing worthwhile comes without some risk, and taking risk requires assessing risk. The more formal and objective and tool driven the risk management, the better the results.
• Don't interfere with somethin' that ain't botherin' you none. Where novices often get bogged down in risk management is in the initial stage of risk identification, because they don't limit the risks to ones that impact their stated business objectives. A risk is not a risk to you unless the occurrence of the risk impacts your objectives.
• When a runnin' horse gets to the edge of a cliff, it's too late to say “whoa.” Risk management is meaningless unless it is done up front and proactively, typically during business case development, project planning, RFP review, etc.
• Timing has a lot to do with the outcome of a rain dance. Another novice mistake in risk management is to confuse the impacts of risks with their causes. Risks can only be managed by treating their causes.
• If you're ridin' ahead of the herd, make sure you look back now and then to see if it's still there. Effective risk management must be done on a cross functional team basis. For example, lawyers are qualified to identify compliance risks, but not product/service delivery or financial risks.
• Sometimes you eat the bear, and sometimes the bear eats you. Assessing individual risks isn't just about identifying causes and impacts. The multiplier often forgotten by novices is probability. Risk = Impact x Probability.
• Know when to hold 'em and when to fold 'em. When the potential risks outweigh the potential reward, company's need to know when to end pursuit of a business opportunity.
• When you draw your gun, quick is good, but accurate is better. Risk management tools are just like six shooters, they need the right balance. For example, a color coded risk map is a simple x-y axis diagram that, when filled out thoughtfully, provides a very powerful tool for prioritizing risks.
• Ride for the brand. Risk management should always be done with an enterprise level view, or better yet as a part of an enterprise risk management plan, taking into account executive management's risk appetite.