Searching for Risk in All the Wrong Places

Guest Post by Geary Sikich & Sara Robertson (first posted on CERM ® RISK INSIGHTS – reposted here with permission)

Much like the song, “Lookin’ for Love in All the Wrong Places” sung by Johnny Lee; risk management professionals need to ask the question “Are we searching for risk in all the wrong places”?  Are risk professionals being deluded or deluding themselves by seeing risk based on media driven analysis; applying outmoded tools, models, etc. that no longer reflect the reality of risk?

Currently, COVID19 is capturing the headlines daily as the pandemic rages worldwide.  So, much of risk management seems to be focused on COVID19 impact, “the new normal” and “the great reset” as touted by high profile consulting firms, such as, McKinsey & Company, Booz Allen, PriceWaterhouse, Boston Consulting Group and sage gurus.  The coronavirus, like all viruses, mutates nearly constantly, and while our attention is focused on the COVID19 headlines are risk professionals taking into account the touchpoint relationships to other risks?

Absolutes Versus Reality 

We cannot manage the complexity of risk today the way we managed risk in the past.  Yesterday’s models, methods and “best practices” while minimally useful, do not readily apply to managing risk in the future.  Risk today is full of uncertainty, complexity, orders of magnitude beyond the readily recognizable.  Therefore, we have to create new ways of looking at risk and managing risk.  What is risk?  Think about it before you leap to answer.  Do we really know and understand risk?  Some facts to consider:

• Risk is not static, it is fluid.
• Risk probes for weaknesses to exploit.
• Risk, therefore, can only be temporarily mitigated and never really eliminated.
• Over time risk mitigation degrades and loses effectiveness as risk mutates, creating new risk realities.

Heisenberg and Schrodinger both came up with theories about uncertainty.  If we move away from the mathematics of quantum mechanics, we can look at the key points and apply them to risk management.

The most famous realization of Heisenberg’s uncertainty principle states that one cannot measure with absolute certainty the position and momentum of a quantum system.

Restated in risk management terms: “One cannot measure with absolute certainty risk realization (occurrence), velocity and impact”.  This is due to inequality; not all risks realized will be felt equally.  For example, today there are five (5) generations in the workforce.  A single application of a risk model cannot be applied as each generation will experience risk realization differently, even though it is the same risk that we identified.

Schrödinger’s famous thought experiment used a cat: a cat, a flask of poison, and a radioactive source are placed in a sealed box.  If an internal monitor (e.g. Geiger counter) detects radioactivity (i.e. a single atom decaying), the flask is shattered, releasing the poison, which kills the cat.  The Copenhagen interpretation of quantum mechanics implies that after a while, the cat is simultaneously alive and dead.  Yet, when one looks in the box, one sees the cat either alive or dead, not both alive and dead.  This poses the question of when exactly quantum superposition ends and reality resolves into one possibility or the other

Restated in risk management terms: Risk management requires that you constantly monitor recognized risks and continue to scan for new, as yet to be recognized, risks.  This process cannot be accomplished with a ‘one and done’ mindset.  Risk needs to be looked at in three dimensions and perhaps even four dimensions to begin to understand the “touchpoints” and aggregation of risk, potential to cascade, conflate and/or come to a confluence.  In other words, “Keep looking into the box”.

McKinsey has come up with the “Uncertainty Cube” as an enhancement for analyzing scenarios.  In a November 2, 2020 article entitled “Are scenarios limiting your pandemic recovery strategy”? McKinsey authors provide examples of the “Uncertainty Cube” used as an analysis tool.  The article highlights include the following:

Building an “uncertainty cube” allows business leaders to accurately assess the probability that certain outcomes will materialize under various scenarios.

Does the “Uncertainty Cube” enhance or inhibit analysis?  It may enhance analysis to a point.  A cube is a rigid structure, bounded by artificial sides.  It therefore limits analysis to the extent that the analyst chooses the cell structure of the cube.

Risk is not bounded by artificial structures, such as, a cube shape.  No matter how creative you get with the cube shape, it is limited to the artificial boundaries that you set.  Perhaps the following examples will visually explain:

Although novelty items, the Amazon X Cube and the Megaminx Shengshou appear to be applicable in the context of “uncertainty” as discussed in the McKinsey article.  However, there is still the boundary problem that presents artificial limits to the identification and analysis of risk.  As already stated, “Risk is not Static”.  Perhaps more logical depiction would be to depict the analysis points as floating points that have no boundaries and are in a constant state of flux (change)?

Can we accurately assess the probability that certain outcomes will materialize under various scenarios?  Probability is at best a guess at what may happen in the future.  Can we accurately assess, no matter how creative we get, when we place artificial boundaries on the parameters of our analysis?  There will always be forces influencing the analysis that we have not taken into account due to analysis bias, emotional bias, overlooking the obvious, applying outmoded analytical tools, etc.

Ask yourself, “What is my organization’s risk absorption capacity?  Where is our risk saturation point?  At what point does our risk profile allow for risk deflection?  At what point does our risk profile create a risk explosion for our organization?”  These four questions, all too often, never get asked when conducting investigations into risk, threat, vulnerability, business impact and/or hazard analyses.  How do you begin to answer these questions?  First, you need to be open to complexity; second you have to be able to see beyond the immediate and third, you have to embrace the dynamic nature of risk as non-static.

Overlooked, Understated, Lurking in the Shadows

Why do we search for “Black Swans” when we are being slapped in the face daily with risks that are accepted, overlooked, sloughed off because their impact is considered insignificant or that we are not directly affected by them?  Below are some examples of the overlooked and understated risk issues that tend to become transparent to analysis until they are not.

Overlooked/Understated Risk Issues

• Senior Management Does Not Take Risk Management Seriously
• Regulatory Compliance is not Risk Management
• Distracted by Current Events – Failure to See the Long Scenario and Cascade Effects
• Lack of Strategic Foresight – the Failure of Risk Management
• Misdiagnosis of Risk
• Labor Resources Treated as a Cost Rather than as an Asset
• Over-Reliance on Process Optimization
• Failure to Identify Risk Beyond First Order Effects (Cascade Effects)
• Human Capital not considered in Contingency Planning
• Single Model for Managing Human Capital (Multi-Generational Workforce)
• Risk Created by Unhealthy Workplaces Largely Ignored by Senior Management.

The recent World Economic Forum publication “Global Risks 2020” provides some excellent examples of connecting the dots.  However, the WEF publication seemed to fall into the media driven moment, focusing on “Climate Action Failure” and “Extreme Weather” as heavily weighted risks, while “Infectious Diseases” merited the lowest weight rating.  Please note that “Pandemic” was not on the list of risks in the report of “Global Risks Interconnections Map 2020” (figure IV of the report).

Incomprehensive, Inconsistent, Over Optimistic

As we write this, the world is in the midst of a global pandemic (COVID19), experiencing unusual weather (wildfires, storms, earthquakes, global warming) and is threatened by geopolitical concerns (trade wars, localized conflicts, state sponsored cyberwarfare).

Are we overlooking the obvious?  We have seen inconsistent, incomprehensive decision making on the part of global leadership with the efforts to stem the effects of the COVID19 pandemic.  This has led to a lot of emotional finger pointing, loss of trust in our leaders at all levels and a general apathy toward the seriousness of the situation.  Leaders often appear to be wading in concrete, mired in confusion, implementing incomprehensive actions that often times do more harm than good.  The inconsistencies of leadership, at all levels, has led to frustration and, in some instances, refusal to comply with mandates that are controversial, ineffective and are so unenforceable (easily circumvented) that they are rendered useless.

Instabilities, Nonequilibrium and “Active Analysis” in Complex Systems

Risk, by its very nature, being non-static, creates instabilities and nonequilibrium in complex systems (touchpoints internal and external to an organization).  Add to this, human intervention in the form of active behavior and you begin to see that the traditional approaches to identifying, quantifying and protecting against risk realization become less flexible and more rigid when applied; thereby creating a false sense of mitigating risk (often thought of as eliminating risk) when in reality, risk has changed as a result of the mitigation effort.  “Active Analysis” is necessary to maintain a current perspective on risk mitigation (buffering) efforts.

Think of this much like the current situation with the coronavirus.  We are now getting reports of a new strain that appears to be easier to transmit from person to person.  And, this is happening just as vaccine distribution is beginning to rollout.  The question arises, “How effective will the current vaccines be against a mutated strain of the virus?”

An analysis of instabilities within complex touchpoints can result in the development of two planes, a plane of possibility and a plane of probability of risk realization.  The plane of possibility is infinite; from which the plane of probabilities emerges.  The graphic below depicts a hypothetical plane of probability (Siegel, D. 2018, “Aware: The Science and Practice of Presence”).

Three important aspects of creating a plane of probability are: 1) early detection of risk realization and potential impacts.  This allows for analysis where very precise measurements are not available or cannot be obtained due to the fluidity of a situation.  2) depending on the number of touchpoints and complexity of touchpoint connectivity, a variety of different scenarios can be developed to create a menu of risk buffering options.  3) even early instabilities can be identified, thus allowing a rather detailed analysis of potentially complicated/connected instability points that can lead to risk cascade effects should the risk be realized.

Below is a simple comparison, contrasting a rigid approach to risk assessment (left) and the reality of the undulating, unstable nature of risk in a dynamic environment (right).  Examples of the reality of risk instability and the cascade effect of risk being realized can be seen in today’s chaotic reaction to the COVID19 situation.  Currently, due to the identification of a new strain of the virus we are seeing immediate border closures, flight cancellations, alterations in trade and apprehension regarding the effectiveness of the currently approved vaccines to be effective against a more virulent emergent strain of the virus.  As it is too early to speculate on the implications of vaccine effectiveness or non-effectiveness the plane of possibility remains open and emerging rather than being buffered and mitigated.

However, are we too narrowly focused on the “risk of the day” that we are not seeing the emerging risks that are present and yet, remain unseen?

Conclusions

Risk taking is central to the functioning of any organization.  Excessive risk taking and a simultaneous decline in the risk absorption capacity of the organization can lead to catastrophic results (i.e., the financial system and financial crisis).  One can never achieve true certainty when assessing risk unless you reduce the probabilities to zero or one.  Opacity, that is, constant uncertainty and changing factors makes getting a clear picture of risk realities nearly impossible.  In order to overcome opacity, you need to constantly monitor the risk environment.  It’s all about targeted flexibility, the art of being prepared, rather than preparing for specific events.

Being able to respond rather than being able to forecast, facilitates early warning and proactive response to shifts in your market segment.  We live in a world full of consequences.  Our decisions need to be made with the most information available with the recognition that all decisions carry with them flaws due to our inability know everything.  Our focus should be on how our flawed decisions establish a context for flawed risk assessments, leading to flawed plans, resulting in flawed abilities to execute effectively.  If we change our thought processes from chasing symptoms and ignoring consequences to recognizing the limitations of decision making under uncertainty, we may find that the decisions we are making have more upside than downside.

We’re limited not by the amount of risk we can identify, but by how inventive we are about how we think about risk and how much we’re willing to do to buffer against risk realization.  Here are seven identified needs for today’s risk managers:

• Techniques for identifying permanent versus cyclical changes in the external operating environment,
• Techniques for spotting and buffering risks so that the organization has the ability to leverage risk management activities for competitive advantage,
• Tools for stimulating the creation of options, particularly where change is occurring rapidly and the scope for risk management action is shifting,
• Tools for stimulating the understanding of opaque risk forces that are truly dynamic, with multiple orders of consequence effects,
• Proven tools for improving strategy, risk management, business continuity and competitive intelligence processes, breaking inertia, and jolting conventional risk management thinking.
• Techniques for generating and harnessing insights from big data about risks that customers, competitors, and suppliers present to the organization,
• Techniques for identifying and focusing the top team’s attention on new or poorly understood risks—before it is too late and the risk materialize (risk realization).

Here are five factors affecting decision making under uncertainty:

• Interconnectedness: Opportunities for risk contagion (geographic, category, geopolitical);
• Asymmetry: Small events that can create disproportionate and unexpected effects;
• Time Compression: “Just in time” processes have little leeway with effects of risk realization being felt rapidly;
• “Noise”: Salient facts that are not noticed at the time of event (failure of critical thinking);
• Information Vetting: Misinformation or inadequately provided information that has not been properly validated can lead to greater risk exposure and skewed responses.

We will close with a quote from Alexander Hamilton, who lived from 1755-1804 and was the first U.S. Treasury Secretary.  Hamilton said: “A nation which can prefer disgrace to danger is prepared for a master, and deserves one.”  Will a failure to connect the dots and rethink risk and uncertainty lead to your demise?

BIOS:

Geary Sikich – Entrepreneur, consultant, author and business lecturer

Contact Information: E-mail: G.Sikich@att.net or gsikich@logicalmanagement.com.  Telephone: 1- 219-513-6244.

Geary Sikich is a seasoned risk management professional who advises private and public sector executives to develop risk buffering strategies to protect their asset base.  With a M.Ed. in Counseling and Guidance, Geary’s focus is human capital: what people think, who they are, what they need and how they communicate. With over 30 years in management consulting as a trusted advisor, crisis manager, senior executive and educator, Geary brings unprecedented value to clients worldwide.

Geary is well-versed in contingency planning, risk management, human resource development, “war gaming,” as well as competitive intelligence, issues analysis, global strategy and identification of transparent vulnerabilities.  Geary began his career as an officer in the U.S. Army after completing his BS in Criminology.  As a thought leader, Geary leverages his skills in client attraction and the tools of LinkedIn, social media and publishing to help executives in decision analysis, strategy development and risk buffering.  A well-known author, his books and articles are readily available on Amazon, Barnes & Noble and the Internet.

Sara Robertson, MSc (c) MCPM MCADT AMMS

After experiencing severe burnout in her former career in management at one of Canada’s 50 Best Managed Companies, Sara went on a mission to build a new life for herself and found a calling in teaching others that there is a better way to live and work.

In 2015 she founded LimeHorse, a professional education company – with a focus on the legal profession – offering online and in-person training in mindfulness, emotional intelligence, organizational development and peak performance.  She is a Faculty and Advisory Board Member of University of Toronto’s AMM-MIND program, Co-Chair of the Ontario Chapter and CLE planning task force member with the Mindfulness in Law Society and Performance Specialist at Mindful Gateway Consulting.  She is a regular contributor on Thrive Global’s special section on Overcoming Lawyer Burnout.  Sara is passionate about helping professionals build resilience and cultivate purposeful work.

Sara has worked in diverse environments such as academic, corporate, and professional sports.  Through MGC she has developed and delivered training for the Toronto Maple Leafs development camp and the Toronto Marlies.  She splits her free time between raising her young daughter, her many hobbies and volunteer commitments working with marginalized individuals.