Three key treasures of good risk management
The future of “Risk Management” would look brighter if we removed the word “Risk”. It is just “Management”. If “Risk” is “the effect of uncertainty on objectives”, Risk Management must be “managing the effect of uncertainty on objectives”. This is “Outcome Management”.
Business Management involves making decisions aimed at achieving business objectives. Outcome management is therefore just management.
The future success of risk management relies on making it an integral part of management. This will only happen if risk management provides the right incentives. Humans and hence organisations run by humans, respond to incentives. Read related article: '10 keys to Risk Management Success'.
Psychologists have discovered that when a person is handed an unexpectedly hot cup of coffee, they typically drop the cup if they perceive it to be inexpensive but manage to hang on if they believe the cup is valuable.
Risk Management is the coffee cup. Implementing risk management creates a degree of pain for the business. Will the business hold onto the cup through the period of pain or drop it? Which way the business goes will depend on their perception of value. As a result, low-value risk management will be dropped. There is no future. High-value risk management will be held onto and treasured.
I believe the key treasures of good risk management are:
Protection of stakeholders is critical. Unfortunately, on its own, the incentive is often not enough. It is like the parent who tells their child to wear a bike helmet as “You will get hurt if you fall off!” We all know it makes sense but, next time no helmet is to be seen. Why is this?
- Firstly, protection implies risk is bad. It will hurt you, create loss and pain.
- Secondly, there is the syndrome of “it won’t happen to me” so the pain of creating protection is wasted.
2. Supporting Opportunities
Let’s return to the child. If on the other hand, we say “if you wear your helmet you can ride to the shops and go over that large BMX bike jump” the child is more likely to respond positively. This is risk management being used in the pursuit of opportunity.
This became real for me in 1987 when I met a hanglider pilot who encouraged me to take up the sport. After a short risk assessment, it was clear the sport was very high risk as many pilots were dying. I perceived the risk as above my appetite and greater than the reward. I declined. Later I decided to do a more in-depth risk assessment and concluded that the main cause of accidents was pilot error. I considered ways that the risk could be reduced and developed a 44-point checklist (risk management). Watch the webinar recording 'Balancing Risk and Reward'.
After applying this, I concluded that revised level of risk was now below my risk appetite and below the reward. Rationally I was now able to do it and enjoyed 15 wonderful years of sustainable reward from flying. Risk management enabled me to fly!
"Great risk management enables a business to pursue opportunities by bringing the residual risk within appetite and below reward. The number one goal of risk management is therefore, “Sustainable Reward”.
3. Decision Making
This leads me to what I see as the ultimate future of risk management, decision-making. The decision-making process of many organisations is unstructured, informal, undocumented and open to the many human influences such as anchored and biased thinking. To make better decisions, we need a more structured, rational, data-rich and transparent processes.
A simple base for good decision-making is:
- Identify the objectives of the decision.
- What is the level of expected achievement (reward) from the decision?
- What are the risks in the decision, what are their level and are they a threat or opportunity?
- Evaluate the level of threat risk against risk appetite. Where the risks are not within appetite, reject the decision.
- If the threat risk levels are within appetite, compare the expected reward against the expected risks. If the rewards exceed the risks, accept the decision. Where the rewards are below the risks, reject the decision.
The future of risk management lies in supporting this process by:
- Identifying the key risks in the decision.
- Assessing and updating the level of risk.
- Measuring the risks.
This demands a big improvement in risk management’s current capabilities including:
- Moving towards a “real-time” view/profile of risk using all available data. This demands a move to continuous monitoring of data.
- Creating a richer and informed assessment of risk using the large volumes of data that are becoming available. The move to automation of everything will provide a much richer digital footprint of risk.
- A need to be able to “see” across the whole life of a decision, and understand what could happen and the likelihood of that happening. Predictive analytics will be key and will move risk management from reactive to proactive.
- A move towards Artificial Intelligence and Machine Learning as we program our machines to make better risk/reward decisions.
A healthy future for risk management will occur when it is used in proactive decision making. Ultimately the greatest measure of success is when the word “Risk” is removed from “Risk Management”.
This article was originally published by RMIA in The Risk Magazine March Edition.