Risk management – intelligent decision making in a complex world

Following a crisis like Covid-19, it’s easy to think that risk management is just a distraction: after all, it didn’t stop the virus did it? In truth, nothing could be further from the truth. Many, if not all, of governments’ actions during the pandemic have been driven by risk-based thinking, and particularly by the trade-offs that need to be made between individual risks. For instance, we have had to decide between the need to protect public health and the need to protect jobs and the economy. Ultimately, a false step in either area could have serious impacts on our overall well-being, both individually and as a society.

It’s at times like these, particularly, that risk management really matters.

Decision making and risk

Risk management helps us to understand and influence what might happen. It follows that risk management is really all about effective decision making. This requires both discipline and knowledge. So, it needs the right people to make each decision and at the right time. It needs a good knowledge of each problem and why the decision is needed.

Moreover, it needs reliable, complete, timely and accurate information, plus insight from different perspectives, together with an understanding of cognitive bias. Alternatives need to be identified and the potential for harm or for reward weighed up. Finally, decisions need to be communicated in a way that is easily understood and makes sense to recipients.

So, both at times of disruption and during ‘business as usual’ as well, it’s really important to consider all the risks, and work to achieve the right balance between them. After all, nothing in life is entirely risk free. What matters most, though, is to take appropriate actions, keeping in mind that dealing with one risk might inadvertently impact on another. 

Complexity and interconnections

Risk management often sounds quite mechanistic in nature. After all, it’s about ‘engineering’ solutions to easily discernible problems, isn’t it? Consider, for a moment, the firm that chooses to buy in new designs, rather than invest in its’ own R&D. Whilst saving money in the short term, such a strategy would ultimately damage its long-term growth opportunities. Life isn’t always simple......

Mechanistic approaches work well in situations with high stability and low complexity. However, they are less effective in today’s world, where global competition and new technologies make all organisations more complex and less predictable. Leaders need to acknowledge this inherent complexity.

Many recent events weren’t predicted despite sophisticated AI tools. The algorithms didn’t predict Trump, Brexit or Covid-19: Google is sometimes wrong. Today’s technology may be the most advanced the world has ever seen, but it can be imperfect. AI trusts correlations that may turn out to be irrelevant or selective. The truth is the world is infinitely more complex than we often think. Leaders must therefore learn to acknowledge the uncertainty and complexity of business problems and so address them indirectly. In a complex system, interactions may reshape the entire system, leading to evolution in often hard to predict ways.

To see how this works in practice, consider corporate culture. Culture is an outcome of the behaviours of employees, rather than what their leaders want it to be. Executives are able to influence culture only indirectly by setting examples, providing incentives and amplifying the right behaviours. Unlike production activities, which can be engineered by command, culture cannot be directly controlled by managers.

To take another example, whilst the Covid-19 pandemic started as a health risk in China, it has had a great impact on the objectives of all organisations all around the world, increasing exposure to not just personal safety, but also economic security, supply chain risk, cyber security, morale, fraud, and much more besides.

As the physicist Fritjof Capra once said, “The more we study the major problems of our time, the more we come to realise that they cannot be understood in isolation. They are frequently interconnected and interdependent.”

All organisations, therefore, need to map and understand the interconnectedness of risk. Scenario planning can help, as well as simulation exercises to walk through how risks might unfold. Bow-tie analysis is also invaluable, helping executives to think beyond proximate causes to root causes, and beyond immediate impacts to potentially broader ones.

Enterprise-wide thinking

Organisations, therefore, cannot manage risks in isolation. They need an enterprise-wide view that recognises the interconnections between risks. That requires both a top-down approach that considers objectives and the risks to them, as well as a bottom-up approach that looks at the details of each risk. Good risk management brings together detailed risk quantification with creative thinking on risk and its potential impact.

Organisations need to see the intricate relationships of objectives, risks and the organisation’s own ecosystem. Business today operates in almost a world of chaos. In chaos theory, the “butterfly effect” means that something as simple as the flutter of a butterfly’s wings in the UK can create tiny changes in the atmosphere that may ultimately impact the development and path of a typhoon in Japan. A small event develops into what becomes a major issue.

Likewise, Apple’s iPhone may be designed in California, but it contains parts from Ireland, the Philippines, China, Japan, Austria, Thailand, Puerto Rico, Vietnam, Morocco, Malta and fourteen other countries. Just think of the complexity in that supply chain.

The years of simplicity in business are long gone. Rapid growth in technology, social expectations, environmental awareness, legislation, globalisation, supply chain business data and more, have changed the world for us all. Keeping business strategy, risk management, complexity and change in step is therefore one of the great management issues of the day.

IIRSM Managing Risk courses

IIRSM’s ‘Managing Risk’ courses cover the issues discussed in this article, placing risk management in a real business context. Available both as a one-day classroom-based programme and as a two 2 two-hour online course. For more information and to book please click here.