Assessing Risk

My two most recent professional assignments, both undertaken and completed this year, have concerned 'risk'. The first was assessing at how well the major bank for whom I do a lot of my consultancy work manages its outsourcing arrangements, and particularly the wrapper of 'risk management' (I used the inverted commas advisedly) it puts around them. The second was assessing how well the same organisation's 'Three Lines of Defence' risk model works, whether some of its participants are in fact located in the right place from an organisational design point of view, and building consensus around a new risk operating model that I designed.

Well done if you're still reading, for that all sounds pretty dry, does it not? It probably is, but every time I come into contact with anything labelled 'risk' in my professional world, it convinces me more of two things: first, that while many people can effectively identify a 'risk', they can be quite bad at quantifying it, and even less effective assessing whether it's an acceptable risk to take when compared to the likely benefits that will accrue. Second, and this is more applicable to work situations than non-work circumstances, I see a lot of people who think that the application of a process to risk assessment will in and of itself mitigate the underlying risk, rather than any resultant action. This can be very dangerous, because it persuades people that a risk has been taken care of, and therefore that they can turn off their own critical faculties.

I should state now, lest you think that I'm some kind of Health & Safety nutter, that that's absolutely not the case. But nor am I some kind of rule- and circumstance-ignoring maverick. I find both extremes irritating; the former is the local authority that might decree, for example, that hanging baskets are no longer to be allowed on a high street because of the alleged risk they pose to passers-by, while the latter is the motorway driver who ploughs on at 70 mph even in thick fog or driving snow.  In one case, the miniscule level of risk is unjustifiably used as the reason for the removal of a great pleasure giver, and in the other the benefit of arriving at one's destination a few minutes earlier does not justify the hugely increased risk of driving inappropriately.

I guess both of those examples fall into the first of the two things I see at work - that people can be bad at quantifying risk and even worse at offsetting it against benefits or downsides. My second observation is more nuanced - that putting a process round risk assessment can actually worsen a situation. This came to light on the outsourcing work I did earlier this year - to cut a long story short one of the 'supplier management' processes that those managing the outsource in question had to adhere to was to ensure that the supplier had a business continuity plan in place, so that if they were hit with an unexpected event they could still provide the bank with the contracted service. The supplier managers ticked the appropriate boxes in every case, to indicate that yes, their suppliers did indeed have such a plan, and that they'd witnessed it with their own eyes. However, a few cases has arisen where suppliers had hit problems, and their service had been interrupted. Their business continuity plan had failed. When the inevitable inquest took place, it turned out, to put it simply, that because the internal process didn't require supplier managers to assess the likely effectiveness of that continuity plan, they hadn't done; as long as they did what the process said, they weren't going to get fired or disciplined, regardless of any detrimental business outcome. Crazy process, crazy design (and crazy reward system, but that's a different issue), because it allowed them not to have to think about the real risk.

Now, I'm not going to claim that my risk assessment abilities are perfect, or even very good. I've no idea really, But I know that I at least think about these things. Let's take two contrasting examples, one of which might paint me as a risk-averse paranoid, and the other as an idiot with a death wish. The former applies when I'm using the Tube in London, which I do a lot when I'm working there, and normally at rush hour. At those times, I'm acutely aware that it would only take one unhinged person to pick on me and push me in front of an oncoming train to end my life. The number of times it actually happens each year is thankfully minimal, but happen it does. So I never stand facing the track; I stand sideways at a platform end, so I can see everyone around me. And neither do I listen to music or take calls; I want my wits about me. The risk of the negative thing occurring might be very small, but the cost of me taking what I consider to be sensible precautions is very low to zero, so why wouldn't I?

By contrast, it's inherently a lot more risky, measured in terms of probability multiplied by effect, of me riding my bicycle down mountains quickly. All it would take is one small misjudgement by me or potentially others, or one unseen patch of gravel, and I would be off and probably seriously hurt. The odds of that happening are probably much higher than being pushed under a Tube train. But I take the chance. Why? Because I estimate the rewards to be great - the adrenalin, the rush, the feeling of needing to deploy skill and experience to stay well. Some might say my approach is inconsistent, but I'd argue not - it's logical to minimise even small risks if there's no cost to doing so, and it's equally logical to incur a degree of risk if the rewards are great.

These are things I'm not sure are well understood. That's certainly how I feel when I look at some of the reactions to where we currently are with Covid-19. Let's take the education unions' objections to schools re-opening next week. I'm going to assume good faith on their part rather than any political motive (perish the thought), and take their objections at face value. But let's look at the facts - for the children certainly, and probably most teachers under 40, the chances of catching the virus at all are increasingly slim, and the chances of any infection resulting in a serious case are very small. By contrast, the cost of having kids at home not being educated, the effect on their development, education and socialisation, and the opportunity cost of their parents having to find childcare, is very great. There is clearly a strong case for schools to return; the danger to children is negligible. I would have some sympathy with the unions' position if it were more nuanced. If I were an overweight male teacher in my late 50s - and especially if I had diabetes - I'd be quite worried about going back into school, and I'd expect both the education authority and my union to be working to protect me. But I've seen no hint from either side that they're differentiating like that between teaching staff - there's either a 'risk' or there isn't in their view, which is just not true. It's an unintelligent way of looking at risk.

Similarly, and on a wider scale, it was evident right from the start of the coronavirus episode that there were groups who were massively vulnerable, and others who weren't. But instead of isolating one group and encouraging the other to continue life as usual, but with some sensible precautions, we closed down and locked up whole economies on the basis of risk assessment, driven by apparently horribly flawed modelling. I'm getting into a different subject now, so I'll stop, but I think there's going to be a strong case to look at the decisions Japan took at the outset, and the risk assessments upon which they were based. My sense is - and this is the point of this post I suppose - that they approached their risk assessments, and the subsequent political decisions in a very much better way than lots of other countries, and we should learn from that.