Exploiting Future Uncertainty

Creating Value from Risk

David Hillson

• Publisher: Routledge
• Year: 2017
• Print ISBN: 9781138465688
• eBook ISBN: 9781351937696
• Topic: Business
• Subtopic: Business General
• Index: Business

Whatever the future holds, one thing is sure: nothing is certain except uncertainty. Prediction is always hard, especially about the future, but the biggest risk is not taking any risk at all. All businesses face significant levels of uncertainty these days. To succeed you need to exploit future uncertainty, turning it to your advantage by managing risk effectively. This book shows you how. In his role as The Risk Doctor, international risk consultant Dr David Hillson has advised many major organisations across the globe, showing them how to create value from risk. Now you can benefit from his unique approach and insights. Exploiting Future Uncertainty contains more than sixty focused briefings, each addressing a key part of the risk challenge. Using five themes, David covers the links between better business and risk-taking, basic risk concepts, making risk management work in practice, people aspects, and managing risk in the wider world. Each section is packed with clear practical advice with specific how-to tips and guidance. David Hillson is one of the most influential writers and consultants on risk and in Exploiting Future Uncertainty he offers his prescription for effective risk management in 21st Century businesses.

1
Risk Management and Better Business

The Long View Back

The earliest records of human history and prehistory include stories of risk and its management. If we take a long view back, we find historical documents, sacred writings, myths and legends – all telling tales of the human struggle against nature, the gods or the odds. Accounts of mankind's earliest origins describe the urge to break boundaries, to go beyond current confines, to explore the unknown.

Narratives describe risk-taking individuals ranging from Abraham, revered by three of the world's great religions for his faith in leaving home and setting out to find a new country, through mythological heroes like Jason or Odysseus who undertook epic journeys, to modern entrepreneurs and innovators who change the lives of millions through ground-breaking discoveries and inventions.

The world we inhabit is unpredictable, strange, incomprehensible, surprising, mysterious, awesome, different, other.

The broader sweep of human development has included risky phases as hunter-gatherers and agrarians, leading to the establishment of great civilisations like Egypt or the Mayans, to the present day.

Seen from a certain perspective, risk is everywhere. The world we inhabit is unpredictable, strange, incomprehensible, surprising, mysterious, awesome, different, other. This is true from the macro level of galaxies to the exotic nano-realm of subatomic particles, and everywhere in between. Irrefutable evidence forces people to accept the truth that we neither know nor understand everything, and we cannot control everything.

Consequently, the word "risk" has become a common and widely used part of today's vocabulary, relating to personal circumstances (health, pensions, insurance, investments etc), society (terrorism, economic performance, food safety etc), and business (corporate governance, strategy, business continuity etc).

And it seems that mankind has an insatiable desire to confront risk and attempt to manage it proactively. Many of the institutions of human society and culture could be viewed as frameworks constructed to address uncertainty, including politics, religion, philosophy, technology, laws, ethics and morality.

Each of these tries to impose structure on the world as it is experienced, limiting variation where that is possible, and explaining residual uncertainty where control is not feasible. Sense-making appears to be an innate human faculty, seeking patterns in apparent randomness. People apply a variety of approaches, both overtly and subconsciously, to reach an acceptable degree of comfort in the face of uncertainty.

Many institutions of human society and culture could be viewed as frameworks constructed to address uncertainty, including politics, religion, philosophy, technology, laws, ethics and morality.

As a result, not only is risk everywhere, but so is risk management. Perhaps it is not too far-fetched to describe risk management as offering an integrative framework for understanding many parts of the human experience, if not all. Just as the presence of risk is recognised and accepted as inevitable and unavoidable in every field of human endeavour, so there is a matching drive to address risk as far as possible. This has led to a proliferation of areas where the phrase "risk management" is used to describe efforts to identify, understand and respond to risk, particularly in various aspects of business.

There seems little doubt that risk management has been part of human activity for a very long time, and it is today a vital component of business. As a result anyone asking the simple question, "What is risk management?" will not find a simple answer. Even the most cursory exploration reveals a huge variety of differing perspectives, all claiming to represent the best way to address risk.

In fact risk management is not a single subject at all; it is a family of related topics. These business applications range from project and technical risk management through operational and financial risk management up to strategic and enterprise-wide risk management. Other disciplines could also be included under the risk management umbrella, such as health and safety, business continuity, or corporate governance.

There are many common elements shared by these different types of risk management, but each has its own distinctive language, methodology, tools and techniques. They vary in scope from the broadest application to very specific areas of risk. They are at different levels of maturity, with some types of risk management being quite recent developments while others measure their history in decades or longer. But each is important in its own way, representing part of the response of business to the uncertain environment within which it operates.

All of this leads to one essential question: If risk is everywhere and risk management is so important, why don't we do it for our business? We are constantly confronted with business failures and in the rare cases where post-mortem reviews are held afterwards, causes of failure often include unforeseen-but-foreseeable risks.

Threats that should have been spotted and tackled turn into avoidable problems, and opportunities to create additional value or minimise waste and rework are missed. This continuing catalogue of failure indicates an ongoing lack of effective risk management. If we believe that our uncertain world can be managed proactively, then we need to find and address the missing critical success factors that are preventing risk management from delivering its promised benefits.

Mankind has always faced risk, from our earliest beginnings and throughout our history. Our survival and success as a species has largely resulted from our ability to understand and manage our uncertain environment, rising to each new challenge and adapting our behaviour to meet it. Perhaps we need to apply the same approach to how we manage the risks inherent in our business.

Opportunity Knocks

What is risk? And what impact does it have on your business? The simplest definition is that risk is "an uncertainty that matters because it could affect your objectives." The traditional position was that this referred always and only to negative things. After much hot debate, a new view has emerged.

Defining risk the old way, as "an uncertainty that could have an adverse effect leading to loss, harm or damage," limited the scope of the risk management process, which aims to avoid or minimise potential problems by acting proactively. It's true that by this yardstick traditional risk management has been very successful, and is now seen as a major contributor towards achieving business and project objectives.

However, using the risk process to deal only with the downside of uncertainty is an inevitable one-way street. If the process identifies only threats that could have an adverse effect, then responses designed to address these threats can only at best bring the performance back on target. It is much more likely that recovery of any deviation will be partial at best, leaving a shortfall in performance.

The realisation that threat-focused risk management only offers damage limitation has led to consideration of upside or positive risk – those uncertainties that could bring additional benefits if they were to occur – also known as "opportunities".

The definition of opportunity as "an uncertainty that could have a positive effect leading to benefits or rewards" is very similar to the traditional definition of "risk". In fact opportunity could be seen as just another form of risk: a risk with negative impacts is a threat, whereas a risk with a positive impact is an opportunity.

One side of the risk definition debate has concluded that risk should include both threat and opportunity, and that risk management should also address both types of uncertainty, seeking to minimise threats and maximise opportunities. This perspective is being reflected increasingly in risk management standards and professional guidelines, as well as in the practice of leading organisations.

So is opportunity just the flip side of threat? A standard examination question for medical students states, " Health is not the absence of disease: discuss." In the same way that peace is not the absence of war, or happiness is not the absence of sadness, it is also true that opportunity is not the absence of threat.

Of course, some opportunities are created when threats are removed (if staff do not take industrial action we could introduce an incentive scheme), and other opportunities are simply the inverse of related threats (instead of productivity being lower than planned, it might be higher). But there are also "pure opportunities" unrelated to threats: imcertain events or circumstances that would produce real additional benefits, if they could be captured proactively and exploited.

As well as identifying and addressing threats, it is equally important to seek and maximise opportunities, in order to optimise achievement of objectives: the opportunity to improve on your original plan by working "faster, smarter, cheaper" or the opportunity to reap significant unexpected rewards.

Better Safe Than Sorry? You Can Be Too Careful

Whenever we face a risk, one of the biggest challenges is deciding what to do about it, if anything. This is not a simple matter. A wide range of influences affect how we respond to a risk. There are physiological factors relating to the "flight, fright or freeze" reaction. There are subconscious sources of bias arising from previous experience and internal frames of reference. And of course there are various measurable criteria that we can use to make a rational assessment of the situation.

One factor that is not often considered is the role of cultural norms of behaviour. These are often embodied in the popular sayings and proverbs that we all learn from our childhood. And while they often capture a great deal of learned wisdom and experience, some of these proverbs are misleading and can result in an inappropriate response.

In the context of managing risk, one of the most unhelpful sayings is the assurance that, "What you don't know can't hurt you." Many businessmen and project teams know only too well that this is far from the truth, and the archetypal unpredictable "Black Swan" events (popularised by Nassim Nicholas Taleb in his book "The Black Swan: The impact of the highly improbable") prove that unforeseen events can have a devastating impact if and when they happen.

Another proverb defines a common approach to managing risk that has shaped public and professional attitudes to risk in many ways. We've all heard the saying, "It's better to be safe than to be sorry." This sentiment has a more formal manifestation in a concept that affects a wide range of areas, including government policy, health and safety legislation, environmental standards, business regulatory frameworks, child protection practice, and even parenting guidelines. "Better safe than sorry" is also known as the precautionary principle.

The precautionary principle states that where there is a threat of severe or irreversible harm, and if there is no proof that harm would not result, it is better to take protective action. Decisions are then made to protect the public or the environment from the severe harm that might occur. Examples include reactions to the supposed but unproven "dangers" of genetically modified food, mobile phones or nanotechnology. We also hear tales of local authorities banning Christmas lights or hanging baskets "just in case" they fall on someone, or requiring schoolchildren to wear protective goggles when playing conkers.

The problem with the precautionary principle is that it leads to an over protective approach, wasting too much time and effort on things that might not ever be a problem. It can also lead the discipline of risk management into disrepute. When one of my friends learned I was a risk specialist, she got very cross about "silly rules at work" imposed by the "risk police" that mean she can't leave her handbag under her desk "just in case" someone trips on it.

The precautionary principle arises from a focus on one of the two main dimensions of risk to the detriment of another. It comes from concentrating on impact (what would happen if the risk occurred) but ignoring probability (how likely the risk is to occur at all). This is partly because the impact of a risk is easy to estimate or describe, whereas probability is a hard concept, especially where we have no relevant previous experience of this or a similar risk. We also discount probability because people generally are afraid of statistics. (Probability is a subject we will come back to in more detail in Chapter 3 of this book, which covers the practical application of the risk process.) But ultimately the precautionary principle simply reflects the "public wisdom" embodied in the proverb whereby we all know it is "Better to be safe than to be sorry."

How does the precautionary principle relate to business? We constantly encounter risks in all our projects and businesses, and many of these are novel with no previous history or track record to guide us in how to respond. As in public life, the temptation is to exercise caution, preferring safety "just in case", leading to an unnecessary overreaction to risks and a waste of valuable time and resources that could be better used elsewhere. Then when nothing happens and the risks that we all worried about never materialise, people say that risk management is just a lot of fuss about nothing.

In terms of public policy, the value of the precautionary principle is being challenged. A UK House of Lords enquiry even recommended that it should be dropped as an unhelpful influence, even though European law requires governments to take it into account when forming policy.

In business too, we should question whether "better safe than sorry" is the right approach. A few simple steps can help us to counter the tendency to be overprotective. For example:

• We should ensure that our risk process includes a realistic assessment of how likely a risk is to occur, as well as an estimate of its possible effect.
• We need to recognise that the worst-case level of impact almost never happens, and perhaps it would be better to develop responses that target the most likely impact.
• We must remember tha...

Table of contents

• Cover
• Half Title
• Copyright
• Title
• Contents
• PROLOGUE
• INTRODUCTION: WHAT'S NEW?
• CHAPTER 1: RISK MANAGEMENT AND BETTER BUSINESS
• CHAPTER 2: RISK CONCEPTS
• CHAPTER 3: MAKING IT HAPPEN – RISK MANAGEMENT IN PRACTICE
• CHAPTER 4: THE P-FACTOR – PEOPLE
• CHAPTER 5: THE WIDER WORLD
• CONCLUSION: OVER TO YOU
• EPILOGUE
• ABOUT THE AUTHOR
• USEFUL REFERENCES
• INDEX