Risk of not facing risk

A lot has been said about risk and how it was or was not managed in the aftermath of the sub-prime mortgage failures. This discussion has centered on risk management in terms of financial risk - the risk due to market positions where a loss or profit can be made from something occuring or not.

The "mistakes" made that have brought about the Global Financial Crisis are specific to this time and relate to a financial system that does not exists in the same form anymore. However, the human behaviour that has made these obvious errors is still inherent in us and has a role to play in every endeavour and every project.

Humans are risk adverse. This is a valuable survival mechanism. It is a trait that is effective in addressing the immediate concerns of an individual. However since what is good for the many may not be good for the few or the one, it is a trait that often serves leaders poorly when addressing matters of those they lead. In the extreme, it is a trait that has destroyed civilisations from its most damaging effect - the tendency to overlook matters that are in the future.

Managing risk involves risk

A risk owner must balance their investment in risk management. The options to mitigate, monitor and/or develop response strategies all involve organisational capacity and increase the cost of delivery. Unfortunately, successful risk management means that nothing may happen. This is a difficult outcome to value. It is also an outcome that raises questions about the validity of the decisions taken to invest in risk management.

Performing risk management is therefore a risk - a personal and immediate risk. The risks to be managed are usually impersonal and rarely immediate. The result is that without processes to avoid it, human behaviour takes over and drives three typical responses:

1. It's someone else's problem
   
   In a formal and active risk management culture, a recognised risk is avoided through informally considering the risk as part of some else's scope. The informal transfer leaves the nominated risk owner completely unaware.



2. Head in the sand
   
   Regardless of whether or not a formal risk management framework exists, specific or even entire categories of risk are inappropriately set low likelihoods or ignored altogether.



3. Kill the messenger
   
   Irrespective of the policy and procedure insisting that risk be raised and analysed, the desire to avoid addressing what may be obvious leaves the risk unmanaged. Eventually, the proverbial 'elephant in the room' is identified by a team member, who subsequently is tarnished as the cause for all the resultig costs of the risk management.

A risk managed is a risk minimised, yet this not what human behaviour responds to. Instead of lowering stress from the rational evaluation that the risk is now minimised, a risk managed provides additional stress through the role playing of the negative outcomes of the risk.

Everything about corporate and project risk management is counter-intuitive on a personal level

Too often the process relies on the experience of the team or key people. Ironically, the people with the experience of managing the negative outcomes of risks, or in other words the people who had not managed the risk in the first place are often valued more highly than those who managed the risk. The reason? Nothing of note happened in the project where the risks where managed - with the notable exception of trouble-free projects.

Certainly, the experience of the team and its key people is important. However, having an experienced team is not synonyous to risk management. All the experience of the western financial system did not stop the GFC from happening. Time will tell if it assisted in minimising the impact, but the cost would have been far less had a response strategy been in place or mitigation in the form of the subsequently established regulation.

The most damaging impact of not truly managing risk is the poor metrics for project costing and the resulting impact to the decision processes. The over-inflated costs impact the benefit-cost-ratio and prevents viable projects from proceeding. Unfortunately, as the poor risk management persists in the delivery of the projects that survive, the whole process becomes self-justified.

The risk or not facing risk is the loss of opportunity. The projects do not progress, there are social impacts from the services delayed and considerable time is wasted in addressing negative outcomes that need never have occurred.