Latest views from Alex Sidorenko on how “innovation”, lack of business acumen and consultants are killing modern risk management in non-financial organizations.
First there was science…
Some sources suggest probability theory started in gambling and maritime insurance. In both cases the science was primarily used to help people and companies make better decision and hence make money. Risk management used mathematical tools available at the time to quantify risk and their application was quite pragmatic.
Banks and investment funds started applying risk management and they too were using it to make better pricing and investment decisions and to make money. Risk management at the time was quite scientific. H. Markowitz, M. Miller, W. Sharpe won a Noble prize in 1990 for CAPM, a tool also used for risk management. This doesn’t mean risk management was always always accurate, just see the case of LTCM, but one thing for certain risk managers did apply the latest in probability theory and used quite sophisticated tools to help businesses make money (either by generating new cash flows or protecting existing ones).
Then risk management became art…
Then came the turn of non-financial companies and government entities. And that’s when risk management started becoming more of an art than science.
Some of the reasons behind the shift were arguably:
- Lack of reliable data to quantify risks (Douglas W. Hubbard in his books actually proved this to be not true). Today, there is literally no excuse for not quantifying risks in any type of an organization.
- Lack of demand from the business. Many non-financial organizations at the time were less sophisticated in terms of planning, budgeting and decision making. So many executives didn’t even ask risk managers to provide quantifiable risk analysis.
- Lack of qualified risk managers. As a result, many risk managers became “soft” and “cuddly”, not having the skills or background required to quantify risks and measure their impact on business objectives and decisions.
- This was fine for the time, it was part of the learning curve, I guess, and many of the non-financial companies quickly learned which risks to quantify and how. Other companies that failed to mature usually lost interest in risk management, or should I say, never saw the real value.
Today it’s just a mess…
What I am seeing today however is nothing short of remarkable
Instead of being pragmatic, simple and focused on making money, risk management moved into the “land of buzz-words”. If you are reading this and thinking: “Hold on, Alex, risk velocity is important, organizations should be risk resilient, risk management is about both opportunities and risks, risk appetite, capacity and tolerances should be quantified and discussed at the Board level and inherent risk is useful.” Congratulations! You may have lost touch with business reality and could be contributing to the problem.
I have grouped my thinking into four problem areas:
A. There is literally no link between modern science and business risk management
Today, even the most advanced non-financial organizations use the same risk management tools (decision trees, Monte Carlo, VaR, stress testing, scenario analysis) created in the 40s and the 60s. The latest research in forecasting, modeling uncertainty, risk quantification and neural networks is mainly ignored by majority of risk managers in non-financial sector.
Ironically, many organizations do use tools like Monte Carlo simulations (developed in 1946 by the way) for forecasting and research, but it’s not the risk manager who does that. Same can be said about the latest development in blockchain technology, arguably the best tool for transparent and accurate counter-party risk management. Yet pretty much ignored by risk managers.
It’s also been years since I last saw a scientist present at any risk management event sharing new ways or tools to quantify risks associated with business objectives. Same can be said about the overall poor quality of postgraduate research published in the field of risk management.
B. Modern risk management is detached from day to day business operations and decision making
Unless we are talking about not-for-profit or a government entity, the objective is simple – make money. And while making money every organization is faced with a lot of uncertainty. Luckily business has a range of tools to help deal with uncertainty, tools like business planning, sales forecasting, budgeting, investment analysis, performance management and so on.
Yet, instead of integrating into all of the above risk managers often choose to go they own separate way, create a parallel universe, specifically dedicated to risks (very naive I think). Some of the common examples include:
- Creating a risk management framework document instead of updating existing policies and procedures to be aligned with the overall principles of risk management in ISO31000:2009
- Conducting risk workshops instead of discussing risks during strategy setting or business planning meetings
- Performing separate risk assessments instead of calculating risks within the existing budget or financial or project models
- Creating risk mitigation plans instead of integrating risk mitigation into existing business plans and KPIs
- Reporting risk levels instead of reporting KPI@Risk, CF@Risk, Budget@Risk, Schedule@Risk
- Creating separate risk reports instead of integrating risk information into normal management reporting, and so on…
- Risk management has become an objective in itself. Executives in non-financial sector stoped, or maybe never have, viewed risk management as tool to make money. Risk managers don’t talk, many don’t even understand, business language or how decisions are being made in the organization. Risk analysis is often outdated and by the time risk managers capture it, important business decisions are long done.
C. Risk managers continue to ignore human nature
Despite the extensive research conducted by Noble-prize winners D.Kanehmman, A.Tversky and others, risk managers continue to use expert judgement, risk maps/matrices, probability x impact scales, surveys and workshops to capture and assess risks. These tools do not provide accurate results (mildly put), they never have and never will. Just stop using them. There are better tools for integrating risk analysis into decision making.
Building the culture of risk awareness is critical to any organization’s success, yet so few modern risk managers invest in it. Instead of doing risk workshops, risk managers should teach employees about risk perception, cognitive biases, fundamentals of ISO31000:2009 and how to integrate risk analysis into their day to day activities and decision making.
D. Risk managers are too busy chasing the unicorn
Instead of sticking to the basics and getting them to work, many are too busy chasing the latest “buzz words” and “innovations”. Remember, how “resilience” was a big thing few years ago, before that was the “emerging risks”, also “risk intelligence”, “agility”, “cyber risk”, the list goes on an on. It seems we are so busy finding the new enemy every year that we forgot to get the basics right.
Consultants lately seem to have too much say in how modern risk management evolves. Latest installment was the new COSO:ERM draft, created by PwC and published by COSO this June. And what a load of bullsh@t that was. The authors sure did “innovate”: among other “useful ideas”, they came up with a new way to capture risk profiles. Nice… if risk profiling was the objective of risk management. Sadly it is not. Risk profiling in any form does little to help executives and managers make risky decisions every day. For more feedback on COSO:ERM click here.
To be completely fair, the global team currently working on the update for the ISO31000:2009 also has a few consultants, who have very limited understanding about risk management application in day to day decisions and in helping organizations make money.
I think it’s time to get back to basics and turn risk management back into the tool to help make decisions and make money.
Interested to hear your thoughts, share, like and comment below.
RISK-ACADEMY guides and templates:
Check out other risk management books
RISK-ACADEMY offers online courses
Informed Risk Taking
Learn 15 practical steps on integrating risk management into decision making, business processes, organizational culture and other activities!
ISO31000 Integrating Risk Management
Alex Sidorenko, known for his risk management blog http://www.riskacademy.blog, has created a 25-step program to integrate risk management into decision making, core business processes and the overall culture of the organization.
Advanced Risk Governance
This course gives guidance, motivation, critical information, and practical case studies to move beyond traditional risk governance, helping ensure risk management is not a stand-alone process but a change driver for business.
I realize that English is a second or third language for you but if you are going to post in a non-native language, then you should probably have a native speaker proofread your work. I stopped counting at two dozen spelling errors and use of incorrect words; didn’t even bother with the punctuation issues. It really does damage your credibility and ability to deliver what is, otherwise, a good message.
Alan, it does absolutely nothing to my credibility as a good risk manager, only helps to identify people who are anal about things that don’t matter. Seriously I have zero tolerance for stupid comments like this. Found an error, message me directly with the fix, like the rest of good people out there
I just read your blog “Risk management used to be a science, then in became an art…” etc. I generally agree with your comments and critique of risk management practices. I can only add my opinion, for what its worth, based on several decades of experience that the exact same statements could be made about audit management, control management and compliance management. That takes nothing away from what you have written. But it is a systemic issue in my view and goes beyond risk. Keep up the good work.
Thank you. Agree
I fully concur. Risk management, audit and compliance are nice theories if they are not driven by the business knowledge and aligned to the achievement of business specific goals. No matter what business or industry. You are ultimately trying to influence decisions to improve business.
Great work. Very helpful.
Dear Alex, I have two observations: First, I never heard of an important cybersecurity incident having as a root cause a mistake in a risk assessment. Second, I have never found a risk assessment that is self correcting, in other words, it is possible to detect if an output is wrong. For both reasons I think risk assessments are irrelevant, as there are no consequences for getting them wrong. Or perhaps they are always correct? Who thinks that? There are alternatives to understand what needs to be done to improve cybersecurity without risk assessments.
I don’t understand how this relates to the post. You have a basic flaw in argument, just because you didn’t hear something doesn’t mean model risk doesn’t exist. Google model risk and be amazed what a huge issue bad risk assessments are globally. Then google back test and be amazed again how all good risk assessments are self correcting