by James Bone
Social media sites dedicated to risk, audit, governance and compliance have become a hot bed for debating a host of topics related to the proper role of risk management. There is no shortage of opinion leaders who offer their risk framework,definition or standardfor the “proper” risk management program. This debate is emblematic of the growth and importance risk management plays in addressing real challenges in a cross section of industries today. The diversity and breath of these discussions is a healthy sign of the future of risk management yet there is universal agreement that more needs to be done.
reputational compliance
Ask risk managers to provide a succinct definition of risk and you are bound to get as many different responses as respondents to this question. This is not surprising given the proliferation of groups that have sprung up over the last 15 years dedicated to organizing risk professionals into associations by industry, expertise, educational background, and roles. In the process of forming specialty risk associations the need to define risk has tended to, over time, move the practice of risk management further away from the original definition established by a long line of Nobel Laureates who created risk management out of economic theory.
Definitions form the lexicon of all professional groupsby directing its activities to address those things defined within its purview of responsibility. Building on Adam Smith’s “The Wealth of Nations” a long trail of economic theory developed. Economist Frank H. Knight (1885–1972), who is commonly credited with defining the distinction between decisions under “risk” (known chance) and decisions under “uncertainty” (unmeasurable probability) in his 1921 book,Risk, Uncertainty and Profit. Economist Herbert A. Simon redefined the rational man theory and introduced a new definition of “bounded rationality” recognizing the limits of decision making in real world corporate America. And Dan Kahneman and Amos Tversky introduced “prospect theory” which defines how we take short cuts (use heuristics) when making decisions under uncertain conditions.
The opportunity for a new era in risk management lies in bridging today’s diverse perspectives in risk management with the extensive foundation established by past and current Nobel Laureates on this subject. What are the main differences and similarities of the 19th and 21st century risk thinkers? For one, risk management evolved out of separate branches of research focused on a common problem. The theory of the corporation, its actors and the interaction of the two with the markets required a multidisciplinary approach to explain the complexity of the inputs and outputs associated with the new industrial age confronting America.
21st century risk thinkers are faced with an equally traumatic shift in how commerce is conducted as the interface between the old economy and a new internet based economy emerges creating new challenges for almost every industry attempting to understand how to embrace these new tools for future growth. 21st century risk managers have defined risk in terms of specific problem sets driven largely by regulation but also defined by the objectives of each industry and organization. Today’s risk manager is equally diverse in education, expertise and discipline ranging from former physicists, mathematicians and computer scientists to generalists. Risk managers have evolved in response to these new challenges and created new tools to manage risk. Yet, can we say that we understand risk and uncertainty better today than our forefathers? In some ways the answer is yes, but it doesn’t explain the excessive risks banks and mortgage originators took resulting in the Great Recession. It doesn’t explain the current corporate risk failures that occur with increasing frequency and magnitude to our economy and the people whose livelihood depend on getting it right.
What is the “bridge” or common denominator between the Nobel Laureates and today’s risk manager? I am convinced it is a refocus on decision-making in corporations. The one common denominator is people. What Herbert A. Simon called “information processing”. The demands on today’s executives prevent the examination of all relevant facts, alternative choices, and consequences of decision leading to simplification in the face of uncertain outcomes for each decision. In fact, today’s risk manager may be too focused on risk at the expense of understanding uncertainty.
Using Frank Knight’s definition of “known chance”, corporations have chosen to direct most of its resources tomeasure risk and not manage it. In my experience these “risks” are not risks at all but instead represent a lack of clarity or the will to decide what must be done to address them. Whether it’s under-investment in training, controls, people or systems inefficiency is characterized by these unresolved “risks”. As rational beings, managers focus on those activities that realize profits forgoing the opportunity cost of these risks. While this may seem logical, failure to address these issues leads to legacy problems that build over years into interrelated exposures that compound failure when the right circumstances occur.
Many argue that you cannot deal with uncertainty and say there are not enough hours in the day to analyze every eventuality. It is precisely this problem that will be the impetus to rethink risk management with the change already under way. Decision support systems are in their infancy in providing senior management with actionable data from across organizations. New data visualization and simulation software is being developed daily. The 22nd century risk manager will help design these intelligent systems based on his/her organizational goals and objectives. This intelligent design will be incorporated into production systems, customer applications, accounting systems and human resource management allowing management to focus on choosing from a range of optimal outcomes.
Risk and uncertainty will not be eliminated; however, risk managers and corporate leaders will be better prepared to take action in the event of the realization of the risk event or uncertain outcome. This is not some futuristic fantasy! Advancements in robotics, artificial intelligence, and decision support software are already being used to inform how we work, decisions we make and our view of risk. You see it happening around us today and this will accelerate in the next 5 – 10 years. I am convinced that by bridging cognitive decision theory with intelligent implementation of technology we elevate the role of risk manager.
This article was written by James Bone and originally published on corporatecomplianceinsights
