Douglas W. Hubbard - The Failure of Risk Management

The last two objectives—to get managers to quit using ineffectual methods and start them on a better path—are also satisfied by a just-technical-enough approach to the problem. This book won't make most managers masters of more quantitative and scientific methods of risk management. I merely want to convince them to make a radical change in direction from the methods they are most likely using now.

To accomplish these objectives, the remainder of this book is divided along the lines implied by the title:

Part One: An Introduction to the Crisis: This first chapter introduced the problem and its seriousness. Chapter 2outlines the diversity of approaches to assess and mitigate risks and discusses how managers rate their own firms in these areas. Chapter 3examines how we should evaluate risk management methods. Chapter 4will show a simple “straw man” that can be the basis for developing a fully quantitative model. (This will also provide a way to imagine an alternative to current risk management methods as we go through a long and detailed criticism of them.)

Part Two: Why It's Broken: After an introduction to four basic schools of thought about risk management, we will discuss the confusing differences in basic terminology among different areas of risk management. Then we will introduce several sources of fundamental errors in popular methods that remain unaddressed. We will list several fallacies that keep some from adopting better methods. Finally, this part of the book will outline some significant problems with even the most quantitative methods being used.

Part Three: How to Fix It: This final part will introduce methods for addressing each of the previously discussed sources of error in risk management methods. We will build on the basic straw man model introduced in chapter 4. We will discuss the basic concepts behind better methods, including how to think about probabilities and how to introduce scientific methods and measurements into risk management. Finally, we will talk about some of the issues involved in creating a culture in organizations and governments that would facilitate and incentivize better risk management.

Throughout this book, I will offer those who require more hands-on examples sample spreadsheets on this book's website at www.howtomeasureanything.com/riskmanagement. Those who prefer the 10,000-foot view can still get a good idea of the issues without feeling dragged down by some technical details, whereas those who prefer to get more information can get specific example calculations. The website will also give all readers access to evolving risks, new ideas and a community of other professionals interested in commenting on those.

See this book's website at www.howtomeasureanything.com/riskmanagementfor detailed examples from the book, discussion groups, and up-to-date news on risk management.

1 1. My use of placebo effect requires a qualification. The placebo effect in medicine is the tendency among patients to experience both subjective and, in some cases, objectively observable improvements in health after receiving treatment that should be inert. This is a purely psychological effect but the improvements could be in objectively measurable ways—such as reducing blood pressure or cholesterol. However, when I refer to a placebo effect, I mean that there literally is no improvement other than the subjective impression of an improvement.

2 2. Capt. A. C. Haynes, “United 232: Coping with the ‘One-in-a-Billion’ Loss of All Flight Controls,” Accident Prevention 48, June 1991.

People who don't take risks generally make about two big mistakes a year. People who do take risks generally make about two big mistakes a year .

—PETER DRUCKER

Before we start changing any system, it's a good idea to get a reading on its current state and to figure out how it got that way. Risk management is a very old idea that has changed dramatically just in the past few decades.

The history of any idea brings its own baggage that often limits our current thinking on the concept and risk management is no exception. Institutions evolve, standards are codified, and professions mature in such a way that it causes all of us to think in more limited ways than we need to. So before we consider the current state, let's see how we got here.

Organizational risk management could be said to have existed at least as early as the first time a king or chieftain decided to fortify walls, make security alliances, or store extra provisions in case of famine. Even more formalized risk management by agreement among parties seems to be a feature of the earliest civilizations. Since ancient Babylon, traders managed the risks of transporting goods great distances by having the buyers provide loans to the sellers that would be repaid with interest only when the goods arrived safely. The Code of Hammurabi by the Babylonian king of that name provided certain compensations or indemnifications for those harmed by bandits or floods. Babylon was also the birthplace of banking, where lenders managed risks starting with the careful selection of debtors.

But throughout most of human history, risk management was an unguided mitigation of risks. Choosing what risks to prepare for was always a matter of gut feel. What differentiates risk management since the start of the Age of Enlightenment is a more systematic approach to assessing the risk. The development of probability theory and statistics in the seventeenth century enabled risk to be quantified in a meaningful way. However, the typical context of these mathematical investigations were well-defined games of chance. These powerful new tools would be adopted only in select industries for select applications and, even then, only slowly.

From the eighteenth century to the beginning of the twentieth century, the quantitative assessment of risk was exemplified in—and largely limited to—insurance and banking. Although the term actuary predates even probability theory, it was not until the mid-nineteenth century that actuaries became an established profession with accreditation requirements and their methods had risen to earn the title of actuarial science .

Later in that period, we see quantitative risk analysis applied to financial markets and perhaps certain government agencies dealing with public health. Still, until the mid-twentieth century, the idea of a retailer or manufacturer using similar methods to assess risk in operations, new products, marketing campaigns, or major acquisitions was not seriously considered. For this reason, the executives in many firms may have treated risk management as synonymous with insurance or making sure the simplest and most obvious precautions are taken (and many still do today). At most, it was effectively a checklist approach in, for example, areas where safety was a key driver (aviation, mining, etc.).

By the 1960s, new methods and tools were being adopted by professionals outside of traditional insurance: engineers and economists. The emergence of computers and the ability to generate thousands of random scenarios with quantitative models made it possible to do the math with uncertain inputs. Engineers in nuclear power and oil and gas were among the first to adopt methods like this outside of insurance. Economists were influenced more by mathematical fields of game theory and decision theory, which provided for the mathematical description of common decision problems, especially decisions under uncertainty. The methods of engineers and economists were both connected to the fundamental ideas of probability theory, and they were largely developed in isolation from actuarial science.