A while ago I planned to take the last aeroplane of the evening to fly out for a client meeting the next day. Unfortunately the plane was cancelled and I had to miss the meeting. On speaking to the client, he said dryly: “But you are supposed to be a risk manager!”
I smiled but did not respond. However, as he was saying this (and indeed well before in anticipation), the following thoughts went through my head: First, the reason that I planned to take the last plane was that the client was particularly unwilling to pay my normal charge out rate, and after protracted negotiations we had just about come to a satisfactory solution. As a result to make the whole situation worthwhile, I had to do a full day’s chargeable work on the day before visiting the client. Second, in any case the only way of guaranteeing with close to 100% certainty that I would have been at the meeting would have been to take a flight two days earlier, and lose even more productive work time. Third, the client and I had prepared well for the meeting in advance, and he was well able to represent our joint project to his colleagues without my presence.
In other words, risk management is not really about risk elimination at all costs, but rather about balancing the costs of risk mitigation (e.g. high cost associated with travelling to a meeting two days early) with the consequences if risks materialise (costs associated with my not being at the meeting). Effective risk management is about finding the optimal balance between these. Even if all risks could be eliminated, generally doing so would be too costly.
In many everyday situations, we already optimise our actions to reflect this balance. When crossing the road, we look both ways, perhaps several times (an action which costs little but reduces the probability of an accident), but we do not build a bridge (an action that could eliminate the risk, but only at great cost). We intuitively find the optimum point and accept residual risk. More formally one can approach optimisation problems by building quantitative risk models (e.g. using Monte Carlo simulation or decision tree analysis). Often such analysis is most easily implemented by the use of risk software such as @RISK, PrecisionTree or RISKOptimizer (which uses a genetic algorithm to optimise within the context of a Monte Carlo simulation).
The topic of residual risk (and optimisation) is an interesting one, as it does pose challenges from a communication perspective. Management may wish rather to hear that all risks have been eliminated (rather than their being a residual which is too costly to eliminate). In addition, the notion of an optimum does open the discussion of which criteria are used to assess that (e.g. maximising the total average profit after including the cost of risk mitigation measures, or minimising the losses in the worst 10% of cases etc.). In more complex cases (such as in some agricultural, veterinary, or environmental risk analysis situations), the costs of risk mitigation and the benefits associated with this are borne by different parties. Such externalities can make an appropriate assessment even more complex; perhaps there will be more on this in a later blog.
Dr. Michael Rees
Director of Training and Consulting