What is Risk? Many people think about risk as the potential impact of an exogenous event, like a hurricane or an auto accident. However, it is much broader than that. Risk is uncertainty with respect to attainment of a desired result.
Management, according to Wikipedia, is “. . . the function that coordinates the efforts of people to accomplish goals and objectives by using available resources efficiently and effectively.”
From Webster’s Dictionary, management is “judicious use of means to accomplish an end.”
So, therefore, management is intended to control risks.
In a post in his blog, The BIG Picture, Barry Ritholtz cited Michael Mauboussin’s definitions of risk and uncertainty:
- Risk: We don’t know what is going to happen next, but we do know what the distribution looks like.
- Uncertainty: We don’t know what is going to happen next, and we do not know what the possible distribution looks like.
Well-managed, organized enterprises:
- anticipate potential impediments to reaching their goals,
- have alternative plans in place to overcome obstacles or navigate around them,
- exercise the maturity and discipline required to discontinue efforts that are unlikely to achieve their targeted benefits and
- apply ongoing efforts to transform uncertainties into risks and then mitigate them.
Well-managed, organized enterprises demonstrate a conscious approach to risk management. In fact, most day-to-day decisions are guided by risk management considerations. When we perform a set of tasks in a specific order to ensure we achieve the end result we’re aiming for, that’s risk management. When we select a specific restaurant to dine at with some friends because we think they’ll enjoy it, that may well be also. The only difference between these examples is that day-to-day risk management in our personal lives is more likely to be unconscious than conscious. Unfortunately, a lot of risk management in commercial and professional settings is performed unconsciously, which can lead to sub-optimal, if not downright disastrous, results.
Forward-chaining Analysis
Managing any work process or initiative requires that each of the interim states and gateway conditions that must be achieved to realize the goal be identified and planned for. Customarily, these are conceptualized from beginning to end, for example, the Waterfall systems development paradigm—Requirements Definition, Design, Build, Test, Gain Acceptance, Deploy. The classic gateway conditions require that each phase be completed acceptably prior to initiating the following phase and, if the paradigm is followed slavishly, it will produce a working result but not necessarily the best possible result. This is a case in which the potential for downside risk (late completion, missing functionality, cost overruns, poor quality) has been minimized through regimentation, but upside opportunities have been all but obviated. The tradeoffs inherent in it are based on a few crucial assumptions (a big one is that users know what they want and need, ex ante,) which are frequently violated, diminishing the value of the end results. It is also a rote approach often applied unconsciously to manage implementation risks and it does little to promote consideration of alternative approaches that could improve performance.
Backward-chaining Analysis
An alternative to the classic forward-chaining approach is to start with a goal, identify the interim state and set of conditions which must exist in order to realize the goal and then walk backward another step to identify the interim states and conditions which are precursors to them. Eventually, the backward walk will lead to a starting state, which may or may not be the current state. Differences between the two may suggest what would have been otherwise unforeseen prerequisites or opportunities for process improvement.
The Application of Forward- and Backward-chaining Methods
In point of fact, most of us apply both approaches to one degree or another in almost every case. Here is an example—suppose we note that food carts are proliferating in the downtown area in which many people work. We see long lines at the hot dog carts at lunchtime and think that an upscale offering of sausages made from exotic meats could be successful—a premium product at a premium price. How do we go about putting a cart on the street to sell our intended products?
What is required to meet the goal?
- Sausage, bread, drinks, condiments, paper goods, etc. Suppliers for each item.
- Pricing targets
- Licenses
- Startup funding
- Cart, someplace to store the cart when not in use and a way to transport it to where it will operate
- Location
- Staffing
How do we implement our initiative? How do we prioritize and stage the effort? Here are just some of the concerns:
- What’s required to obtain a license? Do we need the cart first? Do we need to reserve a location first?
- How can we determine our cost of goods? Can we get accurate quotes without making purchase commitments?
- How much do we think we can charge for our sausages? What sales volume can we expect?
- Who will staff the cart? Can we do it if we cannot hire someone? Should we spend some amount of time running the cart ourselves before hiring someone else to do it?
- What functions and features does the cart need? Where can we have it built? How much will we need to spend? What is the cost/benefit of additional features?
- What are the logistics and cost to store and transport the cart?
- We should try to get funded as late in our process as possible. The more that is known, the less likely we are to borrow money for something that is infeasible or to borrow the wrong amount.
This is quite a list, and it’s probably not even exhaustive. Furthermore, the questions we have and the tasks we must accomplish seem to be circular and interconnected. There are also subordinate goals to consider. We want to minimize the time and costs involved with merely evaluating our opportunity and we want to avoid giving our idea away to anyone who could run with it and beat us to market. We are at step one and have no choice but to work forward, yet, we may be well-served to start our thinking at the desired end result and work backward. If we employ backward-chaining thinking, we may identify relationships and dependencies that would not have been apparent, otherwise.
Most of these decisions seem like just plain old management practice but they are, in fact, driven by performance and risk concerns and the more explicitly this context is acknowledged, the better the decision process will be. In considering any decision, we should articulate the goals, assumptions, critical factors, alternatives, costs, risks and potential mitigations associated with any course of action.
Organization design and integration of risk-based thinking have evolved as risk has become a more prominent focus of standard-setting organizations, such as the ISO. Positions that are obviously associated with risk mitigation, such as Chief Risk Officer and Chief Information Systems Security Officer have evolved relatively recently but other disciplines that can now also be seen as risk-related, such as PMOs and Architecture Review Boards, have been there all along.
All management decision-making is based on risk considerations. If we operate in a mindful manner and include these considerations a little more formally in our decision-making processes, we stand to improve our ability to make better choices.