“The History of every major Galactic Civilisation tends to pass through three distinct and recognisable phases, those of Survival, Inquiry and Sophistication, otherwise known as the How, Why, and Where phases. For instance, the first phase is characterised by the question ‘How can we eat?’ the second by the question ‘Why do we eat?’ and the third by the question ‘Where shall we have lunch?”
― Douglas Adams, The Restaurant at the End of the Universe
Every few years I re-read that wholly remarkable book, The Hitchhikers Guide to the Galaxy (aka H2G2), and I always find new nuggets of wisdom. This one got me thinking about the state of the risk management profession and where we are on the maturity curve.
My experience of risk management was first as as victim: a middle manager being put through the annual bureaucratic torture of coming up with a bunch of risk & mitigation statements.You always know when a function that stood a chance is about to jump the shark: someone puts the word “Enterprise” in front of it, and once or twice a year some poor soul from ERM would remind me I need to update the risk register.
Being in the IT trade this tended to fall into two categories such as the datacentre burns down, or a project goes off the rails. The former was an eye-rolling exercise (of course we would cope) and the latter almost a certainty (so why waste energy in advance that would be better employed fixing the inevitable problems?).
In H2G2 terms I think we were firmly in the “How [can we manage risk]” phase. It was a chore which we cynically dismissed, trying to get away with a minimal response to keep the Risk team out of our hair.
If that sounds familiar it is probably because it is the sense I often get when I hear discussions about risk today, whether it be in the context of Health & Safety or Anti-Money Laundering. I like those examples because it is useful to remind ourselves that what we do can have real life-or-death impact. Allow a culture of box-ticking to establish in a high-risk industry and people get hurt. Treat AML requirements as a bureaucratic overhead from Wellington, and slave-traders thrive.
The next question we need to be asking is just that: Why [do we use risk-based decision making]? Because this is how we will win the hearts and minds of the people who must engage with our risk processes. We need to make the processes frictionless, and focus on the risks that matter.