The Failure of Risk Management. Douglas W. Hubbard

The Failure of Risk Management - Douglas W. Hubbard


Скачать книгу

      People who don't take risks generally make about two big mistakes a year. People who do take risks generally make about two big mistakes a year.

      —PETER DRUCKER

      Before we start changing any system, it's a good idea to get a reading on its current state and to figure out how it got that way. Risk management is a very old idea that has changed dramatically just in the past few decades.

      The history of any idea brings its own baggage that often limits our current thinking on the concept and risk management is no exception. Institutions evolve, standards are codified, and professions mature in such a way that it causes all of us to think in more limited ways than we need to. So before we consider the current state, let's see how we got here.

      But throughout most of human history, risk management was an unguided mitigation of risks. Choosing what risks to prepare for was always a matter of gut feel. What differentiates risk management since the start of the Age of Enlightenment is a more systematic approach to assessing the risk. The development of probability theory and statistics in the seventeenth century enabled risk to be quantified in a meaningful way. However, the typical context of these mathematical investigations were well-defined games of chance. These powerful new tools would be adopted only in select industries for select applications and, even then, only slowly.

      From the eighteenth century to the beginning of the twentieth century, the quantitative assessment of risk was exemplified in—and largely limited to—insurance and banking. Although the term actuary predates even probability theory, it was not until the mid-nineteenth century that actuaries became an established profession with accreditation requirements and their methods had risen to earn the title of actuarial science.

      By the 1960s, new methods and tools were being adopted by professionals outside of traditional insurance: engineers and economists. The emergence of computers and the ability to generate thousands of random scenarios with quantitative models made it possible to do the math with uncertain inputs. Engineers in nuclear power and oil and gas were among the first to adopt methods like this outside of insurance. Economists were influenced more by mathematical fields of game theory and decision theory, which provided for the mathematical description of common decision problems, especially decisions under uncertainty. The methods of engineers and economists were both connected to the fundamental ideas of probability theory, and they were largely developed in isolation from actuarial science.

      By the end of the twentieth century, a fourth independent set of methods were being used as part of risk management, and these methods had almost no connection to the previous ideas developed by actuaries, economists, or engineers. Struggling to keep track of emerging risks, executives were hungry for a simple way to summarize the risk landscape, without necessarily adopting the more quantitative (and, at the time, more obscure) methods that came before them.

      By the 1990s the major consulting firms promoted an early version of a common risk communication tool known as the risk matrix as well as various qualitative risk ranking or risk scoring methods. These were simple to use and simple to communicate. In some cases, pressure to adopt some sort of risk analysis method quickly encouraged the adoption of the simplest method without regard to its effectiveness. Once one approach gains momentum, prudent executives had a growing interest in using a method that everyone else was using. Every shock to the system, such as natural disasters, recessions, terrorism, emerging cybersecurity threats, and more, encouraged wider adoption of whatever simple method was gaining a foothold.

      If executives needed any more incentive to adopt risk management, new regulations continue to provide the extra push. Since 1988, the Basel I, II, and III Accords created new international standards and requirements for risk management in banking. In the United States, the Sarbanes-Oxley Act of 2002 and the President's Management Agenda (PMA) under Bush in 2001 stated sweeping requirements for risk analysis of all major government programs. All of these regulations required different organizations to adopt risk analysis methods, but without much detail, risk analysis was usually interpreted to be the simpler, qualitative methods. The European Union's General Data Protection Regulation (GDPR) in 2018 provided for the possibility of enormous potential fines for companies who have experienced breaches of personal data of the public. But its requirements for risk assessment specify only qualitative designations such as “high risk.” The Dodd-Frank Wall Street Reform and Consumer Protection Act (2009) specifically required that the Federal Deposit Insurance Commission (FDIC) use a risk matrix.

      The need for risk assessment has grown much faster than the awareness of relative performance of solutions. The most popular, newer methods don't necessarily build on the foundation of earlier methods that have stood up to scientific and historical scrutiny. However, even the quantitative risk management methods used in finance revealed cracks under the light of the 2008/2009 financial crisis.

      So let's try to map out this rapidly expanding “Wild West” frontier of risk management solutions. Things are moving fast, so this description will probably soon be incomplete. For now, we can examine how risk management is adopted in the modern organization, the risk assessment methods used, and the types of risk mitigation methods used.

      To get a finger on the pulse of the current state of risk management, we could rely on the anecdotes of my network of connections in risk management. And I do to some degree. But the best tool we have is structured surveys of various levels of management in organizations. My firm, Hubbard Decision Research (HDR), collaborated with The Netherlands office of the consulting firm KPMG to survey 283 organizations and risk experts from fifty-three countries across many industries. Organizations ranged in size: eighty-four had less than one hundred employees and


Скачать книгу