Risk Agility and Decision Making in the 21st Century

As risks have evolved from being phenomenological occurrences in the natural world, the twenty-first century is in many ways the era of man-made risk and man-stoked fires. From cyber risk--which is increasingly mutating to impact all facets of the modern economy--to terrorism, climate change, and reputation risk, mounting a credible defense to these risks requires as much soft skill as it does technical risk and analytical capabilities. Moreover, twenty-first century survival depends very much on our ability to harness risk, encourage bounded risk taking, and improving overall organizational and societal resilience.

Like no time in human history, the priorities of risk and resilience have taken center stage. Yet, risk does not live in isolation, nor does it conform compliantly to the classification systems used by traditional risk management approaches. Rather, decision makers must view risk as a dynamic process that cannot be adequately contained with static tools. The placebo affect that can be created by believing that certain risks are “covered” through traditional approaches to risk management is often more dangerous than the risk itself.

The example of VW is instructive. Once considered a paragon of corporate governance and a leader in the automotive industry, in 2015 VW grappled with a rapidly eroding reputation and a precipitous decline in its market value due to an entirely preventable emission-rigging scandal [1]. It turns out its alleged emissions-cheat device, which was set to reduce engine output while emission tests were conducted on diesel vehicles, was also connected to the company’s kill switch. No direct competitive force (perhaps other than the urge to cut corners and gain market share--all due to internal sources of pressure) and no discernible outside factor, caused VW executives to make these ill-fated choices. They did that entirely on their own.

In another era perhaps VW may have escaped the prying eyes of regulators and the public. Today, firms must opt in favor of transparency in order to remain competitive. VW’s case is very much emblematic of risk in our times, where climate change, reputation and technology converged to amplify the losses to the company’s shareholders, inviting worldwide scrutiny. Actions that were once accepted as an externality are now treated as something punishable with monetary fines and sometimes irreversible damage to a firm’s hard earned reputation.

Climate change is no longer some distant reality in a far off arid developing country. Catastrophic draught is a reality in California. Following Super Storm Sandy, when images of New York’s Stock Exchange covered with sandbags were beamed around the world, Wall Street, Main Street and board rooms everywhere contemplated their response to increasingly extreme natural risks. In the aftermath of the VW scandal, companies that do not leave light environmental footprints, or try to cut regulatory corners, fail to review their “green” posture at their peril. Being perceived as thoughtful about the environment is no longer simply a nice marketing motif, it should be thought of as a source of competitive advantage and survival.

Adaptability and Agility

Whether we respond to risk through fear or fiat, risk agility is the key attribute of the survivors. Adaptability and agility have always been the secret survival mechanism of the fittest. Many methodologies have lulled us into ignoring our instincts under the guise that we are safe and that risks are hedged. Compliance, which in some cases is merely the act of grudgingly checking boxes, is not an adequate form of risk management for the twenty-first century.

Risk agility implies a certain mastery of risk, decision making under opacity, and a level of simplicity in the face of complex, heavily interconnected systems. This is both the source of ease in implementing well considered approaches to risk management and decision making, as much as it is one of the confounding factors. Agility, by definition implies nimbleness, speed and an intellectual acuity that often betray large, complex organizations.

The modern multinational is anything but agile--imagine a super tanker making a U-turn. Now imagine a super tanker with Francesco Schettino at the helm--the captain of the doomed Costa Concordia--navigating through rough seas, while facing a mutinous crew and a system failure caused by a breach. As vivid as this image is, modern corporate leaders share the waters of the market in conditions this risky, and with captains this reckless [2]. The best among them must make decisions that impact the lives of their crew, their missions and, in the direst of circumstances, the very survival of their ship--all with limited information or all the wrong signals.

The inexorable reality is that no matter how opaque choices are, the defining attribute of a leader is his or her ability or obligation to choose. The defining attribute of an agile enterprise is the ability to align all resources to enterprise-dependent decisions. Even in the best of cases, decisions are often made applying the 80-20 rule, or some other maxim that justifies ’permitted’ uncertainty in boardrooms, executive committees and government.

For many global enterprises, indecision and paralysis have crept into the decision matrix. Entire continents, such as Africa, are ring-fenced from investment under the perception that the investment climate is too risky or illiquid. New technologies and disruptions are ceded to upstarts, and better ways of organizing for resilience and agility are left to tech companies. Sometimes the best choice to make is no choice at all. For large and complex organizations, gaining momentum and responsiveness can be an exercise in futility. The perpetual motion machine of organizational behavior and the profit motive stand in the way of agility. Our natural orientation toward risk aversion blinds us to clear warning signs that trouble lies ahead.

The Risk Ready Firm

In a risk-ready firm, it is everyone’s business to remain in business, which requires a flat risk-response structure that leverages multidisciplinary risk management approaches. In financial institutions, risk management is largely a backward-looking activity that is heavily quantitative and most often driven by regulatory fiat. In the non-financial world, particularly in the manufacturing industry, risk management is much more qualitative, given the tangible (observational) nature of errors in a system or process. Charting a course as a hybrid between the two yields three-dimensional risk management, wherein the filter to noise ratio is controlled, and better, more instinctive responses can emerge.

Culturally, fear of failure and an aversion against reporting bad news must be confronted in all its guises in order for organizations to fully unlock value from risk. Withholding bad news does not make it go away or make it better. In fact, bad news tends to become amplified, and festers with time. In VW’s case, company leaders received clear warning signs of the emissions-rigging scandal dating back to 2007, if not earlier [3]. In the Germanwings tragedy, managers received clear signals that Andreas Lubitz, the suicidal co-pilot, was clearly a danger in the skies. Nevertheless, these risk signals were ignored, despite the relatively simple approaches to mitigate and respond to their presence [4].

Many risk management approaches unfortunately impose far too much complexity on organizations, making them a source of risk amplification rather than a source of risk abatement. As the old adage goes, complex systems fail in complex ways. Simplicity, therefore, is a key attribute of an agile risk management framework. Some of the most enduring ways to avoid losses merely outline proscribed activities, as opposed to delineating every possible situational response. Greater simplicity is needed in risk management--and in decision making systems--in order to keep up with the times.

The other principal weakness of traditional risk management frameworks and how they hamper agility is that they often rely on historical data to drive current understanding and future directions. The challenge of taking this approach is that it is not very effective against unprecedented, emerging, or never before seen threats. Moreover, despite all the rigor of statistical methods, for many risk domains, such as cyber and reputation risk, the data set is shallow and largely unreported. The omerta that follows a potentially embarrassing cyber risk or reputational exposure hampers the ability to fully understand the scope and the forces shaping these risk domains.

The False Positives of History

The other challenge to historical methods is the preponderance of false-positives derived from a confirmation bias that affects individuals, teams, and organizations. The lessons of history may be consulted not for real clues about the present or future, but for a confirmation of preconceived notions. History can either be a useful guide to managing the present, or it can really set one off on the wrong path. The behavior of nation-states is a good example; either a country will behave exactly as it has and be highly predictable (such as the government of North Korea’s constant antics), or it can surprise and amaze (such as Germany’s willingness to throw open its doors to Syrian refugees, when many of its neighbors locked the door shut).

By the same token, preconceived notions about how the government of a country may act can defy prediction. For example, since the collapse of the Soviet Union, the world has come to expect that Vladimir Putin will seek to remind the West that Russia still matters, on the global stage. Russia will therefore be expected to flex its muscles around its borders, and seek to revive an anti-U.S. alliance with China. The West could not have predicted, based on its experience since 2011, that Mr. Putin would choose to take the lead in the fight against ISIS in Syria, essentially superseding America’s and the West’s prior limited efforts to combat ISIS, and largely making the West irrelevant in Syria’s future.

History tends to be an excellent teacher vis-à-vis great successes or great failures when it comes to decision making. It is not such a great teacher when it comes to predicting the future or taking a leap into the unknown. The behavior of complex systems such as weather, the economy, and social risk are not readily gauged by traditional approaches. Such approaches are most effective for high frequency, reliable events. With low frequency and rare events statistical methods tend to suffer from "model error"--namely, the risk that the object being measured is far too complex for the methods used, or more common still, that the person doing the measuring makes a mistake or the model itself is too confounding. Many losses resulting from the global financial crisis where compounded by this reality. Simply put, complexity plus complexity equals complexity squared.

A (Fr)agile Balancing Act

Risk agility and effective decision making is not about fearing the twenty-first century, although it certainly deserves deference. It is about respecting the speed with which things can fall apart as a result of unforeseen or unexpected events – as quickly as the so called Panama Papers were leaked and within a day had claimed its first head of state in Iceland. As such, the basis for making bold choices should include doing something never done before, or waiting to see what happens before making a move. Agile enterprises are transparent, trustworthy, entrepreneurial and, above all, risk takers. Aversion to risk is dangerous and implies being stuck in another era and held at a standstill by the inertia of fear.

The age that we are living in--the age of globalization, instantaneous information, tremendous technological advances, seemingly constant radical political change, and an unseen strain on critical resources--will show no remorse for the risk averse. Those firms that embrace risk agility will be able to quickly reinevent themselves and establish frameworks and a company culture that recognizes when the enterprise is imperiled by a particular internal course of action, or by external forces. This is the very creative/destructive cycle that drives the global economy. How people, organizations and society will thrive depends now more than ever on our individual and collective decisions.

Risk agility and decision making is mostly about common sense--remembering what your mother taught you as a child, incorporating the lessons you have learned throughout your life, and transforming it all into sensible action. It boils down to this: Be bold. Lean Forward. Know more about the world. Turn the pyramid upside down. Embrace risk. Have a long-term orientation toward the future. Be thoughtful about what you are doing, and how you are doing it. Consider the viewpoints, needs and desires of others. Do the right thing. It is not just about making money or getting the job done; in the twenty-first century, it is about getting to the finish line in one piece, and with a clear conscience.

About the Authors

Dante Disparte is CEO of Risk Cooperative. Daniel Wagner is CEO of Country Risk Solutions. Both are co-authors of the forthcoming book “Global Risk Agility and Decision Making”.