Let’s quantify every risk!
I read a recent post on LinkedIn (now deleted, fortunately) that asserted that the job of the risk manager is to quantify every risk. Of course I replied that their job is to help the organization and its leaders succeed by helping them get the right information at the right time to make the right decisions.
But there are some who talk as if the only and mandatory way to assess risk is through quantification, and they spend a lot of time talking about the mathematics involved.
Think about it. Do we need to quantify every risk in our professional and personal lives?
OK, time’s up. You took too long to think about it, as we more often than not don’t have the time we might like to be precise about the “value” of a source of risk.
We need to make a decision, often before related risks can be quantified.
Think about that. Time’s up!
Imagine you are driving your partner’s car at 35 mph down a fairly narrow road when a massive boulder rolls down the hill and stops in the middle of the road.
You have four choices:
- Slam on the brakes and pray (literally) that you will stop safely.
- Try to avoid the rock on the right (and pray).
- Try to avoid the rock on the left. (OK, pray.)
- Pray that you can survive by driving through the rock.
Do you quantify the risk under each option? Of course not.
Later, you are sitting up in your hospital bed when your partner enters. Instead of asking after your health and expressing concern, they shout at you:
“What have you done to my car?”
You have options, but you won’t quantify the risks for each optional reply.
There are situations and times where sophisticated modelling, etc. is justified. And there are (IMHO) more situations and times when you and the decision-maker simply don’t have the time and must do the best you can.
I was thinking about the GOP presidential hopeful, Nikki Haley. She had a decision to make when her old boss, former President Trump made several comments about NATO, including saying that he might encourage Russia to attack a member of NATO that hadn’t met its defense spending commitment. How was she to respond? She didn’t have a lot of time for that decision, certainly not time to quantify every risk under every option.
She also had to make decisions on how to respond when President Biden talked about “shutting down the border”, and when he confused Mexico and Egypt.
She and her team didn’t have a lot of time, but they could have been prepared.
They could have planned ahead and considered the risks in responding in different ways should Trump or Biden do or say something that merited her speaking out.
In the same way, I can see risk managers working with decision-makers to pre-plan how they would make time-critical decisions in various situations. They might be more general than specific. That would allow the decision-maker to have anticipated that type of situation, even if the specific situation was unexpected.
When I was a vice president in IT for a financial services company, we needed to build disaster recovery plans. My predecessor had started to write plans for a fire, and earthquake, a plane hitting the data center, and more. We decided that the response would be very much the same regardless of how the data center was put out of action. There were several steps we could anticipate and be prepared for, such as making sure we had backups (of course), a place to restore operations, and (most important) a communications plan.
Haley can reasonably expect both Trump and Biden to say and/or do things that might be opportunities for her to make the point that she is younger, more alert, and more able to be president. (No, I am not saying I support her. This is not a political commercial.) With some preparation, she might be able to seize the opportunity without taking an unacceptable risk.
For example, when your spouse sees you in hospital and shrieks at you, you should be prepared. “Sorry, dear!”
Can you help your decision-makers make better time-critical decisions? Can you help them be prepared?
In addition, there are times when quantification is simply not necessary because the decision is obvious, the risk is either too great or clearly one that should be taken in light of the opportunity.
I welcome your thoughts.
Do we need to quantify every risk? Is that our job?
Leave a comment
Norman Marks on Governance, Risk Management, and Internal Audit 
I haven’t seen the post but it doesn’t sound like an argument someone would make. Obviously risks need to be quantified or rather their effect on decisions should but there are lots of caveats to that statement
Why do they need to be quantified when the decision is clear?
Nobody in the world is silly enough to waste time on quantification of the decision is clear, because if there is no uncertainty there is no risk and the choice to quantify or not is irrelevant
Alex, there is uncertainty about whether I will be hit and how much injury I would suffer if I ran across the road. But absent an emergency, I wouldn’t do it. The decision is clear.
If I were invited to a garden party at Buckingham palace to meet the King, I wouldn’t be sure how much time I would have and whether he would talk to me. (My parents went but only saw the Queen from a distance).)
Sometimes, your intuition will steer you right and spending time quantifying a risk (positive or negative) is unnecessary.
None of these examples, nor the examples in the article are relevant to the quant vs not debate. The baseline is high uncertainty, high value, critical decisions. When we talk about quant we only talk about important things that would justify the effort. That’s why I started by saying I cannot imagine anyone making an argument the way you presented it.
For me quant is the only way but my scope of that statement are only things that already justify the effort. It’s a given and doesn’t need to be stated that trivial matters are not necessary to quant.
Agree, after saying that most situations (by far) are either ones that require a decision at speed, or where the decision is clear.
The point of the post is (a) to recognize this, and (b) to point out that we can help those decisions that have to be made at speed and the ramifications may be important.
Agree with that
More generically, the point is that we need to ask the ‘so what does this imply?’ question of risk information. Both of you (Norman and Alex) are very clear on the pointlessness of simply listing and reporting risks. The amount of effort (and time) put into answering ‘so what?’ should be proportionate to the level of certainty (and urgency) required for whatever decision is being supported.
Good example sighted
I would definitely lose business engagement (and probably my job) if I insisted on quantification of each risk. There is very little value added to this exercise. We generally focus on the “so what” aspect of what risks are, or are not, material at any given time.
It is appropriate for internal audit to examine the basis for major capital spending decisions. Quantification is useful. Coming from the capital-intensive extractive resource industry, I have seen multi-million- dollar decisions considered and made with zero probability of success and others made to only achieve a short-term impact on share prices. One of the unique features of the industry is that you don’t need to actually find anything when you announce an exploration program. You just have to announce you are drilling a hole to get that share price bump. Still, success would be a great side benefit. Probably.
But do you quantify every risk?