Things keep happening

News routinely shatter the comfort of our certainties, including some fundamental tenets of our belief system: oil will not go under $40 a barrel; financial markets cannot collapse; Chinese growth will fuel industrial and financial markets for decades; there is no water on Mars…

Uncertainty is a familiar territory for marketers, planners and strategist, who have developed tools and models enabling them to respond rapidly to emerging changes. Bigger changes that shake up a market or an economy, events that overwhelm a system or a corporation’s capacity to respond are infrequent (luckily) and are (usually) following a series of warning signs, allowing for being prepared. They are however getting little attention, caught between a low probability of occurrence and the limited span of forecasting models.

Risk versus Uncertainty

Risks are unscheduled events or conditions that carry a negative impact. Uncertainty (or variability) proceed from the same origin, but is broader because it encompasses both positive and negative changes. Understanding variabilities regardless the sign (plus or minus) of their impact provides an opportunity to catch an early trend and reap benefits. It also helps understand the total volatility of a market or industry, when negative impacts only offer a partial view of the forces at play.

As Uncertainty becomes the new normal, risk managers are facing two categories of variability: risks that can be predicted, and events that cannot be tagged to a specific timeline. The first category is well covered by tools and approaches, along with mitigation strategies and risk scoring. New thinking on Operational Risk Management promotes the idea that “ordinary” variability, resulting from operations, projects or other undertaking is inevitable and should be directly under the manager in charge. Exceptional and escalated risks only should be managed by a specialized team. Like running, managing a business or a program creates likelihood of stumbling or missing a step. If the fall is manageable, the best approach is to pick yourself up and keep going. If the damage is serious, then medical attention or emergency services might be required. Letting a Risk Committee manage risks on behalf of a manager disenfranchises the person in charge and dilutes accountability.

Risks Committees can however look at the big picture and consider the net amount of exposure a project, business or department carries. Even if all uncertainties are under control, the net amount of exposure might trigger a pro-active risk reduction intervention. Aggregating risk probabilities of occurrence creates misleading representations, eliminating fringe risks even if they are tagged with high impact; compiling the net exposure does not alter the identified risks, as their total exposure is a straight sum, providing a comparable view of the potential liabilities.

Probabilities are not facts

robabilistic and forecasting models are great tools to project a future vision or an effort with a fixed term boundary (e.g.: 5 years, 10 years), which allows synching up strategies, work effort and market changes on a comparable horizon. The benefit of a consistent time scale from a planning perspective is its downfall for catastrophic risks, which are infrequent in nature. Here lays the difficulty with catastrophic risks: they might happen once in a lifetime, maybe never; but would they occur, their impact would be devastating.

The recent real estate and financial crisis illustrated how companies viewed as unmovable could collapse and go bankrupt in almost the blink of an eye. Financial services regulators and industry representatives have put in place measures to prevent the re-occurrence of the massive failures that rocked the markets. Their analysis is based on the potential impact of large, often correlated events, with little regard to their likelihood of occurrence. The question is not of the probability of occurrence of major risks scenarios, but of the readiness of organizations should they occur.

Working with scenarios has already been a best practice in strategic planning, helping compare multiple most-likely options without having to run a full scale Monte Carlo model. The Basel recommendations that followed the Economic crisis aimed at creating sufficient reserves for companies so they can withstand a major new crisis. Expanding the use of scenarios creates a tool that helps prepare for major events as well as operational uncertainties, making the business more resistant to variability, and in case of a major impact, more resilient.

Uncertainty is a new normal

The management of risks for an organization mainly relies on the probability (likelihood) of occurrence of a risk. The higher the score, the higher the attention, adopting the actuarial model developed by insurance companies around the world.

This approach to risk management relies on two important premises:

• The specific risk to occur must be predicted or figured out;
• The response to such risk is within the range of the organization’s means.

Assuming these two aspects can be set aside for a moment, then the risk exposure based on the graded scores can trigger a solid mitigation approach.

Traditional Risk Management

Mature organizations collect all risks into a Risk Management Plan, providing both independent oversight and validation of the mitigation steps. Recent thinking states that the most frequent (and usually lower impact) risks should be viewed as the normal costs of doing business, managed by whoever is in charge of the activity. The rationale is that most of the risks linked to an activity, their associated warning signs and their direct mitigation should be well known by the manager in charge. In this view, less likely risks and those independent from the activity should still be handled by an independent risk structure, in collaboration.

Key risks for a new project for instance, include the unavailability of key resources, the insufficient support or engagement from the sponsors, a change-of-heart from the targeted users before the effort is completed and the imperfect deployment or adoption of the work products. Key risks for an operational activity would include unavailability and lack of knowledge from the resources, failure to perform checks and controls, supply chain errors or delays and deficit in agility against market changes.

In these cases, risk patterns, cautionary signs and mitigation or reactive actions are well known and within the capacity of a manager to handle. The unusual risks such as a sudden change to the company’s priorities, of the raw material prices, or a competitor’s disruption would fall outside of the purview of the line manager, and should be managed in coordination, but separately.

Business as Usual risk profiles

Using the classic risk grid (Green, Yellow, Red), the “ordinary” risks are the red and possibly Yellow blocks; all others should be under a specific Risk Management structure.

The Risk Management structure is an umbrella function, which consolidates the risks analysis and mitigation handled by the line manager, in order to benefit from a 360 degree view of risks at any moment: if “operational risks” are higher than expected, or their mitigation fails to meet the objectives, an escalation or intervention might be necessary.

Operations and business activities are living through continuous changes, some predictable, others foreseen only by visionaries, and some occurring without notice. These changes are similar to the risks, with a caveat: the impact can be negative (like risks), neutral or beneficial. The main difference between variability and risk is in the appreciation of the outcome. Risk managers only focus on variances and events that carry a negative impact onto the business, initiatives under way or operational and financial performances. While this is their charter, observing all uncertainties and their occurrence regardless the positive or negative sign of their impact provides a broader view of all forces at play and their impact. The broader view helps better understand the volatility of the landscape, giving precious input to modelers and forecasters.

Uncertainty and Impact

Uncertainty is everywhere; being prepared is no longer an exceptional effort, but should be a normal activity of any organization. A number of changes occurring might very well have a positive impact onto the business or the organization; being able to identify such changes ahead of time enables taking actions on time to reap the potential benefits.

Some uncertainty however can be of massive scale or impacts, which might exceed the normal (or full) response capacity of the organization. These are major events, which total impact might exceed the financial capacity of the business, but also events which might cause a near fatal impact to a part of a business, or take years to recover from.

Uncertainty is the new normal, and a decade of global economic crisis, entire countries defaulting and collapsing has been teaching us that recognizing the ordinary, operational and catastrophic risks is the first step only. Comprehensive mitigation, management and continuity plans need to be prepared and activated as unscheduled events occur.

Preparedness is becoming the new operating standard.