Why Risk Management Doesn't Work.

I had my epiphany 5 years ago. I remember it as if it were yesterday.

Like a house of cards, when you pull out a card from the bottom, my whole Risk Management world fell apart.

Nassim Taleb had a significant influence on this shift. It was October 2018, and I was attending Nassim's Real World Risk Course in New York.

Let's start at the beginning...

For many years, I believed that Risk Management was the Champions League of organizational management. (For my US friends, Champions League is about real football ;).

I endeavored to assist companies with Risk Management to the best of my ability, but I often found myself facing challenges.

Conversations with peers revealed they felt the same way.

For a long time, I kept thinking: If I could just get better at identification, or assessment, or monitoring, then I'd truly excel at helping companies manage risks.

Observing the current state of RM, it's evident that numerous companies grapple with one crisis after another.

This challenge isn't confined to companies, entire nations often misjudge risks.

It appears we allocate resources to minor, almost negligible risks, while overlooking the substantial ones.

How is this possible? And, more importantly, how can we fix this?

I was ready for Nassim's insights.

As the saying goes, when the student is ready, the master will appear.

I had this gut feeling that many aspects of our approach were misguided.

How?

I tried to verify what worked in the real world and found that much of the theoretical knowledge about risk management didn't quite translate in practice.

Nassim and his brilliant colleagues gave me a powerful push, starting my journey.

People often confuse complex and complicated systems (do look it up if you're unfamiliar), but they commit a more important error.

Professionals in Risk Management frequently employ tools designed for complicated systems and apply them to the complex domain.

A complicated system is a closed one, something we can fully understand and predict, often referring to human-made systems, like machinery.

Consider tools like Failure Tree analysis or Bow-Tie analysis. They're perfectly suitable for closed technical systems that we can comprehend and forecast.

The same applies to the commonly used risk matrix.

Generally, anything that involves probability works reasonable well in closed systems.

But, as we expand these closed systems—say, by connecting them or introducing human interaction—it becomes tricky.

The catch is that our tools from the complicated domain might seem to work in complex environments, but only until they suddenly don't.

To clarify, I do still employ these methods in complex settings since they help me understanding risks better. However, it's vital to recognize their limitations.

Taleb emphasized the importance of focusing on fragility, a perspective I've since integrated into my analysis.

Without considering fragility and the interconnected nature of elements, we miss out on numerous dimensions.

The real game-changer for me was the understanding of the concept of resilience (or at least what I understand under resilience).

While Risk Management zooms in on parts of complex systems, resilience aims to encompass the entire system, including its interrelationships.

This holistic perspective didn't come naturally to me at first.

Even if we regularly mention system thinking, it's not intuitive for many.

People often seek clear-cut, binary solutions that dictate actions for various scenarios.

Reflect on a post I wrote about two months ago, where I differentiated risk management from business continuity management. It received substantial engagement.

Using somewhat arbitrary definitions (even if they're from a standard), I established a boundary. This is akin to how colonial powers once drew borders on maps while sitting in European cafes.

The crux of the matter is that such divisions might look good on paper but frequently fall short in real-world applications.

Our inclination to simplify to understand complex topics becomes a double-edged sword. There comes a point where this reductionism becomes detrimental, and we need to transcend it.

"To understand complex systems, we have to go up and out, instead of down and in." - Sidney Dekker

Once I grasped this, my journey became considerably smoother, providing clarity on where to direct my focus.

When striving to understand systems, I map them out. This system mapping is essential for risk comprehension.

Merely defining the scope of the systems, their boundaries, proves to be highly beneficial.

The notion of fragility directs me to the system's underlying weaknesses, manifesting in various forms, with bottlenecks and constraints being among the most significant.

From this foundation, everything else aligns.

We should address complexity with a nuanced understanding, ensuring we don't confuse complexity with complication.

It might surprise you how straightforward solutions for complex systems can be.

Ultimately, continuous monitoring and adaptation to evolving environments are crucial.

With an initial identification of fragility, this adaptation becomes much more manageable.

Don't misunderstand, it remains a demanding endeavor.

Yet, it's more achievable and fulfilling compared to other methodologies I've come across.

Remember, resilience isn't a fixed state, it's a continuous process.

See you soon!

Marco

P.S.: If you're keen to join me on this journey, DM me: "Resilience Engineer".