Uncertainty, Emerging Risk, and our Blind Spots

Uncertainty in Emerging Risk. One question is "not if but when, and will we be ready”? Another question is “how are we blinding ourselves”?

Assumptions are deep-seated, institutional and cultural. These influence us, particularly when looking at Emerging Risks and expectations of our ability, collectively, commercially and personally, to assess and respond. The Covid-19 Pandemic should have stripped bare, but probably did not, the assumptions that we can respond effectively. Another lesson we should take is that hubris and myopic cultural confidence can cloud our vision when considering Emerging Risks. 

The 2019 Global Health Security Index ranked countries on a number of factors, coming up with a combined score. That score provides a surrogate for perceptions of countries ability to respond to a pandemic or other major health emergency. Of course, ‘rich’ countries scored better than ‘poor’ countries. Developed countries scored better. ‘Western’ countries scored higher. Every way you look at their data and estimates, the ‘Western’ developed countries come out ahead. 

The United States was ranked as number 1 overall, with the UK ranking as number 2 overall. China was ranked 51st. However, it seems that these two countries failed when confronted with the emergence of a risk that has been on risk registers for years, if not decades. 

The WHO, Bill Gates and others have shouted the warnings of the dangers of a pandemic, and even the CDC had a Pandemic Response team and plan before Trump dismantled it. In the UK, the 2017 version of the “National Risk Register Of Civil Emergencies” from the UK Cabinet Office, National security and intelligence, contains a section dedicated to Pandemic Flu. While Covid-19 is not an influenza virus, the principles and responses are the same. 

Why did Risk Managers miss this, and why were Western countries so, on the whole, ineffective in their response? What should Risk Managers take away from the events we have been living through, and hope will come out of this year?

Before going further I would like to remind any reader that this Pandemic is only one of the potential pandemics that could envelop our world. Pandemic influenza remains a real danger, even though the personal distancing, lockdowns and quarantines, and use of personal protective equipment (PPE) by most people has resulting in 2020 being the “Flu season that never happened”. 

What are some of the lessons that I have taken from this?

1. Assume a Western bias in all materials developed in, researched in, or presented in Western countries and media.
2. Accept that national hubris overestimates our governments' and societies' ability to identify the actual level of the threat.
3. Be confident that elected leaders will, in most cases, make the hard decisions too late, and in half-measure.
4. Do not accept that a “free society” is any more capable of an effective response. 
5. Reject the idea that we cannot or could not see this coming.
6. Be ready to be amazed by the resiliency of businesses of all sizes.
7. Finally, please agree that Capitalism is not the best system to allocate capital, and that government ‘guidance’, no matter how flawed, is required to save Capitalism from itself.

None of those is meant to result in or generate political arguments, though some economic discussions may result. There are no intended value statements about the moral, cultural or philosophical supremacy or superiority of any country or political system. Humans have a limited attention span, both in time and distance. The Strategic Planner’s, and I would argue the Risk Manager’s role is to inculcate a wider attention span. To look beyond the horizons that otherwise limit our ability to plan and respond.

1. Western bias. We’ve seen it again and again, in reports such as the WHSI referenced above. It is natural to consume information written by people with the same cultural and historical references, and living in the same economic (and in many cases) political structures. We read what they write because they write in our language, our culture, and we understand their references. If anyone writes about Enron or Parmalat, there is a good chance that an accountant, and auditor or a risk manager in a Western company will understand the references without having to learn an entire backstory.

We read and learn from the experiences of those around us, not from those in other cultures or in different continents. Because we speak the same culture and references, we take our lessons from those references. That makes it too easy to accept that ours is the one-true-way, and that we have the answers.

Yet look at the Middle East and Asia, and you will find that they have their answers, that work for them, and have worked for them. By Western measures, China should not be possible. Year-on-year 6.5% to 8% annual growth is not sustainable. And it isn’t. But that is only if we are looking at the Western experience and economies. The Asian economies have created that growth through a combination of public sector spending and private sector export-driven growth, founded on economies with large numbers of newly urbanised and well-educated workers. 

Can this continue in a straight line? Absolutely not. We’ve long bet the growth has been exhausted and that stimulus can no longer support that growth; a crash is coming. We’ve been mistaken thus far. How much longer will we be mistaken? And, while it hasn’t happened yet, an econcomic collapse with consequent social unrest in China remains an Emerging Risk, as does economic turmoil in Europe.

2. National hubris. The introduction to the “National Risk Register Of Civil Emergencies” mentioned above states:

The United Kingdom has an enviable reputation for resilience. In a rapidly changing world, we are at the forefront of embracing new opportunities and seeking innovative solutions to emerging problems. Our openness and integration of technological developments brings us huge benefits but also introduces risks and vulnerabilities. As such, resilience is crucial to protecting our people and businesses, and through them our society and economy.

These are the stories we tell ourselves, and these are the stories we believe. Each country has its reasons for pride, and is blind to aspects of its strengths and weaknesses. The British believe that the UK the Financial system is the best in the world. The Americans think they have a monopoly on “Freedom” (whatever that is) and that their capitalist system is the best at allocating capital, creating jobs and making money. Militarily they are unassailable, and from a technology perspective, they lead the world. France has culture (as does Italy), Greece has history, and Germany has order and discipline (translating into the best workforce globally).

Yet what about China and Japan? They have history that we know nothing about, and cultures that we do not understand. Therefore they must not be as advanced or as capable as “we” are. 

Why does this matter to Emerging Risks? We overestimate our ability to see the risks coming, just as we overestimate our ability to respond. If the USA has the greatest military and the ability to sail an aircraft carrier and support ships to respond to a disaster, then surely America can respond best to any disaster. If the UK Financial system is the best in the world, it will surely see financial crises developing and respond to such crises? If Asia (whatever that means) are not as advanced as the West (a badly flawed supposition), then surely we cannot rely on them to either see events coming, or to respond to them as effectively as “we” can and will. Our national hubris blinds us.

3. “Our” systems of democracy are superior, and our elected officials, supported by professional civil services, have the best interests of the people in mind, and will mobilise the resources required to respond to Emerging Risks effectively.

We might want to reconsider that, and remember that elected officials respond to what they believe is the “will of the people”, as manifest by what actions and programmes will ensure their re-election. The civil service's role is to implement the will of the people, as determined and funded by elected officials. This includes cadres of civil servants whose primary jobs are to scan the horizon for upcoming risks (and opportunities) and provide the elected officials with a foresight to craft policies and allocate budgets. 

But the Pandemic has taught us that our elected officials can fail, and do so spectacularly. The response from the major Western countries to the Pandemic has been one of gauging public perceptions of the risk and attempting to determine the level of response acceptable to the electorate, resulting in responses that have been too late and frequently too little.

Consider the potential contribution or impact of government support of intervention in the event of a large systemic event .

4. Freedom. Now we come to one of our worst blind spots. We in the West are free. And that means that we can choose what we want to do. I’m afraid we have lost sight of the two sides of the scale; Freedom is balanced by Responsibility. Responsibility as the counterbalance to Freedom has been subverted by using the phrase “Cancel Culture” to escape responsibility and avoid consequences.

AS Risk Managers we need to be looking at the responsibility side of the equation, and assessing what may occur if this is forgotten. The lack of responsibility felt by the “wage slave” works directing into the hands of the corporate leader and shareholder and into the hands of the fraudster. Too often “freedom” can result in the suppression of the sense of responsibility, resulting in individuals who feel no meaningful responsibility to the company, the customers or companies’ role or place in society. 

From an Emerging Risk perspective, we need to be questioning individuals’ and society’ perceptions of the role of Freedom and Responsibility. 

We also need to be careful when assessing the capability for an effective response to an Emerging Risk, and to consider the level of social and personal responsibly that will be required to deliver the response required. Where the response is top-down, there may be less risk of a Freedom/Responsibility gap. Command and Control is able to dictate responsibility. But not all situations are suited to such a response.

5. “Didn’t see that coming”. Please. We’ve seen every major crisis of the past two decades coming, and have ignored the signs, or underestimated the potential impact, with the exception of two major natural disasters; the Fukashima earthquake and associated nuclear accident, and the Boxing Day 2004 Tsunami.

The GFC (Global Financial Crisis) did not come as a surprise. Certainly, there were wailings of angst, many by learned or senior individuals all bemoaning how impossible it was to have seen what was coming. Yet we know from the literature that it was foreseen by those very leaders in business and government. 9/11 was a shock, but those with access to the intelligence reports knew that something was coming. The warnings were ignored. 

The Pandemic was foretold for years, and ignored. In late 2019 I was shown an Emerging Risk list, with estimated timeframes for the emergence of the various risks. Pandemic was on the list, but estimated to be in the 5 – 10 year range. I commented that, for all we knew, a Pandemic could already be underway, and that my own assessment of the emergence period for a Pandemic was “yesterday – 10 years”. I’ll hasten to add that this was before it did begin November or December 2019. I claim no unique insight or prescience. 

For most Emerging Risks, we can see them coming. What we cannot see is precisely when, and this makes planning difficult. It also adds difficulty to encouraging management to dedicated limited resources to prepare for a situation that may or may not happen (within the planning horizon). But not freeing resources is not the same as not seeing it coming. 

6. Corporate Resilience. All that being said, be ready to be amazed at corporates and peoples’ resiliency in the face of “the event”. I’ve seen companies go through existential events and come out stronger. Indeed, we hear of companies that fail (other than the great failures due to frauds as mentioned above), sometimes spectacularly. But so many companies recover quickly. Do not underestimate the human capacity for adaptability and perseverance, and when employees are part of a culture that empowers, the ability to rapidly respond to and recover during a crisis if phenomenal. 

7. Capitalism is the answer. When scanning for Emerging Risks, consider that the prevailing economic system may be a contributor to a coming crisis. We will ignore for a moment that Western Capitalism is, in virtually all countries, actually a form of Capitalist/Socialist mutant. An economic system that enables and encourages “moral hazard” exposes itself to greater systemic ecomonic risk. Conversely, Japan has proven to the world that it is possible to monetise debt for two decades (so far) and still have a functioning economy and society. Hyperinflation has not struck Japan, and the Yen has not collapsed. But Japan is not France or Greece, and it certainly it is not the United States or Great Britain. 

The greater the reliance on the state to maintain the economy, the greater the risk of systemic crises, or so we are told and expect. Yet we need to look deeper when considering Emerging Risks. Chinese government policy supports and encourages business growth, and through the GFC, was active in stimulating the economy and supporting businesses. While the Chinese economy may be rife with zombie companies, it is hardly alone in this. The major drag on Chinese growth in future may ‘consumption’ of the pool of under-employed labour as the working-age population shrinks.

There are too many biases and factors that influence our consideration of Emerging Risks, and I’ve not covered them all by any means. But what I have covered should be enough to demonstrate that we need to be aware of these factors. The Strategic Planner and the Risk Manager's role is to look beyond what is within our day-to-day sphere, and look beyond the prejudices that we take for granted. 

Doing so will help us to more objectively assess the Emerging Risks on our registers. Objective assessment is the first step to present the case as to why any Emerging Risk warrants attention. Sometimes a watching brief is all that is required. For others, a “plan” on the shelf will speed and simplify responses. I know a Risk Manager whose organisation had a “Pandemic Response Plan”. It wasn’t much, and was focused on the risk of an influenza outbreak that would stop staff from coming to work, while concurrently increasing customer inquiries. They were able to take that plan off the shelves for the first few weeks of the Covid-19 Pandemic. They were also ‘lucky’ in that their IT department had a large stock of laptops in the process of being refreshed or ready for disposal, so there was more stock than at a ‘normal’ time.

Still, it was an initial plan that enabled them to respond quickly. The plan did not take significant resources to develop, and since testing was not possible, it remained theoretical. Yet having a plan did enable a faster response.

Why did they have that plan at all? Because they recognised that a health event (such as a significant flu outbreak) would happen. There was (and remains) uncertainty as to when an outbreak would happen, but they had absolute certainty that there would come a day when it would happen.

Uncertainty demands that we scan the horizons constantly, and that we consider what will happen when, not if. It demands that we look past the natural and human boundaries and prejudices that shape our thinking. It also demands that we prepare, enough at least, to be ready to respond, and not to be taken by surprise. 

It's all about the Target (risk assessment)

In my previous post I commented on the importance of adding a “Target” risk position to the traditional "Inherent" and "Residual" risk assessments, and the linkage to the Risk Appetite. More importantly, the “Target” level for any risk provides a focus on the future.

Let me explain.

Inherent to Residual: Inherent risk is the level of risk before remediation. This is important to ensure that we are focusing on the areas of risk that represent this greatest threat or opportunity for the entity. Inherent risk scoring is subjective, but then so is almost all risk scoring. Yet an assessment, subjective or quantified, of the risk before controls or other remediation ensures that we invest our limited resources on the areas that pose the greatest to achievement of the entity's objectives.

So we’ve assessed the Inherent risk, and we have applied controls for remediation, mitigation, etc. Now we have our “Residual” or “Net” risk position. Again, this is by nature subjective, and fraught with assumptions. But it does provide an assessment of our current state of risk and the level of risk that is being taken by or accepted by the entity. But this is subjective. And it will be wrong.

There will be too many missing controls, controls that are functioning ineffectively, mitigation that is unfocused or not in place. The assessment of the Residual risk position provides a snapshot of the current situation, with no insights into either the level of risk that is acceptable, the actual level of risk being taken, or the level and type of risks that the entity wants to take.

Target: And to we get to the “Target” risk level or assessment. What level of risk does the entity want to take, and what level of risk is acceptable. This fundamentally an assessment of the desired future-state of the risk environment that the entity wishes to work within. And yes, this too shall be subjective. It will also probably be achievable.

As Risk Managers we need to consider and advise on the level of acceptable or desirable risk to be taken or accepted by an entity, across the spectrum of risks. This means that we need to assess not only the raw (Inherent) risk environment and support the allocation of resources to highest or least desirable risk areas, and of course allocation of resources to those areas where we want to take risk. 

We also need to work with management to objectively assess the desired, or acceptable level of risk to take; the Risk Appetite. This should be done globally, and should be done at the level of each identified and recorded (and managed) risk. This is our Target risk level for each risk.

Now, and only now, can we meaningfully assess our “Residual” level or risk, and determine if that level of risk is appropriate. 

If our current (“Residual” or “Net”) equals our Target, then we are running at our desired level of risk. And if we are not, then we now know that our desired future state does not equal our current risk managed state for this, and all other risks where Residual does not equal Target. 

Example of Residual to Target tracking

In the example above, a number of interesting observations can be made, including that the Residual and Target risk assessments change, as risks are reviewed by the Risk Owners. It is also clear that Residual are Target are not the same. Within the data there will probably be a number of individual risks where the Residual assessment equals the Target assessment; the current risk situation for those risks equals the entity's Risk Appetite for those specific risks.

So why does Residual not equal Target? There are three possibilities:

1. Our control environment is ineffective and or does not include all the controls that are already in place to manage the risks (and these then need to be identified).
2. Our aspirational level of risk management for risk is too high.
3. Conversely, we are over-controlled (where Residual is lower than Target for specific risks) and we are potentially stifling the business through excess controls.

And when we determine that our Residual risk position does not equal our Target risk position, we have four option:

1. Accept that it will not be possible to achieve the desired Risk Appetite for this risk, and, through a Delegation of Risk Authority process, change our Risk Appetite and therefore our Target level for this risk to equate to the current Residual risk level.
2. Subtly different, but we may determine that the Risk Appetite is not right, and that we do want to accept, or take, more of this risk, and therefore change the Target.
3. Identify the controls that are not effective and implement improvement programmes or introduce new controls.
4. Confirm that we are over-controlled and look at which controls are not actually required, or are burdensome and should be replaced with monitoring controls.

What is the role of Internal Audit in this?

The Internal Audit function provides some assurance that the system of internal controls is effective. This requires Internal Audit to determine what areas of business activity they will review. This selection should be risk-based, which means starting with the risk register and consider a balance between this Highest “Inherent” risk areas, and the highest “Residual” risk areas.

As part of each Internal Audit, the assessed level of Target risk should be considered, and Internal Audit should then perform an audit programme designed to confirm (or otherwise) that management’s assessment of the effectiveness of controls is accurate. If the controls are effective, and these controls have been determined to bring the entity to within Risk Appetite, than Internal Audit’s role is limited to questioning the appropriateness of the Risk Appetite. (Note I say question, not set, as that is the role of senior executives and the Board, other others within their Delegation of Risk Authority).

Where the Residual risk level does not meet the Target, Internal Audit should be determining if this is because the controls are ineffective, or because the control environment provides inadequate coverage of the risk. In which case, new controls may be appropriate.

In all cases, Internal Audit should be determining if Management's assessment of the effectiveness of the control environment matches the evidence provide to Internal Audit. If management's assessment is correct, and there remains a delta between the Residual and Target, and senior management and/or the Board are aware, then there is no Internal Audit finding other than the fact that senior management and/or the Board are aware of the difference, and are aware of and support management's plans for remediation.

It's all about the Future

The core message however is that the Inherent risk position represents a “past” with no controls, the Residual risk position represents the present (as assessed by management), while the Target risk represents the future, or desirable control and risk management state, and is one of the enunciation of the entity's Risk Appetite.

The question we ask of Risk Owners is: What are you doing to get from the Residual risk position to the Target risk position, and when will you get there?