Businesses routinely assume risk as part of their business model. Decisions are made to accept more risks to improve financial results, but the cumulative nature of these risks may not be monitored and acted upon.
The result may be that the risk profile is significantly raised over time, and the threshold when the cumulative risks become critical is missed. The current economic crisis is a perfect example.
A sea change in risk management is necessary.
The mere passage of time — without an explicit action — may increase risk. A product or process may be designed at one point in time, and the factors that influenced that design may have changed. For example, a trust may have been written at one point in time, and as the decades pass its purpose may become increasing irrelevant, and the current beneficiaries may have vastly different needs from the original ones. The risk of fiduciaries being sued by beneficiaries may increase simply with the passage of time.
Decisions that affect a business are generally made on a continuous basis. Individual decisions may involve very modest risk trade-offs. If the decisions involve risks that are isolated, that is one thing, but if they are connected, the result can be catastrophic. Knowing the difference in real time becomes the challenge.
Ideally, you would like not only to know when risks may be connected, but also to monitor them continuously to understand when a tipping point has been reached. This might permit you to avoid catastrophic risk. This may seem a daunting task, but there are two approaches that can help. One is to lower the risk profile of the business. The other is to build a model that would monitor cumulative risks.
In both cases, you would start with historical information supplemented with structured interviews.
Historical information can provide quantitative data and some tentative causal direction. Catastrophic events are often infrequent (and hard to predict), so review as much data, over as long a period of time, as possible. For each event, identify those individual actions that were related to the event. Some patterns may emerge. These actions may not have been individually significant, but they were cumulatively significant.
Actions across multiple events, of course, are not necessary labeled as isolated or connected, and not every single action is necessarily related to every other action. Structured interviews with those familiar with the business can help make those judgment and others. Experts may discern patterns. Those involved in the business may know why individual actions occurred.
Employees may know that certain actions are connected. They may understand why risks become cumulative. They may be able to articulate business, economic and cultural issues that encouraged the risk-taking. They may be able to explain or help explain the logic of failure or the root cause. There may be systemic causes that the historical data doesn't explain, but experts can.
Structured interviews can also produce essential data in building a useful model.
Analyzing the historical data may suggest opportunities to re-engineer the products, delivery or service associated with the business. For example, the data may indicate that certain products or features increased the risk profile of the business. It may be possible to modify the products or ensure that the price reflects the inherent risk.
After the re-engineering, it may be possible to build a model to predict how future actions may increase the business risk and when a tipping point is reached. Though not completely analogous, investment and credit-scoring models are widespread in business.
I am not suggesting this is an exact science, but you know historically what types of actions caused unwanted events. You may know some of the risk drivers associated with your business, and you may have a sense of the future. Why not leverage the information you do have to help you monitor cumulative risk?
