I've recently explored what risk is all about and the function of a risk department. Today I'll walk through three categories of how people handle risk, then introduce what I call The Three Ms as a way to jump-start your risk-handling ideas.
Handling risk isn't an all-or-nothing affair. There's a gradient of behavior that we can segment as follows:
Not Handling/Not Accepting: People and companies in this group handle risk by not handling it. They simply pretend that risk doesn't exist and that their intended outcome is the only possible outcome.
Handling/Accepting: This group is generally a healthy one. They respect the idea of risk and try to account for different outcomes.
Embracing: Instead of simply handling risk, this group employs it. They see situations in terms of risk/reward pairs, and then do their homework to evaluate whether a given risk is worth taking.
The middle region, Handling/Accepting, is usually the best place to start. If you're here, you've learned to map out a handful of scenarios beyond your intended outcome, weigh the probability of each of them happening, and also park some extra time and money as a cushion for the things you didn't consider. The so-called Unknown Unknowns.
Some folks are born with -- or, over time, develop -- an increased understanding of risk and migrate to the Embracing region. This is the realm of traders and other groups that make their money through speculation. (Technically, traders and similar folks make their money by hedging, which loosely means "positioning myself to win in all possible scenarios." But that's a story for another day.)
There is still plenty of dangerous territory in the Embracing camp but it's a sort of knowing, acknowledged danger. The other side of this risk is the possibility of an outsized payoff, something that is very large compared to the initial time, effort, and capital they put in.
The Embracing people do occasionally lose their shirt, though. They knew all along that it was one of the possible outcomes, and they prepared for it as best they could. You may joke that a risk-Embracing person can only lose once and then they're out of the game, but that's not always the case. You can spot a true Embracing person when they lose, recover, and immediately try another risky venture. They're practically wired for it.
Still, the dangers of the Embracing territory are nothing compared to those of the Not Handling/Not Accepting region. People here are most susceptible to surprises... and most of those surprises stem from an unwillingness to think about possibilities. (If you've already imagined it and weighed its impact, it's not a surprise anymore, is it?) Worse still, as risk is not a widely-known topic, most people and companies find themselves here.
Handling/Accepting people conduct their risk assessment and mitigation planning up-front. People in the Embracing crowd do that to a much more researched, calculating degree. Not Handling/Not Accepting people put all of their proverbial chips on their desired outcome. When the inevitable problem hits, they are forced into a reactive mode. They have to rely on their wits to sort out their risk mitigation in the heat of the moment.
As an individual, Not Handling/Not Accepting means to assume that everything will be perfect. It's a particularly poisonous flavor of overconfidence: they assume they've won out because they were right all along, even if it was really a matter of sheer luck. When they lose, they scramble to patch things up (and probably make a new mess along the way). The worst of them will skip over the cleanup and straight into denial, pretending that nothing happened.
Companies are made of, and led by, individuals, so the corporate form of Not Handling/Not Accepting is a larger-scale version of the individual case. You can usually spot this in the leader who assumes that shouting something enough times will make it a fact, or in the group that accuses someone of being negative because they have spotted a potential problem. A more subtle practice is for companies to "handle" risk by trying to fold every possible scenario into a contract, in excruciating detail, and then pass all of the problems off to the signing counterparty.
Hopefully I've convinced you to spend some time in the Handling/Accepting region of the risk-handling spectrum. To get there, you want to develop a habit of considering possible scenarios beyond your intended, desired outcome.
Sometimes you can do that by playing the role of Murphy, and asking yourself: what could go wrong? That's a great start. Map out your business plan and your processes, then ask yourself what happens if each piece along the way fails. "What if our supplier goes belly-up?" "What do we do if we lose our top three clients?" "What if the ML model starts emitting a lot of inappropriate answers to prediction requests?"
Other times, you need to get out of your own head, to conjure up scenarios beyond your existing knowledge. One option is to explore companies or industries that have done something similar to what you are doing, and see how they handle risk.
This works especially well if this industry has more at stake than you do. Such fields have usually been around a long time, so they have a lot of experience in what can happen (including, importantly, what can go wrong). That experience has forced them to accept that things can and will go wrong -- it’s tough to ignore history -- and they plan accordingly.
Consider Professor Stephen Rosen's take on innovation in the military. He suggests that people in the US armed forces can:
... seek out assignments which put you overseas, in contact with other people working on these problems. I spend a lot of my time talking to Indians. Why? They're facing the Chinese on their border. I spend a lot of time talking with the Japanese. Why? They're facing the Chinese and North Koreans, right across the straits. They're motivated and they're in a position to learn things that we may not see.
In other words: India and Japan have a lot to lose if their relationship with China falters. They must perform continuous risk assessments and devise plans for mitigation. If another country is at risk of a conflict with China, they can borrow ideas of scenarios and solutions from Japan and India.
This is one of many examples from what I call The Three Ms: Medicine, Money, and Military. Whether you are a hospital, an investment bank, or an army, most of what you do is a combination of "high stakes" and "high responsibility." These fields can teach us all a lot about how to approach risk.
(Long-time readers of this site will notice that I have drawn plenty of examples from the world of trading, plus a handful from military history.)
As a Three Ms take-home exercise: try to see your business through Professor Rosen's lens. Who are your competitors? What are your sources of existential threat? Who faces greater exposure to those threats than you? And what can you learn from them?
(This content is an excerpt of a future project on risk.)
Where Is Your Risk Department?
Every company needs someone to be their extra eyes.
Our Maturing Expectations of AI
As we learn more about AI, what will change about how we develop and deploy it?