Techniques for Foresight & Risk Management

This is a continuation of last week’s discussion of risk management, which appeared under the title Risk Management for 2009 and Beyond.

Now let’s turn to some of the methods that can help you with risk management. Remember at the beginning I told you that risk management involved asking the right questions about what might happen in the future, and then making the best plans you can to deal with events that occur? So, how do you ask the right questions? The future is such a broad topic that you can’t usefully think about it all, all at once. Accordingly, if you ask vague, general questions about the future, you’ll get vague, useless answers. Instead, look for ways of breaking the future into manageable parts. I’m going to give you two ways of doing this, both related, with the second one of particular value for the kinds of risk management you do. The general process is called scenario planning, and the second part is called Wild Card scenarios. Let’s start with the overall process

Our society seems to feel that if you can’t decide exactly what’s going to happen, if you’re not prepared to be manly and decisive, then you are somehow defective. Yet, my opinion is: the future is inherently unpredictable, so why fail at something that’s impossible when there’s a better alternative? And that better alternative is to consider a range of possible futures, then think through how you would deal with each one if it happened – to come up with a Plan B to deal with a Future B.These alternative futures are called “scenarios” and this process is called scenario planning. The issue is not whether you will be caught by surprise by the future – you will – but by how quickly you recover, and how constructively you. Scenario planning was originally developed by the U.S. military for dealing with possible nuclear confrontations with the Iron Curtain countries. It was then brought to the corporate world by the RAND Corporation, and popularized by the publication of Herman Khan’s books, On Thermonuclear War and Thinking the Unthinkable. Over time, it was picked up and used by a variety of corporations, notably Royal Dutch Shell, which used it to successfully anticipate the Arab oil embargo of 1973, and became one of the very few organizations to successfully anticipate the collapse of the Soviet Union. In fact, Shell warned the CIA that the Soviet Union was on the verge of collapse in the late 1980s, but weren’t believed. In both cases, Shell made a killing in the oil market because they correctly anticipated events the rest of the market never considered.

I’ve written extensively about scenario planning elsewhere, so I won’t go into details on how to do it here.

Wild cards: expecting the unexpected

A wild card is a low probability event that, if it happens, can have dramatic consequences. Hence, the terrorist attacks of 9/11 were a classic wild card. The way you approach wild cards is by asking the question: “What could have dramatic effects on our operations that we’re not presently considering?” and then following through on the answers. So, let me ask you: what low probability event could have a dramatic effect on your operations?

A classic example of how to use wild card scenarios to expect the unexpected is Royal Dutch Shell’s determination that the Soviet Union was about to fall in the late 1980s. They approached the issue by asking the question: “What could have a dramatic effect on the price of oil?” One of the answers they came to was that if one of the major oil producing countries stopped producing, this could dramatically affect the price of oil. So, if, for instance, there were a revolution in Saudi Arabia, and the current government were replaced by an extreme fundamentalist Islamic government, hostile to the West, it might cause oil exports from Saudi to stop. However, another answer was if the Soviet Union, which was at that time, the world’s second largest exporter of oil, stopped producing. Once they had arrived at the possibility, they tried to decide what might cause this to happen. This means working backward from possible effects to possible causes rather than the other way around, and is the hallmark of using wild cards.

Ranking potential risks

Next, you’re going to have to decide which risks you’re going to contemplate and prepare for. There will always be more possibilities than you can consider in any detail, and since you can’t do everything, you should consider prioritize the risks you need to prepare for first. One way to do this is to use a concept from economics called “expected return”, or, in this case, “expected cost.” To do this, first you need to assign probabilities for each potential contingency or risk. These will, of necessity, be guesses, but they should be educated guesses, prepared by gathering as much relevant information as you can on each important risk. Next, you need to assess the potential harm for each risk, and then finally multiply that potential harm (in dollars) by its probability to come up with an expected cost. Hence, the formula is:

Total Cost of the contingency (in dollars) X Probability it will happen = Expected Cost (in dollars)

Once you’ve done this, you rank the contingencies by expected cost to give a rough, first cut at a priority list by ranking the contingencies by the size of the expected cost. Once you have this ranking, you should decide whether you agree that it makes sense, or decide that you want to make a judgment call to move some risks up or down your final ranking of potential contingencies.

Once you have this ranking, and you’re comfortable with it, you start working on contingency plans for each, working with the highest priority first, and preparing at least outlines of contingency plans for as many of them as you can manage. The detail you provide for each contingency plan will depend on how great the risk is, how high the expected cost is, and, frankly, how you will feel about the plan if the event actually occurs. There’s little point in creating a one-page contingency plan that won’t help you if the event actually occurs.

Using role-playing to flesh out potential risk scenarios

Finally, let me talk briefly about improving the contingency plans you create to deal with potential risks. I’m going to use the flu pandemic again for this exercise principally because many of you will already have made preparations for it.

Earlier I talked about developing a story for each scenario as a way of fleshing it out, and making it seem more realistic. Do the same thing for a defined contingency by creating a story line for it, as if you were predicting what was going to happen when, and then tell that story to your planning team. Next, have different members of your team take on different roles, not only of people, but of events, and then role-play their interactions. Hence, in the case of a flu pandemic, for example, you might have different individuals or groups playing the following roles, and describing their actions and reactions to events and the actions of the other actors:

o     Patients who are employees

o     Patient’s families

o     Senior management

o     Doctors & health practitioners

o     Hospitals

o     Public health officials

o     Politicians

o     The media

o     The uninfected public

o     The virus itself

The value of role-playing is that each participant can focus on one specific aspect of the scenario, and not worry about the others. This means that they are more likely to come up with thoughts that might not occur to them if they were trying to think of everything. As well, different actors can interact with each other in a kind of “Well, if you do that, then I will react by doing this” interplay that helps you explore how different aspects of the scenario might unfold. As actions occur to you, or further developments, make sure someone jots them down without interrupting the flow of the story so you keep track of new thoughts, but they don’t break up your momentum. You can always circle back and explore a new idea in more detail later on.

The future is always fraught with risks, both positive and negative. As I said at the outset, you can’t always make bad things not happen, although that’s the optimum result of scenario planning. What you can, and should, do as risk managers is make sure that you ask the right questions, contemplate the possible answers, and then prepare action plans to deal with as many potential risks as you reasonably can. You may not get a lot of credit for doing this when times are good, but when one of the risks you’ve defined happens, and your organization is prepared for it, you will look like a hero.

Foresight and preparation are better than shock and last-second reaction. Risk management is an under-appreciated activity that only looks good when things go bad. I wish you good luck, and God speed. Thank you.