Recently prepared for a speech to the upcoming ICSA conference
“It is difficult to make predictions,” the saying goes, “especially about the future.” Originating, apparently, with a Danish politician named Karl Steincke in the 1920s, the aphorism has been attributed variously to Mark Twain, Niels Bohr, Yogi Berra, Samuel Goldwyn, even Confucius. Which only goes to prove that success has a thousand fathers but failure is an orphan. That particular aphorism is widely attributed to John Kennedy. It comes from comments Kennedy made to NBC journalist Sander Vanocur in response to a question at a White House news conference following the Bay of Pigs debacle in 1961; except Kennedy actually said “Victory [rather than ‘success’] has a thousand fathers and defeat is an orphan. Kennedy was quoting fascist Italy’s foreign minister and aristocrat Galeazzo Ciano, whose wife, Edda, was the eldest daughter of Il Duce.
The problem is that when are dealing with business risk, we are inevitably dealing with an uncertain future, about which, as Steincke observed, it is difficult to make predictions; much depends on what we know. Famously, at a news conference following a NATO summit in Brussels in June 2002, then-US Defense Secretary Donald Rumsfeld observed, presumably off-the-cuff:
“The message is that there are no ‘knowns.’ There are things we know that we know. There are known unknowns. That is to say there are things that we now know we don’t know. But there are also unknown unknowns. There are things we don’t know we don’t know. So when we do the best we can and we pull all this information together, and we then say well that’s basically what we see as the situation, that is really only the known knowns and the known unknowns. And each year, we discover a few more of those unknown unknowns.”
Much quoted since then, Rumsfeld captured with customary eloquence part of the problem. But only part. And not necessarily the important part. Reading the statement out of the context in which he made it, it suggests that risk – that uncertainty – is fundamentally a knowledge problem; that with enough knowledge, we will manage uncertainty – that we will be ‘in control’. This is a misconception, albeit a remarkably common one.
Coming from the phenomenal achievements of the physical sciences, the assumption of cause and effect pervades most of our training and much of our thinking: the assumption that pursuit of ever-greater detail of knowledge will reveal the truth about the world. We assume that management thinking operates similarly; that by minimizing the gaps in our knowledge, we will conquer markets as we have conquered so many other of life’s challenges. The triumph of reason in the physical world can be replicated by its rigorous application to the business world; just as in science, measurement is paramount; measures are operable, they are useable.
The difficulty with this way of thinking is that it ignores the essential nature of business: it is a social activity conducted between people with all their talents and foibles. In his Nobel Prize acceptance speech, the great liberal economist Friedrich von Hayek emphasized the problem of what he called “organized complexity” – that social activities and the ‘social sciences’ or, more realistically, humanities that study them must deal with not only with the properties of the individual elements they encounter, but also with the relations between those elements. Or, because we attempt to organize people in a complex environment and because those peoples’ behaviour cannot be predicted, the relations between them are potentially unstable – in technical parlance, they can exhibit ‘positive feedback’.
As we find out more about the way in which individuals behave and react, we understand that even the assumptions of individual rationality breaks down. Psychologists have shown persuasively that individuals faced with decisions on action exhibit a range of biases and that they use ‘heuristics’ – essentially shortcuts – that mean that the decisions are not ‘rational’. This ‘irrationality’ amplifies the problems of social coordination but, evolutionarily, it seems likely we think that way for a reason.
Furthermore, the technological revolution ushered in by “cramming more components into integrated circuits” (the title of Intel founder Gordon Moore’s famous 1965 essay that gave us ‘Moore’s Law’) has given us globalized communication that has offered us greatly increased international trade and awareness of events, opportunities from all parts of the globe. But not without costs. The capacity for transmission of risks around the globe has risen concomitantly.
Adding pervasive social media ensures that the impact or consequence of an event may not be determined by what it effects but by how people react to those effects; reputational effects can dwarf actual effects; reportage and the collective force of individuals’ reactions – especially if accompanied by engaging video – can supersede ‘real’ consequences. A case in point: the staged beheading in August 2014 of US journalist James Foley by an (apparently) British fighter with the Islamic State of Iraq and Syria which shocked the world; Mexican drug cartels regularly decapitate rivals and post the video on the internet, almost unnoticed; witness the advent of “terrorism as theatre,” in the words of US security analyst Robert Kaplan. Context matters.
At present, we are struggling not merely with the after-effects of a global financial crisis of greater duration than the Great Depression and the breakdown of the post-WWII world order following the resignation on Christmas Day 1991 of Soviet President Mikhail Gorbachev and the evaporation of the former Soviet sphere of influence; these events are problematic enough – witness the disorder in Greece in 2012 and 13 and the current autumnal feel of the Arab Spring of 2011. As if these upheavals were not enough to contend with, we have a shift in global economic power to emerging economies, especially China and India, with the unpredictability that implies.
But surpassing all of these, we have an underlying shift in social organisation and power, societal expectations and mores and even life expectancy that is accompanying the technological revolution – what, in 1980, Alvin Toffler called ‘the Third Wave’. That revolution is beginning to be felt more keenly as we move from the early phase of automating industrial-age institutions and functions to the need to revisit and alter those institutions and functions to reflect a new, more interconnected reality.
As if these were not enough, courtesy of by-products of our industrial-era energy technologies and unprecedented growth, we have entered a period of history that biologist Eugene Stoermer and Nobel laureate chemist Paul Crutzen termed in 2000 ‘the Anthropocene’ in which human activities have “grown into a significant geological, morphological force.” The scientific debate around climate change highlights the difficulties of prediction identified by Karl Steincke; those difficulties seem to be growing.
In the case of climate change, proximate cause and effect are debatable; consequences are uncertain but a ‘direction of travel’ appears well established. Climate change is a physical phenomenon with identifiable – though complexly inter-related – causes. In contrast, the future course of events in businesses and markets are simply unknowable, a problem to which Donald Rumsfeld did not refer. But problems are not merely related to our quantum of knowledge; in social contexts there are uncertainties over the state of nature, intentions, ethical values and duties, even over meaning of language.
And yet, when it comes to seeking to manage risk in business, the dominant prescriptions call for ever-greater quanta of knowledge which are interpreted using deterministic and instrumentalist assumptions about the relation between action and consequence, between cause and effect – we have to ‘keep it simple’. The calls for ever-greater categorization of risks and standards for management of risks have grown from within the corporate world as well as by regulators. The role of management reporting of risk and assurance over management of risk has grown considerably as perceived uncertainty has grown. Recent UK regulatory guidance calls for companies’ boards to “determine their desired risk culture,” as if such a thing were determinable and would matter if it were.
In the wake of the financial crisis, leading organizational theorist Ralph Stacey stated:
“Recent economic events . . . must surely be making it very difficult for all but the wilfully blind to avoid questioning whether senior executives in organisations really can do what the dominant management prescriptions call for.”
Especially in risk, which necessarily deals with contemplation of the uncertain future, shifting relationships between people and within markets, transmission and amplification of the consequences of remote events and inherently unknowable outcomes, the “dominant management prescriptions” to which Stacey refers are unproved; they have not been shown to reduce risk or to improve sustainably corporate profitability. Furthermore, practitioners steeped in those prescriptions and the processes and routines they advocate resist staunchly – and often rudely – the suggestion that any such evidence is, at best, anecdotal or may be systematically biased.
We simply do not have any evidence that most current risk practice works or even that it focuses on what matters. We have ample anecdotal evidence, strong logical inference and, increasingly, evidence from experimental psychology and neurophysiology to show that the dominant prescriptions in risk management add little value, may detract from naturalistic managerial judgment and distort systematically attention to human relations.
Of course, we should not throw the baby out with the bathwater and drop all corporate risk routines. Nor should we jump on bandwagons which advocate managing the unmanageable, such as boards piously prescribing organizational culture. But we clearly need to reframe our risk practice towards an appreciation of the complexity of businesses as interacting human and social entities and recognize that people’s behaviour is of paramount importance to outcomes in corporate as well as political and economic contexts. Until we do, risk practice will continue to disappoint at the board table and the Cabinet table alike.
We need to seek out fact and attempt to acknowledge and adjust for systematic or individual biases; we should encourage full accounting for social cost including the costs associated with risk and uncertainty; we should acknowledge uncertainty and allow for it – indeed, plan for it and promote the need for flexibility and resilience against adverse outcomes, especially in strategy. We should overhaul our design of incentives to reflect a more nuanced appreciation of motivation and build in to the assessment of performance an awareness of the risk assumed in creating that performance and the cost of underwriting its potentially adverse outcome.
As recently advocated by the UK’s Financial Reporting Council, we should use stochastic methods to stress-test performance models and the assumptions on which they rest and explore plausible scenarios of adverse outcomes and failure. We should analyse and seek to understand and learn from failures rather minimizing their visibility for political convenience. Above all, we should encourage routines that call for proper questioning of the validity of assumptions and presumed relationships; we must understand that knowledge is not power or vice versa.
We need to acknowledge uncertainty and confront it directly rather than hide it away. Risk matrices and long lists of subjective estimates of risk do little to help.