Before being able to manage risk, a manager must know how much risk is acceptable, and conversely at what stage to cut his or her losses. This appetite for risk is not self-evident. It is a philosophical choice, an issue of comfort with the frequency, severity, uncertainty and correlation of potential events. Risk management is evaluated and achieved through the simple process of thinking, planning and doing.
RISKY THINKING
Different individuals, and different groups, have different preferences. Some people enjoy mountain climbing, comfortable with the knowledge that they are hanging from their fingertips high above the ground from a small crack in a wet rock face. Others prefer the safer comforts of gardening. Each is an example of risk appetite.
"Critically, risk aversion does not necessarily make you safer."
In the financial world, risk appetite simplifies to how much money an organisation is prepared to lose before it cuts its losses. In life and death situations, it is the frequency with which a certain event results in death – the frequency and severity of fatal terrorist attacks in London, say. In some cases it is defined externally. For example, on North Sea oil rigs it is defined through legislation. Events that cause death more than once in 10,000 years are not tolerable, and rig operators must mitigate the risk of any event with odds worse than this.
PLANNING FOR THE BIGGER PICTURE
There are two parts to risk planning: a strategic plan that matches resources and risks; and a tactical plan that assesses all the risks faced and details the response to each one. The first part is the big picture. If, for example, you have decided that the frequency, severity and uncertainty of suicide bombings in London is too great, the big picture is that you need to change your life and move out of London, incurring whatever costs this requires.
"Anyone who fails to manage risk in an extreme environment tends not to last too long."
For organizations, the big picture has to dovetail with the overall business strategy. For example, although low-cost airlines need to be cheap, they cannot afford to cut corners on safety. Valujet discovered this when it was forced to ditch its brand following a catastrophic crash in 1996. Similarly, although the high command of the US Army Rangers recognizes that they operate in very dangerous, potentially fatal environments, they have adopted a policy of 'no man left behind'.
This helps to ensure that in combat, Rangers are less likely to surrender or retreat. Consequently, airlines spend a lot on safety, and armies spend a lot on search and rescue capabilities.
The next stage is detailed planning. First, identify all the risks, all the things that might go wrong. Then assess and compare them to see which ones are the most likely and the most damaging. Finally, set out what to do, who is going to do it and how much it will cost.
California’s state-wide disaster planning process is an excellent template for responding to extreme events, perhaps because of the high frequency of all manner of major incidents there – earthquakes, tsunamis, floods, wildfires, landslides, oil spills – you name it.
State law specifies the extent of mutual aid between local communities, and requires each community to appoint a state-certified emergency manager. Each emergency manager creates a detailed disaster management and recovery plan for his or her local community, reflecting local issues and needs. These plans are audited by state inspectors and rolled up into a state-wide plan. The plan is then passed into the state budgeting process to obtain the necessary resources.
BALANCING APPETITIES
Critically, risk aversion does not necessarily make you safer. Many people or communities express a low-risk enthusiasm but baulk at the expense of reducing their risk to match their appetite. They simply hope that the rare event doesn’t happen. However, in the end, even rare events occur. The results of mismatching risk appetite and resources were devastatingly demonstrated recently as Hurricane Katrina smashed into New Orleans.
Conversely, a large risk appetite is not the same thing as recklessness. A counterintuitive aspect of risk management in extreme environments is that although the individuals concerned are very comfortable with risk, they come across in conversation as somewhat risk averse. While they accept risk in the sense that ‘everyone dies sometime’, they work hard to eliminate or mitigate tangible risks as far as they can.
Anyone who fails to manage risk in an extreme environment tends not to last too long. One former UK Special Forces officer relates the following episode:
"We were in the back of the Land Rover, expecting contact [battle] any minute. Everyone was quiet, going through the plan in their heads, controlling their fear – except for one bloke at the back, who was mouthing off. He hadn’t been in a fight before and I guess this was his way of compensating. I decided that the first thing I would do when we got out of the Land Rover was hit him in the head with my rifle butt. He was too dangerous; I couldn’t accept the risk that he posed to the operation." Gareth Owen, the head of security at Save the Children, is pithier. "Mavericks don’t last," he says.
TRAINED TO DO
'Doing' is a combination of activities. Before an event, 'doing' means being prepared. This consists of recruiting, training and rehearsing response teams; acquiring and positioning the appropriate equipment, communications systems and budget; and ensuring that both the public and the response teams know how to react effectively. After an event, 'doing' means keeping your wits about you while implementing the tactical plan, managing the inevitable and unexpected events that crop up, and if possible, collecting data on the experience.
"In the financial world, risk appetite simplifies to how much money an organisation is prepared to lose before it cuts its losses."
Once the epidemic has broken out or the earthquake has hit, the key is not to panic. Colin Sharples, a former Red Arrow acrobatic pilot and now head of training and industry affairs at Britannia Airways, observes that instinctively "your mind freezes for about ten seconds in an emergency. Then it reboots". Frozen individuals cannot help themselves or others.
To counter this instinct, pilots are required go through a continuous and demanding training programme in flight simulators which "covers all known scenarios, with the more critical ones, for example engine fires, covered every six months. Pilots who do not pass the test have to retrain".
BREATHING SPACE
In addition to providing direct experience of extreme conditions, such training also increases skill levels to the point where difficult activities become routine, even reflexive. Together, the experience and the training allows team members to create some ‘breathing space’ with respect to the immediate danger. This breathing space ensures that team members can play their part and in addition preserve some spare mental capacity to cope with unexpected events.
The importance of this ‘breathing space’ reflex reflects a truth about many extreme situations: they don’t usually start out that way. Rather, a ‘chain of misfortune’ builds up where one bad thing builds on another, and the situation turns from bad to critical to catastrophic. First, something bad happens. For example, a patient reports with novel symptoms and doesn’t respond to treatment. Then the person dies then one of his or her caregivers dies too. Then one of his or her relatives ends up in hospital with the same symptoms, and so on.
A team with ‘breathing space’ can interrupt this chain by solving the problems at source as they arise, allowing them no time to compound. For example, a cautious but curious infectious disease consultant might isolate the patient and implement strict patient/physician contact precautions before the infection is able to spread.
CLOSING THE LOOP
Once the situation has returned to normal, risk managers must close the loop and evaluate their response. Using information collected centrally and participants’ own experience, each part of the plan is evaluated against its original intention. This debrief can be formal or informal, depending on what works best. Sometimes it might even be public, such as the Cullen enquiry into the disastrous Piper Alpha North Sea oil platform fire in 1989, which cost 165 lives.
"Once the situation has returned to normal, risk managers must close the loop and evaluate their response."
Where performance was bad, the group must question whether the cause was local – training, procedures and equipment – or strategic. Perhaps the situation was riskier than the organization was able to afford or tolerate. These conclusions feed into the next round of thinking and planning.
Thinking, planning and doing are usually group activities. Group structures vary from place to place, but usually there is a community at risk and an authority that manages that risk. In addition, there are usually various levels of authority, operating in a hierarchy. The upper levels of the hierarchy, such as national or provincial governments, dictate standards and maintain surplus people, equipment and money.
The lower levels, such as cities or national parks, comply with the standards so they can call on these extra resources if they cannot cope by themselves. For example, city and state disaster management plans in the US must comply with US Federal guidelines if the city or state wants the option of asking for Federal assistance in an emergency. Since each level maintains both plans and response capacity, thinking, planning and doing takes place at all levels of the group. This creates major challenges in coordination.
Managing Risk in Extreme Environments, by Duncan Martin, hardback, 192 pages, £29.99, published by Kogan Page, www.kogan-page.co.uk
| 
