Alto42
Understanding Organisational Failure
THINKING ABOUT RISK
What do you think of when you hear the word "risk"?
Generally we do not think about happy things when we hear the term 'risk' being used however what we mean by this term is less clear. During my research I found dozens of definitions of 'risk'. In the end, the main thing that they all suggested was the possibility of something bad happening. They all raised the possibility of something unwanted emerging from the system or process.
"Hold on a minute" I hear you say. "Does not risk have upsides as well as downsides?" To this I would answer "it depends on how you make sense of the world."
I see my work from the perspective of Performance Management; in this world we discuss costs and benefits. Therefore, to me, all systems are about trying to accrue benefits but knowing that these come with costs. Some costs are definite and some are only a possibility. On the other hand you there might be a limit to the costs acceptable and we accrue all the benefits we can before that limit is exceeded.
In different fields, this idea has been expressed in different ways. Some environmentalists speak of "white outputs" (meaning the desired outputs of a process) while "black outputs" refers to the pollutants that are a byproduct of the same process. Erick Hollnagel encapsulates this idea more succinctly. He talks of success and failure (risk and reward/ cost and benefit) as being "two sides of the same coin". It is this view that I have adopted in my work. This means that whenever someone talks of benefits, I look for the risk, the downside, the cost, the unintended consequences and the subsequences.
In practical terms, I always found it easier to divide conversations into those things we want to happen and those things we do not want to happen or want to prevent that is, the wanted and the unwanted. I have found that, in this format and thinking of them as being two sides of the same coin, risk managers and performance managers were less likely to have misunderstandings.
Here are three ways that I have found useful to think about risk:
Risk Metaphors
First, and most common, is the use of metaphors
To see examples of Risk Metaphors click here.
Lines, Circles and Dots
Second, and largely unrecognised, is the fact that there are three distinct risk management paradigms used. Risk management is viewed differently within [1] project management, [2] process management and [3] accident investigation. I have labelled these Line, Circle and Dot.
For more details, see here
Seven Dimensions of Risk
Third, and barely recognised, looked at from a performance management perspective, there are seven dimensions to risk. These dimensions are more easily seen when examined through the lens of systems thinking. These dimensions are:
[1] Inputs risks.
[2] Transformation risks.
[3] Results risks.
[4] Effect risks.
[5] Consequence Risk.
[6] Subsequence Risk.
[7] Control Risks.
For more details, see here
RISK METAPHORS
Metaphors are commonly used, with hindsight, to explain the causes of accidents or corporate failures. The question therefore is whether these metaphors can also be used, with foresight, as part of an organisation's risk management process.
We see these metaphors (some of the most common are listed below), combined with the testing questions, as a powerful way to provoke you to see things differently and therefore help you foresee what might go wrong within your organisation. This seeing provides a first step within your risk management process.
COMMON METAPHORS:
Pyramids
Horses & Nails
Spider's Web
Icebergs
Rubber Bands
Questions
1
2
3
Are you familiar with these metaphors, and are you clear about how best to use them?
How might you use risk metaphors as part of your risk governance process in order to hold your executive to account?
How might you use risk metaphors as part of your organisation's risk management process?
Lines, Circles and Dots
In the table below I set out the three conflicting ways of seeing (paradigms) that are used as part of risk management practice. Each is valid in it own context however, when they overlap they do produce conflicting courses of action.
My point here is to alert managers to these potential conflicts so they they can manage these dilemmas effectively.
I acknowledge that there are likely to be overlaps between Lines, Circles and Dots within any particular system. Taking the example often used by authors of work in High Reliability Organisations, of naval aircraft carrier operations, it can be seen how the way we may see the issue will change between Lines, Circles and Dots.
If, as a first example, we take a specific carrier mission, the phenomena may be seen in context as a line: the carrier gets its mission, prepares, deploys, operates, returns and recovers. The sequence is seen as unique for this particular deployment and has a temporal linear context.
If the example uses flight deck operations, then this might be envisaged as a Circle. Here we would see planes being prepared, launched, conducting their mission recovered, maintained and then readied for the next cycle.
If we look at a pilot's mission: this might again be seen as a line. This would involve a unique briefing, aircraft preparation, aircraft launch, conduct of mission, recovery and debrief. Each would be unique for this particular mission, again based on a temporal sequence.
If, however, the discussion looks at accident prevention, then the paradigms may be Dot. An example may be prevention of accidents during the arming of aircraft. This examination would work back from the arming process and identify all the potential causes of an accident.
Even when looking at the same phenomenon, take for example aircraft operations, the unit of analysis can have a significant effect. If the unit of analysis is the mission planning cycle, while unique inputs may be considered, the focus would be on those aspects of the aircraft mission that are repeated; the paradigm would be Circle. If the unit of analysis was on a specific mission then, while some repetitive sub-routines may be included, the focus would be on those aspects which were “one-offs” and therefore unique to that mission; the paradigm would therefore be Line. It is therefore possible to see how the selection of the unit of analysis may alter the paradigms used between Line, Circle and Dot.
All conversations are partial and selective in the evidence employed and the use to which it is put. This selection can be seen also to determine the paradigm used to examine the subject in question. The danger for managing risk is that the conversation becomes confused leading to people, all with good intentions, working at cross purposes. This is likely to lead to organisational failures.
The Seven Dimensions of Risk
Managing risk is a truly complex issue. the probability of unwanted occurrences can occur at any time and within any part of the process. I have found that one way of helping me make-sense of the complexity is to divide the risk into, what I refer to as, their seven dimensions. These are:
[1] Inputs. These are the resources (including skills) that need to be assembled in order to produce the wanted outputs.
[2] Transformation. This is the process by which the inputs become the outputs both wanted and unwanted.
[3] Results. The results are the initial outcomes (both wanted and unwanted - here we are concerned with the unwanted ones) of the transformation process. For example, if the mechanism at play is the continual flexing of a structure due to natural phenomena such as wind, the result of this may be that the structure becomes stressed.
[4] Effect. The effect is the end product of the result on the entity causing the negative outcome. Taking the stress structure example from above, the effect of the stress may be that it induces part of a structure to fail.
[5] Consequence. A consequence is the automatic effect (the cascade effect) that will occur as the end product of the effect unless an intervention is made. Continuing the example from above, the consequence of part of the structure failing may be the total collapse of the structure.
[6] Subsequence. Here the term “subsequence” is “the consequence of a decision that follows an unwanted occurrence rather than being part of any cascade of events”. While it will be both wanted and unwanted, for the purpose of risk management it is the unintended unwanted consequences of decisions that we should be considering here.
[7] Control. These are the limits placed on the system to keep within acceptable boundaries and the mechanisms needed to ensure the boundaries are not breached.
Impact. The term “impact” is an overarching term that embraces all negative outputs relevant to the matter in hand. I use this only as a general term as it hides the complexity of what is happening
To me, the inner context is what is happening within the organisation and the outer context is what is happening in the world outside the organisation.
Discussion of the boundaries helps you define whether you perceive the problem at hand to be within a closed system (isolated from outside interference) or is part of an open system (vulnerable to the vagaries of others). It also should ferment a discussion over whether the organisation is looking for a specific win or whether the issue is about its long term survival. In terms of game theory this is about whether it is a finite or an infinite game: knowing this is a key factor in how you should 'play' the game.