Manage Strategic Risks for an Unpredictable Future

Mathematical statistician Nassim Taleb coined the term "black swan" to describe an event that is rare, unpredictable, and has an extreme impact.

According to Taleb, COVID-19 isn't one of those events. In fact, he says it's a white swan because, though catastrophic, it was predicted and not rare at all: dreadful, contagious diseases are, unfortunately, pretty common. Indeed, he says, the long list of epidemics over the last couple of decades -- Ebola, SARS, MERS, Zika -- should have woken leaders up to the inevitability of this crisis. In other words, we were warned.

So why did we fail to see this coming?

Partly because humans are notoriously bad at envisioning their future selves, and partly because we lack any incentive to. If we're focused on quarterly returns, storing up talent or money for an as-yet imaginary event is counterproductive. That's completely natural, but it's bad for business: a survey Gallup conducted before COVID-19 showed that only 22% of employees strongly agree they could take risks at work that could lead to important new products, services or solutions. And a 2014 Corporate Executive Board report showed that auditors spent only 6% of their time analyzing strategic risks, but that the likelihood that strategic business risk failure would lead to significant losses in market value was 86%. Auditors spent most of their time on operational and financial risks.

Better strategic risk assessment should, obviously, be built into recovery plans because Taleb is right --whatever their color, these swans bite. But managing strategic risks has to extend beyond CEOs, CFOs, risk managers and chief strategy officers.

Leaders need to harness the collective intelligence of the entire organization to create a new risk management infrastructure -- and these four key strategies get risk management right in an incessantly disrupted world.

Strategy 1: Consult a broader range of risk measures.

Risk managers typically assess a range of measures to project potential risks. Among these is Value at Risk (VaR) -- a statistic that measures and quantifies the level of financial risk within a firm or portfolio over a specific time frame. But, as famed American investor David Einhorn said, VaR is like "an airbag that works all the time, except when you have a car accident." That's not a ringing endorsement of this risk measure.

Predictive analytics help leaders see the causal connections that lead to problems before they become crises. The challenge of black swans, however, is that they can't be predicted. So, Gallup delved into our global database of more than 70 million employees and identified 10 critical questions to assess the health of a culture. The answers to these questions represent the experiences and voice of the employee -- which makes it plain that culture is an inherent risk driver -- and predict positive business outcomes in wellbeing, engagement, and insights to better approach the harder elements like compliance, disruption, and performance management.

Executive leaders should recognize those 10 questions as fundamental to an effective risk register.

Built well, that register avoids one-dimensional, low-fidelity risks and ensures clear risk definition -- ideally, a comprehensive list of key risk indicators including subjective, yet highly predictive leading indicators of potential risk.

A January 2020 World Economic Forum paper outlined two sets of metrics for sustainable value creation, a core set of well-established quantitative metrics that typically exist in most organizational reporting and a set of "expanded metrics," like culture, that convey a wider value-chain scope or impact in a more sophisticated and tangible way.

These critical metrics need to be measured, monitored, and fixed when broken, as do the risk indicators that VaR points out. But highly functional risk measures take a holistic view of quantitative and qualitative measures and put all potential risks in sight.

Strategy 2: Pay specific attention to human-capital risks.

Agency risk is "the risk that the management of a company will use its authority to benefit itself rather than the shareholder." The management in question could be leaders, managers, even front-line employees in some circumstances, and the threat they present depends on how closely aligned their interests are with those of the organization.

Some employees -- the actively disengaged -- might deliberately sabotage their companies.

Taleb, who began his career as an options trader (and still calls it his "core identity") says, "managing without buffers" is dangerous because "fat-tail events" like COVID-19 can never be completely avoided -- employee engagement is an extremely effective safety device.

That said, risk taking can be less risky than risk-aversion. Our research showed that 71% of engaged employees strongly agreed they could take risks at work that could lead to important new products, services or solutions.

Among actively disengaged employees, that number drops to a miserly 2%. So, engaged employees are 36 times more likely to take the kind of risks that can lead to breakthroughs. In other words, a high number of disengaged employees puts companies at risk of serious decision-making mistakes -- whether of commission (doing something that should not have been done) and omission (doing nothing).

The actively disengaged will likely ignore key opportunities after COVID-19 -- an agency risk in reverse -- but are still quite able to cause catastrophic damage as a result of overlooking them. So much so that active disengagement should be considered not just a productivity risk, but a significant business threat.

CEOs and boards that ignore these do so at their own peril.

Threats to wellbeing are another form of human-capital risk because wellbeing is so closely associated with engagement, which is aligned with productivity and profit.

And as Gallup research indicates, employees with thriving wellbeing have 41% lower health-related costs, which can mean a difference of $30 million for every 10,000 employees.

Strategy 3: Develop leaders to become effective risk-takers.

It goes without saying that good leaders take good risks -- but in a bad economy, leaders are liable to be more worried about failing than hopeful about succeeding.

That's understandable but untenable, so risk-management education in leadership development needs to evolve to meet the needs of this highly unpredictable and dynamic environment.

The most important lessons in risk mitigation are the most powerful -- and the opportunities to learn are immense right now.

Leadership development programs should capitalize on that and help emerging leaders see this environment clearly, objectively and, most of all, holistically.

Development should stress-test leaders' beliefs and possible biases, teaching leaders to define potential risks objectively and rigorously and engage their broader constituency to understand the real cultural determinants of these risks.

Strategy 4: Seek broader input.

Noted above is the small percentage, just 22% of people, who strongly agree they are encouraged to take risks that can benefit their organization. When examined by role, that group includes 26% of managers and even fewer front-line workers, at 18%.

Not even half of all leaders could agree, only 48%.

Such low numbers suggest few people feel welcome to contribute ideas that could make their companies more agile, more responsive to customers, more engaged, more safe -- or more well.

In fact, leaders need all the great ideas employees can muster. When budgets are tight, employees have to be more productive with fewer resources to capture a greater share of the budget.

Disinterest in employees' opinions is dangerous because it deters them from offering ideas that mitigate risks or enhance wellbeing. Inviting input, however, demonstrates that leaders care about their people, what their people think, and that the organization is truly "in it together."

And it's a significant return on investments made in human resources.

A larger pool of ideas from around the organization relieves a bit of the burden on leaders, too. Leaders can't see every danger or contain every threat, and they don't have the solution to every problem. Sometimes crowdsourcing new ideas offers the best protection against inherent risks.

The Future of Risk Management

Which brings us back to where we began. No matter how well-developed the leader is, no matter how wide or detailed their view of the threat environment, every leader is human. And our brains and professional infrastructures work against good risk management.

In 2015, Bill Gates said in a TED Talk, "If anything kills over 10 million people in the next few decades, it's most likely to be a highly infectious virus rather than a war. Not missiles, but microbes."

The Center for Infectious Disease Research and Policy at the University of Minnesota reported in 2007 that we average three pandemics a century -- noting that "the 21st century could still give us just one pandemic -- or five." -- And still, we were disastrously unprepared for it.

Since we can't rely on ourselves, we must make better risk assessment a core competency of leaders. We need to create accountability for the most significant risk exposure through clear policy structures and expertly designed procedures, metrics, measures and monitoring.

And we need a much richer understanding of human-capital risk, the cost of myopia, and operational failures, too.

The risk assessment competency should be a shared responsibility, shouldered by managers and employees at all levels, not just leaders and risk professionals.

Front-line employees might not necessarily have foresight, but they have invaluable insight into the current reality -- and how it shapes the business' future reality. That creates a strong culture of resilience but also a culture of innovation and opportunity maximization.

Taleb is becoming increasingly irritated by people asking him to predict the next black swan -- the thing about black swans is that they can't be predicted. But we all know one is coming eventually.

We need to build a future that can cope with black swans and white ones, and the best way to do that is through better risk management.