A success database for risk management
The corona crisis has made it an oft-used term: the prevention paradox. Opponents of corona measures cry that corona is not that bad, because the number of sick and dead is not too bad for a pandemic. And so, either no measures are needed or they are not proportional. Proponents indicate that the number of dead and sick is relatively small precisely because measures have been taken.
The prevention paradox
By the way, I read that "prevention paradox" is not the correct term for this situation, but is actually a self-refuting prediction. The correct description of the prevention paradox is that (medical) measures should not necessarily be focused only on the higher risk category, but on the entire population, because the high-risk group is relatively small and therefore so is the effect of measures*. Since the prevention paradox is well known as first described, I still use that description as a starting point.
You sometimes hear the prevention paradox even from critics of risk management. Something serious rarely happens so why is risk management, with its time-consuming risk assessments, necessary? And additionally, if something does happen, it was not predicted and/or it was not prevented. How many risk managers predicted the corona crisis? See here the prevention paradox in the risk manager's practice.
Perhaps you recognize these critical questions. But how do you deal with them? Do you explain the principle of the prevention paradox and try to make it clear that risk management has probably saved the organization from major disaster? If so, do you have concrete examples of what has been prevented by your efforts? Or do you leave the discussion for what it is?
The usefulness of risk management
It is notable, however, that such discussions occur mainly in the case of non-financial risks (enterprise risk and operational risk) and less in the case of financial risk management. Hedging currency risk or interest rate risk is rarely discussed.
It is difficult to demonstrate what has been prevented by risk management because it cannot be said with certainty that a particular event would occur. And if the event has demonstrably occurred, it is not always possible to demonstrate what damage has been prevented by risk management, with obvious exceptions. Consider, for example, the advice to take out absenteeism insurance, after which absenteeism increases. The usefulness of the measure is then clear. But this situation will not come up often, and how often does a risk manager monitor and record the success of his advice?
In the financial sector, partly due to legislation, it is more common to keep a so-called loss database of losses that occur due to operational errors (among other things, to calculate the capital to be held for operational risk). A decrease in losses can demonstrate the usefulness of risk management. But a benchmark with this loss database can also demonstrate this. There are parties that map this for the financial sector.
From losses to opportunities
Alternatively, you could focus not only on reducing losses, but also on identifying opportunities that can be used to achieve organizational goals. Perhaps you have alerted the organization to opportunities to increase sales or customer satisfaction.
And of course: ideally you work in an organization with a culture in which risk management is lived and experienced. And that risk management is something that is embraced by the entire organization. But that is far from being the case everywhere. For other parts of the organization it is quite normal to show successes: the achieved sales targets, the decrease in absenteeism, the higher customer satisfaction scores. So why not for risk management? In short: having your own "database" of risk management successes may not be such a crazy idea.
I look forward to hearing your thoughts on this. If you have any good tips of your own to demonstrate the success of risk management, please let us know and we will include them in a follow-up to this blog.
Final tip!
Also let it be known that risk managers are not forecasters. A nice example is this article from the Harvard Business Review (read the editors note).
Marc van Heese
Managing Partner ARC People
