Top 10 Technologies Disrupting Risk Management

Enterprise Risk Management by definition is the integration of an organisation’s risks for the purpose of assisting it achieve its mission.  Linking risk registers to objectives does little more than focus management’s thinking on the outcomes of their decisions. Implementing Controls is an expected compliance activity, not risk management. A ships’ pilot heeds channel markers, but it’s their skill is in reading the water and weather and choosing the most effective course, that decides winners and losers.  Even the most sophistication GPS navigation systems have yet to replace the navigator on a Volvo Ocean Race yacht.

I started this article by detailing the failure of current risk methodologies but then realized I was one of my pet hates.  That of focusing on the problem (like current risk management), not the solution. After a severe talking to myself, I have drafted out my vision of what risk management should look like in the 21st century.  This goes beyond what I listed in my 2013 book “Mastering 21st Century Risk Management”.

Why we need to rethink Risk Management

The World Economy Forum’s 2018 Global Risks Report succinctly observed:

“Humanity has become remarkably adept at understanding how to mitigate conventional risks that can be relatively easily isolated and managed with standard risk-management approaches. But we are much less competent when it comes to dealing with complex risks in the interconnected systems that underpin our world, such as organizations, economies, societies and the environment. There are signs of strain in many of these systems: our accelerating pace of change is testing the absorptive capacities of institutions, communities and individuals.

In a world of complex and interconnected systems, feedback loops, threshold effects and cascading disruptions can lead to sudden and dramatic breakdowns.”

Further, in one of the best insightful articles l’ve read in years, Oxford fellow Roland Kupers’ “Resilience in complex organizations” identifies the central issue that:

“In a deeply interconnected world, stresses and shocks propagate across systems in ways that evade forecasting. Climate change is linked to the Syrian civil war, which is connected to heightened concern over immigration, which precipitated Brexit.”

And the WEF report concludes:

“One of the aims of the Global Risks Report is to encourage individuals and organizations to think critically and creatively about how they can respond to a rapidly evolving risks landscape.”

The purpose of Risk Management in 2020’s

From these comments we can acknowledge that:

1. Acute risks evade forecasting
2. We need to be able to identify evolving risks
3. We need to be able to relate them to other areas of risk
4. The purpose of Risk Management is identifying how to respond rapidly to evolving risks
5. Critically and creatively responses require operational decision making
6. We need systems to enable rapid response to complex situations i.e. AI – Artificial Intelligence

This leads to the inevitable conclusion that risk management can only be Enterprise Risk Management since all risks interact with each other to alter their status.  This makes a mockery of the concept of static risk registers and risk matrix ratings.  This form of forecasting, in addition to being too subjective (a guess), is out of date by the time it is recorded.

If the purpose of risk management is to enable the rapid response to evolving risks, we need real-time systems for identifying and assessing risks, not periodic risk reviews.  Being rapidly evolving, by the time a risk control is developed and implemented the risk has most likely become an operational incident. You are better served by providing operational management with a range of 5 possible scenarios that will assist them with identifying both the direction of the risk evolving and possible courses of action.

It should be self-evident that with the complexity of today’s business environment risk management needs to sit firmly in operational decision making.  If you accept this is the case then the only solution is to implement AI – Artificial Intelligence, computer solutions that can advise operational management in real-time on cause and effect of changes in the physical, social and business environments.

The Role of Risk Management Units

In this new paradigm, the role of Risk Management Units in organisation should be the creation, evolution, calibration, and auditing of scenarios and decision making models, identifying and creating systems to monitor risk influences and drivers (which includes behaviour), and training operational management in modern decision making tools and framework (including bias and games theory).   In the 21st century, risk registers, use of arbitrary heat-maps, and devising impractical or unrequired risk controls to ward off threats, smacks of superstitious witch doctor hocus pocus.

In upcoming articles I will go into the practical ways of applying my top 10 technologies disrupting Risk Management, to achieve these 21st century risk management tenets, covering how to:

1. Bayesian Decision Networks for scenario analysis systems to provide operational management with decision making collateral,
2. Using Big Data to identify trends and evolving risks,
3. Create Neural Networks to identify, classify, and map interrelationships,
4. Implement IoT to monitor changes in environmental factors in real-time,
5. Exploit Deep Learning to monitor customer and staff sentiment, etc.,
6. Use predictive and augmented analytics to set up threat management & preventive action programs,
7. Explore how Blockchain trust systems could be used to obsolete Cybersecurity & Supply Chain risk
8. Harnessing Virtual Reality (VR) to gain a quantum leap in staff training and awareness ,
9. Replace laborious and inaccurate risk assessments & risk reviews with Robotic Automated Processes (RPA).

This will be the shape of management in the 2020s!