Risk is culture

A #bookin2days client is writing a book about risk. The book he recommended is “Risk: A User’s Guide” by General Stanley McChrystal. His “Team of teams” is a classic.

Can you afford to lose

Using examples such as the COVID-19 pandemic, the Cuban crisis, Blockbuster, war stories, special forces, Boston, and Napster. COVID, the Cuban Missile Crisis, blockbuster movies, war stories, special forces, Boston, and Napster. The United States military is an intensely risk-averse entity. Charged with the defence of the nation, the armed forces cannot afford to lose. You need to think about that. Can you afford to lose?

You are not defenceless.

Our weakness is the real threat. Failing to plan/prepare is planning to fail. Organisations fail to mitigate risk because they focus on the probability of something happening—instead of what they can do about it. The greatest risk to us is us.

Ten dominions

We  have dominion over ten key dimensions that we can adjust at any given time to take control over our response: 

1. Communication. How do we exchange information with others?
2. Narrative. How do we share with others who we are and what we do?
3. Structure. How we design our organisations and processes.
4. Technology. How we apply machinery, equipment, resources, and know-how.
5. Diversity. How we leverage a range of perspectives and abilities.
6. Bias. How the assumptions we have about the world influence us.
7. Action. How do we overcome inertia or resistance to drive our response?
8. Timing. How we act affects the effectiveness of our response.
9. Adaptability. How we respond to changing risks and environments.
10. Leadership. How we direct and inspire the overall Risk Immune System

Look inward

It is simple. Detect threats. Assess the risk they represent, based on our own vulnerabilities. Threat × Vulnerability = risk. Respond to avoid or mitigate any negative effects of the risk. Learn so that we are well prepared if the risk reappears. Change your approach from one that is focused on external factors to one that looks inward at the factors that determine our own response. If you have no vulnerabilities, threats don’t matter.

Your Risk Immune System

So you need to develop your Risk Immune System. In reality, risk is neither mathematical nor finite. Its impact depends to a great extent on how we perceive, process, and respond to it. We must learn to live with risk, and even better, do something about it.

What is risk

Risk comes at you from out of the blue, from every angle, when least convenient. There is a cost to both becoming overly focused on risk and ignoring it. And the sweet spot between the two extremes moves with the circumstances around you. There’s something highly subjective about how we consider risk, both individually and collectively. At the most basic level, it is the probability of something unwanted happening and the potential consequences if it did. You should take steps to mitigate the impact of a negative event. You need to maintain the agility to react to changing conditions and emerging threats. Risk is theoretical, psychological, emotional—an unreal bolt of lightning that always hits someone else. Until it doesn’t. Even if we were to determine mathematically what the best move is, we can’t ever account for all factors, and in a fast-moving, complex environment, such an approach would likely increase risk by giving an illusion of completeness impossible to attain. In the end, the real question is not one of odds but attitude: How should we think about risk, and, even more important, how should we react to it?

VUCA

You can use decision theory, dual-process theory, game theory, and expected utility theory and leverage technology to calculate probabilities. However, the focus should be on the capabilities that we can apply to alleviating the risk. It is all about behaviour. Behaviour starts with communication. In a VUCA world, this is a significant issue for businesses. Understatement is ignored, and exaggeration is discounted. Exponential is a hugely difficult concept to explain. Staying situational aware is a challenge. Assessing the impact is hard due to the complexity of the environment we are all operating in. There’s no perfect formulaic approach to determining risk, nor is there an effective checklist to avoid or mitigate it. There is always a black swan somewhere.

Risk is culture

Dealing with risk is part art, part science, and always depends heavily on the personality of an individual or the culture of an organisation. An essential first step is to accept the reality that the greatest risk lies inside you and your organisation. To this end, understanding how you perceive risks is fundamental. It begins with opening your senses and suppressing the biases that cause you to ignore or discount many risks. While risk is often portrayed mathematically, our response to risk is more often instinctive. Understanding the factors that drive how we think about and act upon risk is critical.

Communication

Clear, concise, accurate, and timely information is hard to come by. If we can ensure or facilitate the flow of information and dial in the relevance, accuracy, and timeliness of that information, we can increase the effectiveness of our ability to deal with threats. For communication to be effective, the message transmitted must be accurate and timely, and the recipient must understand. There are four key “tests” that determine if communication is effective:

1. The physical ability to pass the information (can or can’t)
2. The willingness to pass it (will or won’t)
3. The quality of the message (accurate, complete, timely, relevant)
4. The receipt of the information (able or unable to digest and understand the message)

Symptoms of communication challenges 

• Failure to transmit.
• Failure to receive.
• Lack of a pathway. More common in earlier days with less sophisticated technology, the physical inability to share information in a timely fashion often results in uncoordinated efforts.
• Misunderstood message(s).
• Overloaded communications. An excessive volume of information can cause a truly essential “signal” to be lost in the “noise.”
• Distorted or corrupted message(s).
• Intentional misinformation. Information is intentionally corrupted to deceive or confuse, as in propaganda and in similar efforts.

Communication is culture is narrative

Communication is also culture. What individuals and organisations believe about themselves drives their values, beliefs, and actions. How we perceive ourselves—and tell our story—has a significant impact on our behaviour and determines outcomes. And that is narrative. Narrative is the story we tell ourselves—often about ourselves—and it has a defining quality. Built on a foundation of stories and related values and beliefs, narrative gives shape and meaning to individuals and organisations and transcends sterile structures. It drives who we are, what we do, and why we do it. It is the combination of narratives together that provides the purpose necessary to maintain commitment. It is almost never about the paycheck. Just as beauty is in the eye of the beholder, narrative is the resounding message that explains purpose, meaning, and mission. A shared narrative enables us to unite around a common purpose.

Symptoms of narrative misalignment 

• Cynicism.
• The “Say-Do” gap. Leaders espouse one thing—and then do another. Lofty values sound good, but employees know when the bottom line and other interests trump ideals. And most resent it.
• Muddled priorities.
• Tensions. Misunderstood or conflicting narratives can undermine confidence and commitment.
• Brand damage. Untrue or ineffective brand narratives. The contradiction baked into our own narratives invites unforeseen risk, and when our unifying ethos isn’t aligned, the threat may even become existential.
• Narrative drift
• Different perspectives of the terrain/map

Structure

Organisational design eats culture. Clock speed is everything. Guiding principles enable that. Symptoms of structure problems are :

• Unclear roles and responsibilities.
• Duplicative Efforts. An ill-defined organisation leads to multiple parties.
• Gaps where seams should be tight.
• Tortured communications. Information travels painfully slowly through the labyrinth—typically too late to address the need.
• The longest chain. You have to get approval from your boss’s boss’s boss—and you’re not even sure who that is.
• Overdependence on CROs. It creates a psychological concept known as moral licensing. You might also want to read “Overdependence on CROs. It creates a psychological concept known as moral licensing. You might also want to read “The Unaccountability Machine“.

Technology 

We live in a society exquisitely dependent on science and technology, in which hardly anyone knows anything about science and technology. It raises a new question: Who or what is in control? Is the tail wagging the dog? That’s why it’s important to have a plan for incorporating new technology into your workflow in a way that’s smooth and transparent, and that emphasises the technology is intended to make everyone’s life easier, not harder. And sometimes technology sucks. Experience shows us that this increased reliance upon technology carries serious risks.

AI

For example, the perceived benefits of AI can often be a false economy, where decisions are unconsciously shifted away from careful processes or human interaction is impacted, and added costs—financial, reputational, and otherwise—invariably arise. Ceding the ability to manage relationships to an algorithm, we’ve rolled a dangerous die. Sometimes speed kills.

Study your reliance on new technology

You should study not only how you are adding technology, but more importantly, how you are relating to it. Acknowledge differences, limitations, and opportunities. Test your own assumptions, ask questions of your team about their perspectives, and then ask again. For example, technology, as we are all aware, requires constant updates. We can never arrive at a final technological solution—seemingly perfect products are often improved upon years, or even months, later. As a result, the technology Risk Control Factor works in a similar way—it requires frequent updates and recalibration on how much technology we employ, as well as how much human influence, through judgment and wisdom, we incorporate.

Diversity

If you don’t see and address a problem from multiple perspectives, you’ll miss something—and it may be the critical thing. Diversity, unlike equality, is not a legal right. But while diversity is not a right, it is right because it works. Diversity can be a powerful strength for any organisation, and the difference between winning and losing. The symptoms of diversity challenges are 

• Stale preservation of the status quo.
• Finger-pointing.
• “Why didn’t I think of that?” A classic indignant question asked when a diverse perspective outside the team breeds a better, more creative idea.
• “Who could have known?”
• Outpaced by innovation. Diversity brings a freshness of ideas—organisations that lack diversity are slower to innovate.
• Groupthink. Logically, organisations with members who share similar profiles will likely have more thought patterns in common than organisations that are more diverse in their composition. The antidote to groupthink is diversity—including differing perspectives in the decision-making process. 

The risks we encounter in today’s environment increase in speed and complexity, and your Risk Immune System must seek and operationalise diverse opinions to best compete and survive. Also read “Diversity”.

Fusion cells

The use of fusion cells to achieve connectivity, synergy, and, most importantly, diversity in a unified effort has been widely adopted by military organisations and governments alike. The name informs their function: fusion cells fuse intelligence across handfuls of personnel within different agencies and military units. Fusion cells aren’t only helpful for hostage rescue and terrorism prevention; they can be invaluable for any team that needs to rapidly share information and benefit from a diverse perspective.

Bias 

Filters distort. Just because we believe something doesn’t make it so. Biases are as old as humans, and in some ways have been essential to our evolution and survival. Symptoms of common types of biases are:

• Common information sampling bias. The bias to spend more energy and time on information everyone already knows, rather than information that is new and could likely be helpful.
• Confirmation bias.
• The halo effect. The bias to view someone favourably, regardless of their actions.
• Status quo bias.
• Hindsight bias.
• Plan-continuation bias.The bias to not alter the course of action when situations change.
• In-group bias. The bias to think those within a group are superior to those outside of it.
• Ignoring complexity.
• Making it personal.

Consider how bias impacts and often complicates the functioning of your Risk Immune System. At the end of the day, we can’t choose to have or not have biases—we have them. So we must identify and carefully consider them. Apply assumption checks. Do red team exercises. Make people accountable. Apply extreme transparency.

Action 

Typically, for anything to get done, someone has to actually do something. There is no action until inertia is overcome. In the most basic terms, inertia tells us that, absent external forces, things will keep doing whatever they’re doing. Inertia can be defined as a bias toward inaction or changing course.

Consider the coefficient of friction

Simply put, the coefficient of friction is a factor derived from experimentation that reflects how much force is required to either move an object that is at rest or continue moving an object already in motion across a given surface. When something is static, overcoming inertia to begin movement can require significant force, and when you can control or manipulate other factors (affecting the coefficient of friction), you have the ability to facilitate or prevent movement. That’s where the secret lies. 

Symptoms of action—or inaction

• Slow reaction time.
• Missed chances.
• Contradictory efforts. Teams experience whiplash when actions conflict and distract from a goal.
• Playing catch-up with competitors. 
• Analysis paralysis.
• Reactive posture. We tend to react (sometimes emotionally) when we are not properly positioned for action.

Velocity is defined as “the rate of change of position along a straight line with respect to time,” or, more simply, the speed of an object as it moves in a particular direction. Action and other Risk Control Factors are invariably interconnected. For example, communication is often necessary to act, while narrative and bias either enable or inhibit our ability to act effectively. It’s a complex system, but ultimately, if we can’t overcome our coefficient of friction, the gears won’t turn.

Timing

The ability to make our responses to risk as timely and effective as they should be. Achieving effective timing requires an understanding of when an impact is needed and how long it will take to implement the response. To achieve effective timing, we must first understand how long execution, or the implementation of our action, will take (consider the speed of the batter’s swing). Before that, we must determine how much time our decision-making process, including communication across channels, requires. Our Risk Immune Systems must be sensitive to time, reacting quickly and appropriately, as the conditions demand—whether it be in the eye of a hurricane or on the starting grid of a Formula 1 race.

Symptoms of timing challenges

• Hesitation, even an unwillingness, to make difficult decisions early enough to ensure their effective implementation.
• Lack of understanding of the mechanics and interdependencies involved in the execution
• Hurry up and wait. Poorly timed decisions can often cause some parts of the plan to be rushed, while others are painfully delayed.
• Undercooked cake. Taking a cake out of the oven too early means a soggy, unappetising mess.
• Jumping the gun. Sprinters who take off before the starting gun are disqualified from the race. Acting too early (though often in eagerness) can prevent
• Too little, too late. We often don’t know how long processes take until we’re knee-deep in them.
• Creating more work.

Slow is smooth, smooth is fast

There’s a popular saying in the special operators’ world: “Slow is smooth, smooth is fast.” Timing is not entirely about being early or acting quickly—it’s about making the right decisions at the appropriate time and executing rapidly and efficiently for the most favourable results. When considering timing, it’s often helpful to work backwards and identify exactly when your organisation would like to see the impact of its actions. Teams should then zoom out to determine when to execute the appropriate response. Timing is a careful balance that we need to strike—the most robust Risk Immune Systems enable organisations to achieve the timeliest response to risk.

Adaptability 

Adaptability connotes both the willingness and the ability to change. I call it future fitness. Symptoms of adaptability struggles are:

• Two beats behind. Teams that do not adapt lag their more agile competitors—with predictable results.
• Frozen by fear of failure.
• Supercharging a Losing Engine. Teams that rely on a relentless pursuit of maximising an approach they have long used—
• Unable to innovate.
• “Why didn’t I think of that? Teams that don’t have an adaptive mentality are often stumped as to why they hadn’t thought of cutting-edge solutions to new issues and problems.

Also read this, study citizen development or read “Building the in-company change muscle“ and there is of course “Team of teams“. Your organisation requires the willingness and ability to change to the conditions that are ever shifting beneath our feet. Identify interdependencies and address contradictions before competitors can circumvent them.

Leadership 

Leadership, more than any other factor, can make the system function or fail. Here are two other books about leadership from the military:

• The Wisdom of the Bullfrog: Leadership Made Simple (But Not Easy)
• The Habit of Excellence/ Why British Army Leadership Works

The symptoms of weak leadership are

• An Unclear Mission.
• Lack of a strategy—or failure to follow
• Inability to seek information and adapt.
• Poor morale and cohesion.
• The system doesn’t function.

Leadership determines how well the entire Risk Immune System interacts to function. Where leadership effectively stimulates and coordinates the other Risk Control Factors, the Risk Immune System is strong and resilient. Where it falls short, even strengths in one or more areas may prove unable to prevent failure.

What do good leaders do?

To be clear, the best leaders are not instinctively Machiavellian puppet masters, and leading by personal example remains essential and effective, but at the end of the day, leaders don’t actually do very much themselves—they help individuals and organisations perform. Skilled leaders develop the ability and willingness to sense the context of a given situation:

• Communication, the essential enabler of the Risk Immune System, doesn’t happen spontaneously.
• Narrative, or the story we tell about ourselves, is powerful, and it begins with leaders.
• Structure, or how we organise ourselves to function, goes a long way to determine how all of the Risk Control Factors interact.
• Technology, the increasingly omnipresent component and determinant of how well an organisation operates, cannot be a “fire and forget” solution that is implemented and then endured.
• Diversity, often confused solely with gender or racial representation, actually reflects an organisation’s commitment to ensure a spectrum of expertise and perspectives, and in a larger sense, a desire to access a broader range of talent, leaving no one who can contribute on the bench.
• Bias, the conscious and unconscious assumptions that influence what we believe, is often as comfortable as building a team of like-minded people.
• Action, our willingness and ability to overcome the inertia that inhibits an organisation from doing, is essential to survival.
• Timing means acting when the moment is right. Although organisations often know they must act, overcoming inertia or knowing when to wait for the best opportunity requires good leadership.
• Adaptability, or the willingness and ability to change when needed, comes naturally to chameleons but not to organisations.

Immune system

Leadership is about building an immune System—a complicated, multidimensional construct—for optimal performance. When functioning optimally, our Risk Immune System will rapidly detect any emerging threat, assess our potential vulnerability, and determine how it must be dealt with. It will respond as effectively as possible and Learn from the process for future use as required.

Train

Leading is typically a full-contact sport in which success demands leveraging a wide range of organisations and personalities against an ever-changing set of challenges. Ensuring that every single member of an organisation is proficient in the basic skills necessary to perform their role is essential to maintaining a healthy Risk Immune System. Invest in training and discipline. Create a proficiency in a series of individual tasks, and then bring them together to perform increasingly complex tasks that demand teamwork to effectively respond to continuously changing situations.

Develop your core strength 

Developing the system’s core strengths begins with assessing the health and functioning of your Risk Immune System, which then allows you to strengthen individual Risk Control Factors, as well as the interaction of the factors within the system. Use assumptions check, risk reviews,  risk alignment checks,  GAP analysis, snap assessment, communications checks, tabletop exercise, war game, red teaming, scenario prompts, pre-mortem, and after-action review. Also read “Working backwards“.

Test your readiness

Since the dawn of warfare, armies have attempted to gauge their readiness for battle. And quantity matters. While quantitative metrics, when correctly measured, can provide one component of an accurate assessment of an organisation (certainly a lack of adequate resources, including personnel, is a flashing warning light). The qualitative “yin” to the quantitative “yang” is essential to complete an effective appraisal. It is the soft stuff that is more important. If things don’t smell or feel right—trust your instincts. Dig further. Assess your Risk Immune System once, and then assess it again. Try new quantitative and qualitative metrics. Use novel formats to question your team and always keep track of their reactions and responses. Over time, you’ll get better—and your assessments will become more accurate.

The myth of helplessness

Inaction, including a failure to prepare for action, is little more than a dodge. Risk far more lies within our control than outside it. The steps we can take in advance of threats to build and strengthen our Risk Immune Systems, coupled with the actions we can take to facilitate that system’s effective function, are often the difference between success and failure, victory and defeat, or even life and death. Effectively dealing with risk is not relying on a novice gambler’s luck and the next turn of a card, nor is it covering your ears as you walk through a minefield in the hopes that if you don’t hear the boom, then it won’t eviscerate you.

Preparation is the skill

Dealing with risk is the active practice of controlling every single factor within your reach. It begins with making your bed each morning and tying your shoes correctly—and working constantly to stretch your ability to reach ever higher. Seeking control is not a practice for the paranoid—it is the logical objective of anyone for whom the outcome is important.