The Professional Services Practice at Aon’s Keith Tracey considers an increasingly complex risk environment and questions how risks can be categorized so that they are properly owned within the risk function of a professional service firm.

Risks Today

Our analytical abilities and intuition are being tested by new risks. Traditional processes may not work, but can alternative approaches achieve the objectives of understanding and managing risks?

We can place risks into categories such as strategic, operational, hazard and people. That suggests where ownership should lie. These risks are, however, becoming more interconnected and complex and so the risk management process needs to adapt.

External threats may also be a different story, especially since many emerging and evolving risks are consequences rather than root cause risks. For example, damage to reputation and business interruption are consequences, whereas economic slowdown is a root cause that poses numerous threats.

In these circumstances, how do we get to the necessary issues of ownership, assessment, and mitigation?

Let us look at Aon’s Global Risk Management Survey’s Top 10 to investigate that question.

Firstly, we see interconnections and overlaps, for example, cyber and talent. Many could be considered risks to the business arising from strategy, technology, people and skills shortages. They would appear capable of direct management but contain complexities.

Other risks reflect a change in the business environment, such as in the economy or the regulatory environment. These are more subjective and uncertain.

External events can cause major disruptions and arise from a variety of causes. There are overlaps in this categorization but here is a summary of where the Top 10 fall.

Two specific risk management challenges are worth noting.

• We have previously discussed the dynamics of reputation risk. Reputation loss can manifest itself in many ways. Although some firms have historically proven resilient in managing these challenges, reputation events damage client retention and future opportunities. The events may unfold in a “fast” manner but are often the result of a “slow” burn.
  
  
• Considering external events, Donald Rumsfeld famously raised the problem of known unknowns, unknown knowns, and unknown unknowns. In summary, there are things we may not be aware of, or are aware of but do not fully understand. Wilful blindness and bias therefore often have roles in a lack of recognition or preparedness.

How to Manage Today’s Complex Risk Environment?

So, practically what can be done?

A changing work environment is creating new types of hazards and posing new threats. The categories of risks may be familiar, but their frequency and severity are more difficult to gauge.

Traditional frequency, severity and consequence risk identification exercises should work for straightforward risks where a linear analysis of cause and effect are possible.

Does it work for more complex messy risks?

New risk categories may have unknown manifestations and unforeseen consequences that devalue the traditional approaches. Rather like Rumsfeld’s analysis, we sometimes know what we don’t know, but also there are things we don’t know that we don’t know. We need a more creative toolset.

• Multi-skilled responses are needed. Traditional risks still exist but may be more complex: technology springs to mind. Assign a process and a team to define and explore each major risk.
  
  
• More precise descriptions help to better define the threat. The risk titles themselves are insufficient. Strategic thinking exercises may produce better definitions. Complex known risks can be addressed through structured problem solving. For messy, interconnected, and complex risks, a systems thinking approach is valuable to chart the dependencies and relationships, and potential consequences.
  
  
• Well-planned and practised crisis management provides a framework for a response where uncertainty is high. Grey Swans are situations that are challenging since there is a lack of understanding or awareness. They involve a knowledge gap, a misalignment in plans, expectations, incentives, or other errors, including those arising from biases. Preparation may be difficult, but a well-planned response can mitigate the effects should an event occur.
  
  
• Be clear about ownership. This can be done once a risk is defined, and its components broken down. An example would be the risks arising from new technology and AI in particular, where direction, training and risk awareness are all key.
  
  

More insights from Keith