Collaboration. Innovation. Risk. Knowledge.

Flooding, Climate Change, Future vs Current Risks

2011-01-20T14:46:00.001-08:00

I've done a bit of work on climate change risk with a range of government and private industry organisations. Two things stand out which I have written about on this blog at length before:

- the high level of concern about future unknown climate related risks
- the high level of ignorance about current known climate related risks

I encourage organisations to begin looking at climate change risk using the present as the datum point. The Queensland and Victorian floods provide a good example.

Risks and Roof Insulation - Part II

2010-02-23T02:21:00.000-08:00

The roof insulation program outcomes make for pretty sober reading. So what happens now? What are the unintended consequences? Here are a few thoughts:

Buying or selling a house? The transaction should require an all clear from an electrical inspection of the roof. Would you want to buy a house with that hanging over your head.

Loan approval. Same story.
Buying insurance. Same story.

Lots of future work for electricians. But there is plenty for them to do right now.

My prediction - a severe shortage of electricians in the foreseeable future.

Risk and roof insulation

2010-02-19T14:58:00.000-08:00

It has been revealed that cabinet did not seek any assessment of the risks associated with the roll-out of the now defunct roof insulation program until two months after commencement.

Risks have a nasty habit of being completely obvious after the event. What seemed remote and uncertain before becomes utterly certain after and you will be judged by a higher standard because "That just happened".

A new project, a new acquisition. Do yourself a favour and assess the risks properly and, if you get it right, no-one will ever know.

Property Risk Management

2010-02-09T20:17:00.000-08:00

This article was first written a couple of years ago for an industry magazine. Some of the material is slightly out of date but the principles have not changed. If anything I am more convinced about the need to limit the extent of the enterprise model.

This article discusses three aspects of risk management within a property environment: Strategic, operational and construction or project. Each of these components of risk management are applicable to all industries but they have been adapted here as a practical application to the property industry.

Background

Risk management is a diverse discipline covering potentially all aspects of business. Different streams of risk management have developed over time primarily in the insurance, finance and safety industries using a variety of different methodologies. Despite the similarities of the risk management framework that have emerged through the development of the Enterprise Risk Management (ERM) model, the type of individual risk management activities practiced at a bank, for example, are very different from those undertaken within a government department or a manufacturing plant.

Risk management has also been traditionally associated with stopping things from happening or minimising their impact – accidents, credit crunches, catastrophic bushfires and the like. The current risk manager is, or should be, also preoccupied with making good things happen using the same risk management principles – making sure projects are completed on time and within budget, assisting with the achievement of corporate objectives and exploiting business opportunities and infrastructure investments to maximise the reward, whilst managing the risks.

While the management of individual risk has always been with us, as a management discipline, risk management is relatively immature. Australian Standards, with the introduction in 1995 of the world’s first risk management standard, AS4360, provided the pathway for the risk management industry to develop to the extent that there is now widespread acceptance of the need to have embedded risk management cultures and processes within organisations although disagreement within the field on how far that needs to be implemented.

In the period since 1995 the profile of risk management has increased due to its role in effective corporate governance fuelled by some key developments in the past few years.

The collapse of HIH in Australia led to an increased regulatory regime for insurers under the Australian Prudential Regulatory Authority
The Sarbanes–Oxley Act of 2002, is a U.S federal law passed in response to a number of major corporate and accounting scandals including those affecting Enron, Tyco International, and WorldCom.
In Australia in March 2003 The Australian Stock Exchange ("ASX") Corporate Governance Council published "Principles of Good Corporate Governance and Best Practice Recommendation" for the guidance of ASX listed companies. Risk management figured prominently among the ten essential principles and placed heavy emphasis on the Board and the Chief Executive and Financial Officers understanding and signing off on their risk management activities.

2004 saw the introduction of the Enterprise Risk Management — Integrated Framework by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

In the Victorian Government sector the introduction of the Public Administration Act 2004 required the Boards of public entities to inform their Minister and relevant Department Head of known major risks to the effective operation of the entity and of the risk management systems that it has in place to address those risks

Boards and senior management have responded accordingly. The interest and oversight from boards has increased the focus and quality of risk management within organisations. Due to the increased regulatory regime risk management is currently predominantly focused on financial risks, compliance and corporate governance. In Aon's 2006/07 Australasian Risk Management and Total Cost of Insurable Risk Survey, company CEO's and directors nominated corporate governance as the top risk concern for the second year running. One wonders whether this is a concern about their own personal risks rather than the risks to their organisations.

Risk Management Methodology

The Australian Standard on Risk Management, AS 4360 (the Standard) and its accompanying handbook, HB 436 describe a widely accepted methodology for the risk management function and associated processes. Along with the Standard and handbook there are a multitude of articles and tutorials which explain the risk assessment process for those interested in digging deeper. At it's heart risk management is about decision making and prioritising the use of finite resources. All assessment techniques, despite their differences, have that in common. Regardless of which techniques are used it is very important that they are specifically tailored to the organisation. Establishing a consistent nomenclature around risk greatly helps the communication process.

The ERM model is the result of the application of a single risk management framework across the entire organisation. It relies on aggregation of risk analysis information from individual business units along with in feed from strategic and project risk management processes. It requires a high level of risk awareness from all areas of the organisation and a recognition that each area impacts on other areas and that everyone is responsible for managing risks

Taken too far, ERM can be extremely resource hungry as it disperses throughout the organisation and there are dangers associated with quality of risk information, expertise of individuals and the focus on process and documentation rather than outcomes. Those considering a move to an enterprise model should be wary of adopting too evangelical an attitude to risk management. A key element of success is knowing when to stop.

Strategic Risk Management

Strategic risk management is concerned with the strategic objectives of the organisation and in managing the risks associated with those objectives to maximize the likelihood that they will be achieved. It is also concerned with emerging risks and those risks that are not under the direct control of the organisation. Emerging risks such as climate change, the war for talent and an ever changing regulatory landscape are not restricted to any one organisation and the management is a collective effort which involves individuals, organisations and governments. A prudent organisation can recognize emerging risks and make adjustments to strategy in order to either offset a future negative or take advantage of a future positive trend.

For the property industry risks like climate change and the war for talent may have a profound effect on their future strategic direction. Energy efficient buildings with low maintenance services are already becoming more desirable to both property owners and occupiers despite the sometimes high initial costs of such an investment. Changes to the regulatory and legal landscape can be anticipated and effectively managed to ensure that robust compliance, maintenance and inspection activities are in place and appropriate for the associated risks. An intimate understanding of the cost of managing existing risks leads to better decision making around the management of future risks. Changes in the risk profile of existing buildings due to climate change (e.g energy efficiency, increasing flood, windstorm or bushfire exposures) may require retro fitting of additional physical controls and should be determined by an appropriate risk engineering assessment. These risk changes are likely to be gradual but consideration should be given to these issues for such things as site selection and design of new buildings.

Strategic risk management can be practised in several ways but fundamental to the process is the need to align the risks to the objectives of the organisation and to identify emerging risks. At a minimum that requires engagement from the executive and the Board. A risk workshop in which the risks are identified and discussed at the highest level can be highly effective and generate the type of buy-in required from the Board and senior management. In an ERM model this type of strategic risk workshop is integrated to the business planning process and is practised at several levels of the organisation depending on the relative size and complexity. Done well, this type of activity can lead to more consistent achievement of corporate objectives.

It is also useful to look backwards as well as forwards. A fundamental component of risk management is the continuous review and communication function. A corporate objective performance review should include a component on risk management to identify the core reasons why objectives were not met and ensure that they are addressed in the next cycle of business planning and strategic risk management.

Operational Risk Management

The property industry, like many others, is highly regulated. Most of the regulatory requirements are focused on life safety such as the Building Code of Australia and the State regulatory regimes dealing with occupational health and safety, treatment of in-situ asbestos, the risk of legionella from water cooling towers and the like.

Strict adherence to compliance will therefore go a long way toward managing the operational risks that the property poses to the public and its occupants. Compliance alone however will not identify and manage the risks to the property, the property owner or the tenant. Property and equipment protection, continuity of business operations and risks associated with breach of professional duty require an additional level of analysis. One way of doing this is through a physical risk survey. The property insurance industry underwriting report presents a model upon which this can be carried out. A COPE survey focuses on Construction, Occupancy, Protection and Exposure to identify the and quantify the risks and recommend improvements. An expanded COPE survey can be used to quantify the risks and expand the scope of the survey to include such things as professional practices and the giving of advice.

Such surveys should be carried out in a number of circumstances:

by property owners on a recurring basis (say every two to three years)
as part of due diligence for buying a new asset
as part of a business case for a new building

One important aspect of managing the risk to the public is the need to maintain good records. Defending a liability claim against a third party is greatly enhanced by a robust risk management methodology that is diligently followed and recorded. There is general acceptance that not all risks can be mitigated and that a system of prioritisation is a reasonable approach with finite resources. However poor record keeping can undermine the best risk management. Records need to be accurate, continuous and kept, in many cases for several years, in order to provide good protection against third party liability claims. The round of tort law reforms within Australia earlier this decade have reduced the risk of third party claims to property owners by removing “nuisance” litigation. However the risk environment never sits still and there are signs that the balance may swing toward the plaintiff in forthcoming years. This observation is also relevant to the compliance environment in which there tends to be regulatory creep in response to particular severe risk events that occur from time to time. Public liability can be tricky and it may be better to stick to a consistent risk management regime over time rather than try to continually adapt to a changing risk environment.

Construction Risk Management

Construction projects have a number of constraints and pressures:

Budget
Time
Multiple stakeholders
Compromised deliverables
A highly competitive industry

These and other factors combine to create an environment in which a lot of things can go wrong, occasionally spectacularly. A formal risk management approach can be very beneficial in identifying underlying risks to the project that may remain hidden under a standard project management methodology.

Having said the most effective form of project risk management is to follow a formal project management methodology, which is a separate professional discipline in itself and is concerned with managing the myriad resources, materials and stakeholders within a strict reporting and tracking methodology. Project management has many in-built risk management features that go a long way to ensuring that the project is delivered on time, on budget and on-spec.

Integrating a risk management process into a standard project management process is not a simple task. The level of rigour and formality needs to be commensurate with the size and complexity of the project. As with any project activity the earlier that risk discussion can be introduced into the project management process the better. Changes driven by risk considerations need to be identified during the feasibility and business case stages in order for them to be implemented cost effectively. Similarly, risk considerations associated with layout, occupancy, construction materials and fire protection need to be done during the early design stages so that practical solutions can be determined.

The tracking of risk treatments needs to be incorporated into the project management process. Individuals need to be held accountable for the completion of those treatments.

Historically the key activity in the management of risk has been the contract negotiation. In many cases substantial resources are devoted to drafting the contract in an effort to transfer the risk to the party willing to manage it, but not necessarily in the best position to manage it.

When a risk materializes in a standard design and construct contract an adversarial mindset can kick in and the project can suffer accordingly. In recent times the concept of shared risk within a project environment has gained currency. Many large and complex projects financed by state governments in Australia are using the Alliance contracting methodology whose key characteristics is the pain/gain sharing model, a feature of which is that each party to the contract agrees to hold the other parties harmless for any first party losses that might occur during the project period. Anecdotally the experience has been very positive. Contractors appreciate the model because it removes or shares much of the construction risk that they might otherwise bear by themselves. Losses can still occur but the theory is that the collaborative culture created by the Alliance and the inability to sue any other party means that all attention is focused on fixing the problem or avoiding it in the first place. We should expect to see more Alliance projects in the coming years given the projected infrastructure expenditure by State governments around the country and the capacity constraints on the construction industry.

Regardless of the type of contract in place, at the very least the project stakeholders should get together for a risk workshop. Risk workshops rarely reveal hidden risks but what they do is to get the stakeholders talking about risk in an open manner, allowing them to prioritize in terms of importance. A half or full day session, well facilitated, can have very beneficial outcomes for the project group and often results in key decisions around project design options, insurance purchases or other risk mitigation measures that might otherwise not have been addressed within a standard project management framework.

It is very important also that the risks identified and managed through the strategic and operational risk management activities are fed into the project risk management process. Examples of this include design considerations around service redundancies, maintenance and compliance costs, building layouts, construction materials and fire protection.

Take Aways:

Risk management has tremendous value to add to an organisation if used appropriately and within its limitations. The formality and resources dedicated to risk management should always be commensurate with the risk profile of the organisation and with a constant view as to whether the activity is adding value.

The characteristics of a successful risk management program are common to almost any industry. Top-level support is crucial. The increased focus on corporate governance has gone a long way toward achieving this for many organisations but it is common to hear the lament at the top levels that the risk management function is too focused on the methodology and the documentation and not on achieving positive outcomes.

Be wary of the quality of the information used to carry out risk assessments. Each assessment should be given the sniff test to make sure that the data also matches the intuitive conclusions.

Stick to the key issues. The majority of risks will either manage themselves or, if they do eventuate, will cause a ripple but not a tremor within an organisation. An holistic approach to risk will separate the key issues from the day to day operational issues.

Unintended Consequences

2009-06-02T16:58:00.000-07:00

Sometimes the cure is worse than the disease. A common response to a manifested risk is often more government regulation. The resources required to regulate can often be just as great or greater than the underlying risk. Jonah Norberg points out

"The estimated cost of the bailouts of and guarantees to the American financial system is $1.9 trillion dollars. That´s a horrible number. Perhaps it even leads you to demand regulation to make sure it "never happens again"?. Until you realise that the federal regulatory compliance cost for American enterprises is $1.17 trillion - every year."

Every year is the key phrase in that sentence. The cost to regulate risk across its broad spectrum must be enormous. From financial to tranpsort to food safety to public safety. The list goes on. All individually worthy possibly but collectively out of proportion to the underlying risks we face.

Opponents of this view will point out that the risks will be even greater if these regulatory systems are not in place. Fair comment. A proper risk assessment will not take that on good faith. It has got to be backed up by evidence rather than supposition. Maybe looking at the costs as a whole will shed new light on what we gain and what we lose. Compliance is like insurance. It spreads the risk and the cost across society but it also requires its own margin and that can be measured in lost opportunity, reduced entreprenurial activity and an increased expectation that the Government is responsible for protecting us from every risk. Good regulation is risk based and not a blanket for all.

Overreacting to risk

2009-02-10T03:39:00.000-08:00

The $42B stimulus is an overreaction to a perceived risk.

Project Risk Management

2009-02-06T03:43:00.000-08:00

Risk management as it is currently practised is a crock. It is almost entirely focussed on perception management and paper shuffling. It is reactive and shallow.

The risk must be borne by those able to manage it best

2009-01-18T02:08:00.000-08:00

A central tenet of risk management is that the owner of the risk should be the party best able to manage it. This can easily get forgotten during contract negotiations when each party tries to transfer as much risk as humanly possible to the other regardless of whether the other party can manage it or not. Having the best negotiators and lawyers means that you can win the battle but lose the war. This is often the case in large projects that go wrong. The principal transfers the risk to the contractor. The risk materialises, the contractor has either not recognised and accounted for the risk or has no ability to manage it and was hoping for the best. The contractor goes belly up or the project gets bogged down in costly dispute resolution. Hard to pick a winner in that scenario.

The various financial bailouts occurring around the world are another example. There are many well run companies - financial and non-financial - that can weather this crisis. The bailouts are not for them. They are for the ones that can't. The ones that made reckless or poor decisions and couldn't manage their risks. Likewise individuals that borrowed beyond their means, took out margin loans or have huge credit card debts. Interest rates are being lowered which eases the squeeze on them. The ones that didn't take those risks are losing out as their savings returns diminish and are even eroded by taxation and inflation.

And the net result is a lowering of personal responsibility. The bailed out party expects to be saved the next time. The more prudent pack it in and join the party. We don't manage our own risks anymore.

2008-11-26T00:23:00.000-08:00

I'd like to talk to the architect of the Australian superannuation system and ask him/her/them whether their risk assessments included the current scenario. The move from a government regulated pension system was seen as a dramatic step forward in the acknowledgment and management of the country's fiscal long term responsibilities. But the exposure to market volatility and severe collapse puts many people in the firing line through no real fault of their own. Lots of people have benefited from the rise in the market over the last few years but imagine if you had pumped a heap of dough in the last 18 months in preparation for your retirement. Ouch.

It also highlights the problems of managing intergenerational conflicts.

Now I yield to no-one in my views that the baby boomers have had an easy ride (I'm generalising). Plentiful jobs, great wages, cheap housing, free education. These conditions have never existed for the bulk of Generation X and Y. Normally I would grind my teeth thinking about it. But I might have to start feeling sorry for the boomers. Facing retirement their nest eggs have been hit very hard, their homes values are starting to drop and the end figure could be severe. All of the assumptions they had for the future are gone and may not ever return.

This is going to be a real policy conundrum for the government. None of us should expect Boomers to go quietly into the night. They will work longer – forget about assuming the mantle if you are Gen X or Y - , they will lay off younger workers, they will demand favourable taxation. In short they will demand solutions for their problems at the expense of the rest of us and of future generations. And they will do this because, like all of us, they are selfish, but unlike the rest of us, because they can. Maybe I shouldn't feel sorry for them after all.

Climate Change Liabilities

2008-11-22T18:42:00.000-08:00

I actually wrote this several months ago but did not publish for one reason or another. Can I claim I tipped this?

Much was made at the time of plaintiff law firms warning large companies to get their ducks in a line with respect to climate change mitigation. Perhaps the same law firms might also send similar letters to firms on the other side peddling hysteria and misrepresenting the reliability and predictions of climate models. A lot of people have spent a lot of money based on those representations. If they turn out to be wrong or exaggerated then they would have the right to be angry and consider seeking compensation.

P.S. Those same companies and individuals should also check the quality of their own professional indemnity insurance covers.

Climate Change - The Honeymoon is Over

2008-11-22T18:36:00.000-08:00

Climate Change - The Honeymoon is Over

In February 2007 a report was released entitled The Business of Climate Change: Challenges and Opportunities. The report discussed the climate in 2100, documented economic and financial projections, and likely mitigation and adaptation costs several decades into the future. It included a range of possible values for a tonne of carbon tonne in 2050. The report authors are highly credentialed and referenced what look to be the best contemporary scientific knowledge including the recognised global expert body the Intergovernmental Panel on Climate Change.

So what?

Well, the report was written by Lehman Brothers. Eighteen months later Lehman Brothers is no more. They were happy to make predictions and provide advice about the climate and the financial markets 90 years in the future but were unable to predict their own demise a little over one year later.

Of course this doesn't mean the report is wrong. But it doesn't mean it is right either. And certainly their ability to take advantage of whatever opportunities might have been available is now.....somewhat diminished.

But I digress. The executive summary of the report states, in relation to climate change:

Firms that recognise the challenge early, and respond imaginatively and constructively, will create opportunities for themselves and thereby prosper. Others, slower to realise what is going on or electing to ignore it, will likely do markedly less well.

On this point I think they are absolutely right, particularly if, by imaginatively and constructively, they include the decision to do nothing. I'll come back to that in a moment.

On climate change collectively we seem to be experiencing a variation on the five stages of grief - denial, anger, bargaining, depression, acceptance. Your interpretation of the stages depend on your point of view. Climate change sceptics for example might see the denial stage as the acceptance stage and vice versa. I'm not trying to create a new management consultancy model, I'm merely suggesting that the climate change debate has moved into a new stage. Lets call it the cold hard reality stage. For some this might be called the bargaining stage. Again, depends on your perspective.

The reaction to recent financial events suggests that the commitment to climate change action is a mile wide and an inch deep. When faced with the choice between future, uncertain risk represented by climate change, and certain risk that is happening right now then it would appar that there really is no choice. Our responsibility to the future diminishes when we must focus on shoring up the present. Commentators can gnash their teeth all they want about the shallowness of such a view but they are wasting their time. It is who we are. And it is not going to change.

The honeymoon for the climate change industry is well and truly over. That's bad news for some of them but good news for the rest of us. The opportunity to bring the debate and the discussion back to a a more sensible level should be welcomed by all parties.

In the booming economic times we have recently experienced a more wistful approach to issues like climate change inevitably emerge. Our basic and luxury needs are met, we can afford to focus on our spiritual and moral concerns. In less certain times such as these, long term risks are ignored in an effort to deal with the here and now. The correct approach lies somewhere in the middle. It is the analogous to how people deal with risk. High impact, low probability events are underestimated at the point before they occur and overestimated immediately afterward.

The current financial crisis has pushed climate change off the front page but it will be back and hopefully a bit chastened. What is needed is a rational, evidence based assessment process that cuts through the rhetoric.

Tom Roper former Victorian Minister for Planning and Environment and State Treasurer and now an active advocate for environmental and climate change issues, recently told the Age.

Victoria had to plan for a two-metre sea level rise and "if it's less than that, we can all be thankful". "I don't think, certainly in Australia, we have thought through what up to two metres of sea level rise will actually means in terms of our major cities".

Try this, it's fun. Replace two with ten in that passage. Have we thought through what up to ten metres of sea level rise will actually mean in terms of our major cities. How about twenty? Have we thought that through? Probably not.

Let me explain why I'm being so flippant. According to publicly available information from the IPCC and CSIRO, global sea levels are set to rise by up to 60cm if you just take into account the model projections, and, up to 80cm if additional contributions are included due to ice sheet dynamic processes. This is for the last decade of the 21st century - 2090 to 2100 . These figures are the top of the range projections for the last decade of the 21st century relative to 1990. In other words, worst reasonably foreseeable case in 80 to 90 years. If its 80 cm why call for a planning figure of 2m? I don't get it.

This is not a skeptical rant about climate change being a hoax. The vast body of expert evidence suggests that it is real and therefore the only rational response is to accept it and take action. But taking action does not mean going off half cocked. It means having an evidence based approach to understanding the potential risks, measuring their impacts - primary, secondary, tertiary etc - and formulating sensible strategies to mitigate or adapt.

Every decision brings with it unintended consequences. If you introduce a 2 m planning level for an 80 cm problem then there will be a few people that will be upset about it. Such as existing property owners whose land value will head rapidly south perhaps to zero, when the market realises that the utility of that land is now significantly reduced. Insurers will restrict or refuse cover to their assets. Governments and businesses will choose to not replace, maintain or extend essential infrastructure such as drainage, water or electricity.

And if its is 90 years away can't we wait a bit longer and see how the sea level actually rises compared to the theoretical models before committing to policies that will have profound impacts on property values and public infrastructure?

Climate change presents risks. It also creates opportunities for the informed. We tend to overreact to risk or perceptions of risk. Just witness the behavior in the financial markets. People have lost and gained fortunes depending on their view of risk and their willingness to act on it Businesses and governments that understand climate change risk and opportunities can exploit them and gain a competitive advantage over those that don't. They can also avoid making uninformed or rash decisions through the influence of the soaring rhetoric of those with a particular agenda.

True understanding requires a balanced view of existing and future risks and a consideration of the likely actions of others.

Sit down and do a formal risk assessment and you will soon come to a few key realizations.

Firstly that issues such as population growth, economic turmoil, infrastructure investment deficits and demography will have a far more profound impact on the near and medium term future than a changing climate. In fact the biggest short term risk posed by climate change to the economy and society is the emissions trading scheme, an artificial man made construct rather than a change in climate.

Secondly in all the commentary about climate change and the potential impacts there seems to be a view not just that the future is far too risky but that so is the present. The notable characteristic of climate change is that it amplifies existing risks. There will be increases in frequency and intensity of flooding, bushfire, windstorm but in most cases the increases are incremental rather than catastrophic. These risks are already with us but the big ones only hit only once every twenty, thirty or a hundred years. We know this and we are fine with it. Why would we think that an incremental increase would render them a total disaster?

An example. A dry hot climate will lead to a reduction in soil moisture content and cause problems with building foundations and underground infrastructure. Pardon me but isn't the soil already as dry as a dogs biscuit. Lets not get carried away with what the future might hold when it is already here and on reflection, not all that bad.

Thirdly. It's not all bad news. There are some positive effects and some risks will be negatively correlated. Concerns about urban storm water drainage capacity for example will be offset by household rooftop water harvesting.

When doing your assessment consider the the unintended consequences. Map it against a number of scenarios. Consider the consequences of the models being incorrect. Consider how the risk compares to other risks? Consider time factors. Where can you afford to wait and where do you need to take action right away. Have a framework in which to manage it and be prepared to adapt and iterate. In this way you can make sensible, informed decisions and will be able to adapt to changing circumstances.

And some final advice for the climate change industry. It's time to treat climate change like we do any other issue - costs versus benefits. Not because of the financial crisis but because it makes sense. A lot of the proposed adaptation and mitigation strategies do make economic good sense and should be done regardless of the eventual impact of climate change.century relative to 1980-89
So cut out the rhetoric and the scare tactics. Sell us the benefits and outline the true costs. But don't speak in platitudes and don't exaggerate because you'll lose us and we won't come back. And we'll all be poorer for that.

Risk management the new whipping boy

2008-11-10T01:54:00.000-08:00

While our biggest public companies line up to accept the government handouts (i.e. our tax money) that arose from the Black Swan that just occurred in the financial markets we are glibly told of the reasons why.

"Our risk management was not up to scratch".

As if it was all down to a imperfect process or the shortcomings of a single role. The reasons are many and complex and clouded by political ideology. But this was no Black Swan. It was preventable and it was predictable. A simple debt boom.

Too much borrowing fueled by cheap money and moral hazard from too many prior bailouts. Any financial company not willing to play the game gets left behind in the run-up. So the choice is play the game or get out. Prudent companies and individuals saw what was coming a long time ago and developed plans to deal with it. They cashed out, reduced their debt and waited.

Understanding risk (and being willing to act) can give you a huge competitive advantage in normal situations but it is a matter of survival in times like these.

The future of risk management

2008-10-02T06:12:00.000-07:00

Risk management is an immature discipline. In my view the current practices are far too focused on reporting, compliance and relatively minor operational matters. Major risks - those that happen infrequently but have a huge impact are not as well managed as they should be. Strategic risks, major operational risks and project risks. That's where the value lies.

Property Risk Management

2008-06-19T05:53:00.000-07:00

I presented at the Institute of Chartered Accountants Property Day in Melbourne on 16 June. The feedback I got from the session was suitably cryptic - e.g "relevant", "not relevant to my area". Property risk management is a very broad field and the risks vary considerably depending on your position in the property world - tenant, owner, manager, investor. Have a look through the slides and email me if you have any questions: andrew@cirk.com.au

The value of risk management

2008-03-25T22:04:00.000-07:00

I don't pretend to understand the unbelievable complexity of the global financial market. From what I've been reading, nobody does.

Alliance Contracting - Risks in the TOC

2008-02-20T00:47:00.000-08:00

I recently presented at the Alliancing Association of Australasia forum at the Stanford Hotel in Melbourne. Alliancing contracts create some interesting risk allocation permutations and require some critical thinking around risk management and, in particular, the cost benefit of certain insurances.

If you take risks you need to have risk management

2008-01-31T02:21:00.000-08:00

The recent meltdown of the US sub prime loan market and the Société Générale rogue trader losses, although perhaps only loosely connected, highlights some issues around the value of risk management.

Most organisations pay lip service to their risk management functions. They see it as a compliance/assurance activity largely focussed on protecting boardmembers. Nothing wrong with that. Why should someone have to risk all their assets for helping to run a company? However it becomes a problem when it is only about that because people tend to then focus on reporting and process and lose focus on getting to the heart of the key risks. And in doing so they actually make the directors more exposed.

Evidence based risk management cannot defeat power. When risk matters are routinely overridden because of "commercial reasons" the enterprise gets a whole lot riskier. A wonderful example of this is the role of the Risk Assessment and Control department of Enron, entertainingly detailed in The Smartest Guys in the Room.

An enterprise risk management system can be effective when it doesn't drill down too far. Concentrate on where the big risks are and let the others take care of themselves. And I mean really concentrate.

The Future Will Take Care of Itself

2008-01-01T16:02:00.000-08:00

There was a futurologist (is that their name) on the TV this morning opining on what is in store for society for 2008 and beyond. He was ambitious. He predicted all the way out to 2050 with remarkable certainty. My turn to make a prediction. He will almost certainly be wrong and he will never be called to account. That is the beauty and the weakness of the prediction industry and one of the reasons companies shouldn't plan too far ahead. Events are far too complex to predict with any kind of certainty. The winners are those that get lucky. Of all the globe shifting events that have occurred in the past 50 years - September 11, the collapse of the USSR, the rise of China and India etc - who predicted them? These events - described by Nassim Nicholas Taleb as Black Swans, - drive history but are near on impossible to predict.

It is one of the reasons why we should all calm down a bit when it comes to climate change. If there is a more complex system than the world's climate then I'd like to know what it is. And yet we have people predicting with absolute certainty what the weather will be like in 50 years. When I hear an opinion on climate change I do what Deep Throat suggests - "follow the money". Sensible people and organisations stress the uncertainty inherent in modelling climate change. An iterative risk management approach is requried which means making adjustments as the science gets better and the actions of individuals, organisations and countries demonstrates what can be done while changign the future before it occurs. Overreacting to the climate change risk could waste precious resources making it doubly harder to adapt to changes that are now seen as inevitable.

The "Ah Ha" moment

2007-12-11T03:01:00.000-08:00

Risk workshops, among other things, are a method for identifying and assessing risks and prioritising related actions. It is rare that anybody experiences an "ah ha" moment - where a lightbulb goes on and they achieve some extraordinary insight into the risk faced by their organisation. Most informed people have an intuitive understanding of their organisations risks and the value they get from a workshop is understanding the perspective of others and prioritising actions from a discrete list of risks.

In my experience the "ah ha" moment can be achieved when considering the associated controls and the gaps in those controls. Effective interrogation and challenging of assumptions can sometimes reveal the elephant in the room - the problem that everybody knows but nobody wants to talk about. And its rarely a process or a system or infrastructure or an audit function - things that are tangible and relatively easy to fix or implement. It's usually related to culture and goes to the heart of why the organisation cannot achieve its potential.

Safe as necessary, not safe as possible

2007-11-17T10:49:00.000-08:00

A recent article puts forward the view that it’s good for children to hurt themselves at play and that overzealous bureaucrats are failing to use common sense when applying safety guidelines.

Good risk management balances the risk with the opportunity. By wrapping our children in cotton wool - and adults for that matter - we prevent them from building resilience.

Property Risk Management

2007-09-18T19:31:00.000-07:00

I recently presented to the Institute of Chartered Accountants at their National Property Industry Day in Perth. The presentation is here.