Russell Bell: How we determine what risk we are willing to accept

Our risk appetite is too high when it comes to Covid, writes Russell Bell. Photo / Bevan Conley

Comment

A few years back, I was recruited to a consulting team that specialised in identifying and implementing control solutions to manage risk.

I was selected because I had a background in auditing and forensic review, and it marked the beginning of 20 years of working with boards, leaders and managers in managing risk – which continues today.

Over the years I have undertaken training and development, and acquired an interest that extends beyond work in understanding risk (and opportunity) in different contexts.

So I probably pay more attention than most to the language used when the Ministry of Health makes pronouncements about risk when it comes to the "tricky" virus.

And, because lockdown is the "response du jour" to community outbreaks, there are pervasive effects on people and the economy if things go wrong.

This being particularly the case for businesses deemed to be non-essential. So I am particularly interested when matters/events are described as low risk.

There are a number of factors that comprise a risk assessment and the process can be reasonably complex, given that invariably each situation is unique and changes over time.

The part that is of interest to me is that risk is made up of three primary components – consequence, likelihood and controls.

I think the Ministry of Health, when it makes its determination, is only looking at two.

Those components being likelihood of the risk occurring and the controls in place to manage risk.

Likelihood is easiest to understand and, in fact, most dictionary definitions of risk start with it being about the chance that something happens.

Controls are what we can or should do to manage the risk once it is identified.

The one I feel gets less attention than it should (and not just with the MoH) is the consequence of the risk turning itself into an issue.

This factor requires an understanding of the current environment and also the potential future impacts if the risk became an issue and work was required to manage it.

While likelihood and controls are easier to define, the consequence can have many dimensions and is often complex in nature.

But in the case of Covid the consequences of the virus getting into the community, given the time that has passed and the experience of others, it is not too hard to determine potential impact(s).

And, while the likelihood of an event can be determined as low, in this case the corresponding consequence runs from moderate to catastrophic depending on where you are and how the virus and the lockdown response might impact you.

Russell Bell. Photo / Bevan Conley

The final aspect of risk assessment (or possibly it should be considered early in the piece) is risk appetite, that is the level of risk you are willing to accept in relation to your objectives.

This is important and has influence on how you interpret and classify risk.

If determining the consequence of a risk crystallising is challenging, risk appetite is more so because it relies on determining a collective comfort level for risk.

I have had friends, colleagues and clients ask, "why don't we just shut the borders until enough of us are vaccinated?"

Others want the opposite because their frame of reference, built up over many years, is different.

This is where risk takers have a higher risk appetite and may see consequences as low while others may see it as high.

And therein lies the challenge of assessing risk in any circumstance, but it is work that I really enjoy – particularly when you apply the methodology to opportunities.

If you're interested, in my view (as evidenced by flying in sick UN workers in from Fiji last week) I think our risk appetite is currently too high when it comes to Covid.

I also don't think that the risk with regard to it is ever "low" (given the consequential stakes and experiences of other countries).

I think we would see less complacency and even better controls if more time were spent understanding, assessing and better communicating the consequences when determining risk.