Extreme Risk Management

Just when you thought ERM meant enterprise risk management, I'm here to tell you your focus should be more on extreme risk management; after all, should we really spend our limited and valuable time and resources on the expected when the unexpected is often so much more destructive?

By Christopher E. Mandel

Many recent risk management strategies have been focused mistakenly on things of little consequence, either due to errant direction from above or out of misguided priorities. This has resulted in poor investment decisions in risk management activity that shows little or no measurable value and importantly, no improvement implications for the risk profile of firms in desperate need of better results. In many cases these same decision makers have not made the connection between risk and results and thus focus on the wrong thing. Big things need urgent attention; small things shouldn't be ignored, but while often easier to address, they suck resources from more important exposures and generally lead to less meaningful results. I don't deny however, that death can often be the result of "a thousand cuts."

By definition, extreme risks can be a challenge on which to get good intelligence, measure with much accuracy or be used to drive key risk management decisions. The latter is often true because management tends to ignore things that are viewed as remote and ill defined, especially when the response to or preparation for these potential events is less than clear.

Ineffective at Managing Risk (05/01/13)
RIMS Attendees Talk Drones, Product Recall (05/01/13)
Navigating the Fear Farm (03/01/13)
Who is the Real Gambler? (05/01/13)
Abuzz With Energy (04/12/13)

How are extreme risks defined other than the big bad things they are reputed to be? Well, from an actuarial standpoint, they may be tail risks whose probability is far less than the 1 percent chance of occurrence in a stated time period. On the other hand, they could occur more frequently, but normally won't have the historical frequency that makes them in any way easily predictable or that lend themselves to planning. Yet, the insurance industry does in fact do just that. Whether it be Category 5 hurricanes with direct hits on multiple high-density population centers or terrorist events that rarely occur on U.S. soil (but which are much more common elsewhere), predictability is very limited.

More pointedly, extreme risks are those whose impact is material, significant and likely highly disruptive and sometimes fatal to a company. With those descriptors attaching, is there any doubt they deserve our attention? The key challenge is how much to invest in their treatment. This can become the biggest bone of contention for management attention and is frankly another reason senior management is less likely to be convinced to put money on the line for their treatment. In an environment of increasingly restricted resources and new and stronger inhibitors on company's performance, it is tough to compete for those resources. After all, the real dilemma is proving the value of the investment. Traditional risk management is all too familiar with this dilemma in the area of safety investments. Often, the approved spend is more a function of social or moral responsibility that made failing to invest simply socially unacceptable.

Suffice it to say, extreme risks can't be ignored. It is ultimately a key risk oversight responsibility of all boards, and certainly for extreme risk impacts the buck stops with the CEO. What is likely to happen is that more and more senior leaders will get hammered by the risks they thought would never define their legacies. They ignore them at their peril.

CHRIS MANDEL is the president of Excellence in Risk Management LLC, and executive vice president, rPM3 Solutions LLC, a long-term risk management leader and former president of RIMS.

March 1, 2012

Newsletter Sign-up