Risk management will find it increasingly difficult to meet the requirements for enterprise risk management (ERM) as demanded by the draft COSO(1) report without developing some changes to its present mindset.
While this may not come as a surprise, we might be curious to know why.
It is because current systems cannot deliver an understanding of socio/economic and political complexities, and that understanding will increasingly be the key to delivering successful outcomes. Managers will need to be on a first name basis with such concepts as change management, high-performance teams, motivation, emotional and behavioural attributes, and the learning organisation.
Problem solving
In the past, financial institutions have tended to solve problems by analysis, breaking things down into parts, fixing components, and assessing the probability of known sequences of failures leading to an accident or loss. In the new world, this type of problem is labelled as a tame problem, and tame problems tend to enjoy consensus. Everyone more or less agrees what needs to be done and the right way to go about doing it.
To solve a tame problem, we develop systems that gather all the data.
We then analyse that data, formulate a solution, and implement the solution (see Figure 1). It is, however, a mistake to think that tame means simple, for some of these problems are extremely difficult to solve. Over the years our IT systems have been able to process this type of problem at a faster and faster rate, until today's systems can achieve results in real time and advertise their capacity to do so. However, there are still times when we fail, and fail dramatically. This has led us to realise that things can be more complicated. We are increasingly faced with problems of organised complexity, clusters of interrelated or interdependent problems, or systems of problems.
Problems that cannot be solved in relative isolation from one another form messes. We sort out messes through systems methods and modelling, focusing on processes, and interdisciplinary approaches. Rather than simply breaking things down into parts and fixing components, we examine patterns of interactions among parts. We organise ourselves to sort out messes through such things as cross-functional groups, redundancy, and learning organisations. Simply building more expressways does not solve vehicle congestion. A primary danger in mistaking a mess for a tame problem is that it becomes even more difficult to deal with the evolving mess.
Tame problems and wicked messes
Problems persist because managers continue to believe that there are such things as unilateral causation and independent and dependent variables.
Charles Perrow, in his book Normal Accidents, elaborates on some of the problems inherent in messes. First, interactive complexity is the measure of the degree to which we cannot foresee all the ways things may go wrong.
This can be because there are just too many interactions to keep track of. More likely, it is because our various theories are simply not up to the task of modelling socio-technical interactions. Second, coupling is a measure of the degree to which we cannot stop an impending disaster once it starts. This may be because we do not have enough time, because it is physically impossible, or because we do not know how.
The greater the degree of interactive complexity, the less our capacity to prevent surprises; the greater the degree of coupling, the less our capacity to cure surprises. Therefore, the greater the degree of interactive complexity and coupling, the greater the likelihood that a system is an accident waiting to happen - what Perrow terms a 'normal accident'. In such systems, operator errors merely serve as triggers. Strategies and risk management techniques for dealing with such messes are therefore quite different from those appropriate for tame problems. Increasing our capacity to prevent unanticipated interactions among components entails simplifying systems; increasing our capacity to cure them entails decoupling major components (for example by building in longer times to respond).
All this is fairly straightforward and fine as long as most of us share an overriding social theory or overriding social ethic. If we do not, we face wickedness. Wicked problems are termed as 'divergent' as opposed to 'convergent' problems. A convergent problem promises a solution. The more it is studied, the more various answers sooner or later converge.
Tame problems are convergent by definition. Messes are convergent if we agree on what overlaps, on appropriate strategies, and on the kind of climate we wish to maintain.
A divergent problem does not promise a solution. The more it is studied, the more people of integrity and intellect inevitably come to different solutions. As with messes, there are very real dangers in trying to solve the wrong problem. Mistaking wicked problems for messes, let alone tame problems, almost inevitably leads one to conclude that those with different answers lack integrity, intellect, or both. The great danger is that such conclusions undermine trust, and trust is a fundamental strategy for collectively coping with wicked problems.
If wicked problems are becoming more common in our modern era, and there is compelling evidence that they are, we face a strategic choice. We can continue to misrepresent them as messes or tame problems, hoping they will not degenerate. On the other hand, we can acknowledge wicked problems for what they are and try to stabilise them.
This is not going to be easy, because wicked problems offend our sense of logic and our common beliefs even more than messes. It is pretty hard to accept that a problem has no solution. This seems tantamount to giving up. Given that many people will have a stake in how the problem is resolved, the process of solving a wicked problem is fundamentally social, and solving a wicked problem is fundamentally a social process.
Much work has been done on behavioural complexity and dynamic complexity.
What confuses real decision-making is that the two coexist and interact in what we call wicked messes (see Figure 2). The fact that behavioural problems cannot be solved in isolation makes it even more difficult to deal with people's differing assumptions and values: people who think differently must learn about and create a common reality, one that none of them initially understands adequately. Systems of interlinked problems interact with the misunderstandings, divergent assumptions, and polarised beliefs of different groups of people.
Improving communication and trust among different camps is not enough; people still are likely to focus on symptoms rather than deeper causes and to pursue low-leverage changes. Conversely, even if deeper understanding of the systemic forces at play is achieved, such understanding will be viewed with suspicion by the different, competing interests and mental models.
Solutions
The main thrust to the resolution of this type of problem is stakeholder participation and 'satisfaction'. This is because wicked problem resolving produces no single optimum solution but has many alternative satisfactory solutions. Therefore the production of a solution must be bounded by time or financial constraints to avoid it going on for ever.
So how do we propose to deal with wicked messes? The strategic issue is whether we choose to allow wicked messes to degenerate into chaos, choose to stabilise them as conditions, or, more radically, choose to try to dissolve them together.
From the risk perspective, listening and dialogue are essential to mapping the boundaries and learning to recognise the patterns of those interactions which are the crux of sorting out wicked messes. Real listening is also essential in establishing trust, and trust is the sine qua non of effectively working together. More significantly, mistrust is the dark heart of wicked messes.
The strategic principles for establishing trust are grounded in the realisation that what we have in common is far more significant and profound than our differences. These strategic principles are essential in sorting out wicked messes together. More significantly, in our increasingly complex and interdependent times, these principles guide us to live in ways that help us dissolve what is problematic.
What does this mean for the world of risk? Let us first look at how it might affect the concepts of management and leadership.
For our purposes, let us use John Kotter's definitions.(2) Here, management is about coping with complexity, and its practices and procedures are largely a response to the emergence of large organisations and complex projects. Leadership, by contrast, is about coping with change.
These different functions, coping with complexity and coping with change, shape the characteristic activities of management and leadership. Each system of action involves deciding what needs to be done, creating networks of people and relationships that can accomplish an agenda, and then trying to ensure that those people actually do the job. But each accomplishes these tasks in different ways. Therefore, how can we identify when we require the skills of leadership to dominate those of management to obtain a successful outcome?
I propose that we use the matrix. If we look at the activities required in more detail to see the attributes exhibited by the two principles, it may indicate the type of problems best solved by those skills. Let us revisit Figure 2 and look at the characteristics required to address these issues. Those required to achieve change are predominantly behaviour-based (needs and emotions) requiring influence rather than power to ensure their resolution. Trust and relationships must be developed, indicating a high degree of behavioural complexity. This allows us to divide the matrix into two, where leadership qualities dominate solutions in the upper half and management qualities the lower (see Figure 3).
How can this model help us with our overall understanding of risk and risk management? In the past, there has been a considerable difference of opinion between the use and legitimacy at various times of qualitative and quantitative risk assessment. If we accept the classification of types of problems shown in Figure 2 and then analyse how risk analysis may be applied to help us with each type of problem, we can see that, as we move further to the right of the matrix, there appears to be an increased reliance on the use of systems emphasising an interconnectivity of events. As we move farther toward the top of the matrix, there seems to be an increased reliance on social-science type solutions, where people do not necessarily behave as 'soft systems'. Instead, their behaviour is dominated by belief systems based on their feelings.
If we then apply our two types of risk assessment (quantitative and qualitative) and overlay them on the matrix we produce the diagram shown in Figure 4. We can observe that for the bottom sectors, where scientific-based solutions are dominant, quantitative risk data is reliable in the assessment of risk. Our assumption is that there is an optimum solution and therefore an underlying number that we will converge towards. By generating ever more data, we will move closer to the underlying 'truth'.
However, as we move up towards the behavioural sector, there is no underlying single solution. The solution will now depend on the feelings and ideologies of the people concerned in the assessment. Here, by using quantitative data to inform facilitated opportunity/risk workshops, qualitative results will reveal those underlying beliefs which will lead to satisfactory solutions.
Therefore it is critically important to involve all the stakeholders who can influence the success of the project and to attempt to limit your boundaries to the case in hand. Failure to do so may mean the group will grow beyond the limits of achieving a solution.
For risk managers, the most difficult part will be recognising the type of problem they are facing. To help achieve this I have used the classification of Tame, Messes, Wicked Problems and Wicked Messes. I have also sought to use the matrix to understand the behaviours required to deliver outcomes when using managers or leaders, and, finally, I have attempted to overlay the two concepts of qualitative and quantitative risk management on this matrix to aid in choice of the risk management techniques associated with the type of problem. The key to the solution of wicked messes lies in people and in the use of discussion and forums to explore the problems and the limitations of the solution.
There must be an open culture with an attitude of 'no blame'. It also requires the pursuit of designs that limit system coupling and complexity where possible. The move to enterprise risk management will require future risk managers to live comfortably in all areas of the matrix and to become familiar with and apply the tools and techniques needed.
Academic and business thinker Russell Ackoff wrote in 1974: 'We fail more often because we solve the wrong problem than because we get the wrong solution to the right problem.' Successful problem solving for risk management professionals means finding the right solution to the right problem.
(1) COSO is the Committee of Sponsoring Organizations of the Treadway Commission. www.coso.org (2) John P Kotter, wrote 'Leading Change', which outlined an eight-step process for implementing successful transformations.
- David Hancock is executive director consultancy, Halcrow Group, Tel: 01793 856529, E-mail: HancockD@halcrow.com
