Decision Making / 7 / 7.5 / 7.5.4

7.5.4 Evaluate Risks

The aim of the first series of group workshops conducted to identify, analyse risks, and evaluate is to complete a risk list taking the form of the template at Figure 7-2. The collective output of a risk workshop is typically as many as 100-125 risks. Clearly we cannot work with all of these, though we are bound to work with them to the extent that they may be linked in a web of interrelationships as shown in the cases studied.

The Risk List is reduced according to a process of ranking of risks according to their risk factors (RFs). Those closest to 1.0 (though 1.0 should never be found in practice because nothing is certain) are listed at the top of the ranked list, then listed in decreasing numerical order. Where risks with lower RFs are linked to risks with higher RFs, there must be some form of cross-referencing between these risks. The comment column is generally used for this. This means that risks with lower RFs cannot be disregarded where it is essential to preserve the systemic linkages. Acceptance that risks can be, and indeed are, systemic in nature means that when feedback loops operate, a specific risk previously identified as having a low likelihood may grow exponentially as a result of the operation of the feedback loop. Similarly we cannot discard linked risks even though the initial evaluation suggests consequence is not serious: consequences may become more serious as the circumstances change and feedback loops operates, or there is shifting feedback loop dominance. Unique IDs must remain with each of the originally identified risks. If new risks are identified, they are designated using previously unused ID numbers. Even if risks are subsequently discarded from further consideration, the remaining risks should never be re-numbered. There are a number of intervening steps, which are not explicitly described in the risk-management process:

• Feeding back the products of risk workshops to key stakeholders -the completed Risk List is reported back to the key stakeholders. This List is explained in detail, with particular emphasis on the rationale behind the rating of each risk. The key stakeholders are those whose domains of action are most likely to be impacted upon by the development of risk mitigation strategies. Their continued support will be essential to the implementation of risk-mitigation strategies.
• Refining the Risk List– the complete Risk List must be refined through one or more reviews. Typically, the complete list of over a hundred identified risks is reduced to some 15-20 through a series of workshops and discussions involving the original stakeholders and the key stakeholders, if necessary through a series of iterations. An alternative is to assemble a nominal group formed from members of the original stakeholders’ group and the key stakeholders. It has been found that it is not always practical to involve all stakeholders in the process of reducing the list to a further reduced number. Sufficient of them will be so closely involved with the risks they identified in the first instance that they will be reticent to allow the relevant Likelihoods and Consequences, and hence their Risk Factors to be reassessed. This had been found to be the case particularly when the risk is re-evaluated with a recommendation it be downgraded.
• Further refining of Risk List to create the basis for scenario planning. The next step involves achieving formal endorsement of this Risk List from the key stakeholders and their ultimate endorsement. Without endorsement and unqualified support at this stage, development and ultimate implementation of acceptable risk-mitigation strategies will not be possible. Remaining risks are re-cast into a set of scenarios each taking the form of a short story. To help stakeholders provide valuable input to the building these stories, or scenarios, I frequently ask them to imagine reading the newspaper at some stage in the future. The future newspaper article is reporting some serious set of incidents in the domains of action of the stakeholders. They are asked to imagine how those newspaper headlines could have possibly grown out of today’s situation, as that situation might be affected by the playing out of systemic and dynamic events in the intervening period. These scenario-building activities must be informed by an understanding of dynamic complexity and systemic risks. Causal depictions are necessary prerequisites to identifying possible ways the scenarios might play out⁴. We should find, though we must not artificially create it, that feedback causality and delay are part of the scenarios.