Tag Archives: risk

Cry Wolf?

1 Reply
Revised on: 2022-10-30

Resilience Adviser or Scaremonger? What am I really? That is what started to ask myself after I came across an article written by Frank Furedi the other day. In the article, Furedi, a Professor of Sociology at the University of Kent, highlights the issue of vulnerability-driven policies and how possibilistic (worst likely) risk thinking has dethroned probabilistic (most likely) risk thinking. Why is it that we fear so much?

Cry wolf?

The Merriam-Websters Dictonary defines scaremonger as someone who is inclined to raise or excite alarms, especially needlessly. Well, that doesn’t fit me, does it? The Oxford Dictionary defines scaremonger as a person who spreads frightening or ominous reports or rumours. Perhaps a bit more like what I do every day. Reports yes, but rumours are a no-no. Finally, the Collins Dictionary defines scaremonger as a person who delights in spreading rumours of disaster. Well, I’m definitely not a rumour spreader, but I am perhaps overly concerned with – and some of my colleagues may even think obsessed with – thoughts of possible worst case scenarios that my organisation should prepare for.

The case for and against worst-case

And the overemphasis on possible risks rather than probable risks is exactly what Furedi tackles head-on in this article Precautionary Culture and the Rise of Possibilistic Risk Assessment. Written in 2009, it is probably or possibly (pun intended) even more valid today than it was back then.

The shift from probabilistic to possibilistic risk management characterises contemporary cultural attitudes towards uncertainty. This shift in attitude is paralleled by the growing influence of the belief that future risks are not only unknown but are also unknowable.

Future risks – to many people – are not only uncertain, but also unknowable. So, while probable, but uncertain risks is something we can learn to live with, possible and unknown risks – and even worse: unknowable risks – are almost too much to  bear.

The shift towards possibilistic thinking is driven by a powerful sense of cultural pessimism about knowing and an intense feeling of apprehension about the unknown. The cumulative outcome of this sensibility is the routinisation of the expectation of worst possible outcomes. The principal question posed by possibilistic thinking, ‘what can possibly go wrong’, continually invites the answer ‘everything’. The connection between possibilistic and worse-case thinking is self-consciously promoted by the advocates of this approach.

One of the defining features of our times is that anxiety about the unknown appears to have a greater significance than the fear of known threats. This constant feeling of anxiety is typical of today’s risk society, a society I wrote about risk society in a post 5 years ago: According to sociologist Anthony Giddens a risk society is increasingly preoccupied with the future (and also with safety), thus generating the notion of ubiquitous risk in whatever direction we look.  The German sociologist Ulrich Beck defines it as a society that while hailing technology and innovation at the same time seeks to deal with the hazards and insecurities induced and introduced by technology and innovation itself. In other words, we’re more concerned with whatever possible bad that comes with the good than trying to assess how bad the bad really is, if at all.

Time and again the public is informed that the most dreadful dangers are not just ones that we cannot predict or anticipate but ones about which we cannot say anything because they are literally unknown. […] The traditional association of risk with probabilities is now contested by a growing body of opinion that believes that humanity lacks the knowledge to calculate them.

So instead of applying all our science and all our knowledge to close in on the most probable risks, the much easier solution is to home in on all possible risks, or better, on the most feared risks. It’s a vicious circle, because the less we know about a risk, the more we fear it, and the more we fear it, the more we want to deal with it, without investigating it, because it could happen any time, probable or not.

The future of the world appears to be a far darker and frightening one when perceived through the prism of possibilities rather than probabilities. Probabilities can be calculated and managed, and adverse outcomes can be minimised. In contrast, worse-case thinking sensitises the imagination to just that – worst cases.

Worse-case thinking, so Furedi, encourages society to adopt fear as of one of the dominant principles around which the public, its government, and institutions should organise their life. Insecurity is institutionalised and worst-case scenarios are thought of as so normal that people feel defenceless and vulnerable to a wide range of future threats.

Furedi describes this overemphasis on possible threats instead of probable threats as “the devaluation of knowledge and the enthronement of ignorance”. We are ignorant because we prefer not to know about (the probability of) the risks, they are simply there, that is enough for us. Worst case risks are what drives our policies, not the actual risk.

And I?

Furedi does have point. In my attempts to convince my own management that we need to have crisis management plans and conduct emergency drills I must admit that I often resort to worst case scenarios. That said, the realisation is dawning on me that crisis management plans and drills need to be based on (f)actual and probable threats, not on fear alone.

Reference

Furedi, F. (2009) Precautionary Culture and the Rise of Possibilistic Risk Assessment. Erasmus Law Review 2(2), 197-220. DOI: 10.553/ELR221026712009002002005

Author link

Read and download

Related posts

The capability concept

Leave a reply
Revised on: 2015-11-26

Capability is an important measure in addressing vulnerabilities and in assessing resilience. Is there a way to quantitatively describe what capability entails? That is what Hanna Lindom, Henrik Tehler, Kerstin Eriksson and Terje Aven try to do, in a paper called The capability concept – On how to define and describe capability in relation to risk, vulnerability and resilience. And as the name implies, it’s not just about capability.

Background checks are worth doing

I came across this paper while doing some “background checks” – as I like to call it – on the paper I reviewed the other day. By background check I mean reading the references and/or other papers that could shed some same or different light on the issues in the paper in review. And because in that paper capability was highlighted as an important issue in supply chain risk management I began investigating the concept of capability and found this paper here. A very interesting paper, and definitely an Aven-ish paper, even though he only appears as the fourth author.

Definitions of capability

The concept of capability is used frequently in scientific literature. However, despite the fact that researchers
and practitioners frequently use the concept of capability, they rarely seem to define it. So say the authors. Nonetheless, in their extensive literature review they manage to find no less than 13 different definitions or descriptions of capability:

Looking more closely at these definitions, the authors put forward five trends:  that capability equates to resources, that resources are an important part of capability, that capability is related to ability, that capability is related to capacity, and that capability is something that affects a goal.

Capability explained

Building on Aven’s definitions of risk, vulnerability and resilience the authors describe capability in a very same manner, and this is where the paper really is the most Aven-ish:

Capability is the uncertainty about and severity of the consequences of the activity given the occurrence of an initiating event and the performed task.

Capability = (CT U | A T)

This is definitely not an easy definition to follow if you haven’t read Aven’s other definitions first, so let me recapitulate those.

Risk is the uncertainty about and severity of the consequences of an activity.

This relates risk to the familiar definition of risk as a combination of probability and impact, where probability is not seen seen as a deterministic value but as a value that is uncertain and must be taken into account as such.

Vulnerability is the uncertainty about and severity of the consequences of the activity given the occurrence of an initiating event A.

This links vulnerability to risk, saying that a given vulnerability depends on a given risk, but only manifests itself when triggered by an event, meaning that one cannot be generally vulnerable, but only vis-a-vis a certain risk and only triggered by a certain event related to that certain risk.

Resilience is the uncertainty about and severity of the consequences of the activity given the occurence of any type of A.

This links resilience to vulnerability, saying that resilience constitutes the sum of vulnerabilities (or perhaps non-vulnerabilities) in relation to whatever trigger. While one cannot be generally vulnerable, one can be generally resilient.

Going back to the definition of capability can thus be interpreted as the uncertain effect a certain task has that is performed in relation to a vulnerability. There is no general capability, only a certain capability in relation to a certain vulnerability, depending on how a certain task addresses this vulnerability.

Capability explored

Going back to the paper, the authors develop an excellent case example of how capability can be understood the way they have defined it.

In the case example they take the reader through a set of various scenarios where they develop a stepwise determination of capability given the success or failure of the previous step, thus demonstrating that capability is inextricably linked to a task with an uncertain outcome (success or failure).

Conclusion

I started out by saying that this is a very Aven-ish paper, and it is. What is so Aven-ish are the abstract definitions that twist your mind and must be thought through and dissected word by word, and put back together again. I must admit that I in the beginning of my blogging career and academic endeavours  stayed away from Aven’s papers because they were hard to grasp and intellectually challenging for a qualitative researcher like me. That said, maybe I have matured or maybe Aven has become more pragmatic over the years (albeit I doubt he has), because his papers have gotten easier to read and understand since I first started to read them. As to the topic of capability I now know a lot more about it.

Reference

Lindbom, H., Tehler, H. , Eriksson, K. , Aven, T. (2015) The capability concept – On how to define and describe capability in relation to risk, vulnerability and resilience. Reliability Engineering & System Safety (135), 45-54. DOI: 10.1016/j.ress.2014.11.007

Download

Author links

Related posts

Appetite versus Attitude

Leave a reply
Revised on: 2015-09-20

Finally, and long overdue, another review in the Gower Short Guide to Business Risk book series. This is the 7th book I’m covering, and I must say that the main topic of Risk Appetite versus Risk Attitude has brought a whole new perspective on risk and risk management to my attention. Basically, what the books states is that every company should ask themselves two questions: 1) How much risk do we want to take? That is risk appetite. 2) How much risk do we think we should take? That is risk attitude. There are actually 4 more questions, dealing with risk propensity, risk capacity, risk perception and risk exposure that make up the risk management framework presented in this book.

Risk management – difficult or easy?

Risk management, so the authors, is a way of understanding the trade-offs we are making when we decide a course of action, not only in the short-term, but more importantly, in the long term, because a long-term perspective helps in making strategically consistent decisions time and again, instead of simply listening go your gut feelings. Understanding your risk appetite, and your risk attitude, lays the groundwork for making good decisions in uncertain yet important situations.

Who says what?

An interesting feature of the book is a whole chapter dedicated to collecting the views on risk appetite from regulators, standards bodies like, professional associations and consultants, clearly showing that there is a lot of debate about risk appetite, but no consensus.

Risk appetite risk tolerance, risk attitude and risk profile are mentioned by the regulators, but appear to be the same. Risk appetite is mentioned in standards, but not always well defined. Professional associations  do fare a bit better; at least they do show some guidance in how to express risk appetite in a useful way. Consultants, seeing business opportunities in helping confused managers, have produced a wide range of white papers on risk appetite.

Although there is some common thinking among all these sources, there is little agreement and no agreed-upon definition. The list of 24 different definitions taken from these sources definitely shows that. However, so the authors claim, two strands of thought are common in these definitions, risk as a level or threshold that should not be crossed, and risk as a willingness to cross that same threshold, i.e. how much risk do we think we should take and how much risk do we want to take respectively.

Appetite versus attitude

The authors spend a whole chapter on describing and discussing appetite and attitude, their differences and similarities, perhaps a bit too much in my view, but the message sinks in finally:

Risk appetite: Tendency of an individual or group to take risk in a given situation.

Risk attitude: Chose response to a given risky situation, influenced by risk perception.

While this makes perfect sense when reading it the first time, the second time I ask myself, what is “risk” in risk appetite, and what are “risky situations” in risk attitude? Nit-picking, perhaps, and quickly forgotten, because their next point is rather brilliantly explained:

So when we face a risky and important situation and we need to decide how much risk to take […] we could just go with our gut, and make an intuitive decision [..] that might lead to a good outcome. But i might not. This is where is risk attitude comes in, allowing us to chose an appropriate positioning towards the risk.

Risk appetite comes from the heart, or rather, gut, whereas risk attitude comes from the head. Simple as that.

Risk elements at play – inputs and outcomes

The perhaps most difficult part of the book is the chapter that puts all risk elements together:

Risk propensity: How much risk do we usually like to take?
Risk appetite:  How much risk do we want to take?
Risk capacity: How much risk can we take?
Risk perception: How much risk do we think we are taking?
Risk attitude: How much risk do we think we should take?
Risk exposure: How much risk are we actually taking?

Inputs to risk appetite and risk attitude and their respective outcomes are then used to construct what the authors call the RARA-model.

What I noticed here is that risk actions are outcomes of risk attitude, not risk appetite. Risk appetite on the other hand sets the risk threshold, against which risk actions and the resulting residual risk should be checked against. They way I interpret this is that risk attitude has a lower risk level than than risk appetite, and risk attitude should be the guiding principle for risk actions, not risk appetite.

Risk attitude and risk appetite exemplified

Half the book is devoted to a number of convincing examples of how the RARA-model can be used in practice in making well-informed risk decisions. In doing so, the authors use three kinds of scenarios: Unmanaged, Constrained and Informed Scenario.

Unmanaged, where risk thresholds are set by the organisation with no conscious or intentional reference to risk appetite or risk attitude.

Constrained, where risk thresholds are consciously modified by an understanding of the inherent risk appetite.

Informed, taking into account the chosen risk attitudes of key stakeholders as well as wider organisational factors when setting risk thresholds.

The beauty of these different scenarios is that they make use of the above elements in the RARA-model in very different ways, demonstrating how everything comes into play.

Conclusion

At first glance the RARA-model appears unnecessarily complex, and the case examples, using every single element of the model, are very elaborated. However, what the model really is all about is answering the six questions above. I like this book, but it takes a while to sink in, especially for someone like me, who uses the ISO 31000 standard extensively in my daily work.

Reference

Murray-Webster, R. and Hillson, D. (2012) A Short Guide to Risk Appetite. Farnham: Gower Publishing.

Related links

Related posts

What is risk?

Leave a reply
Revised on: 2015-10-24

What is risk, and how can it be expressed? Should risk be defined through probabilities or should risk be defined through uncertainties? That is what Eyvind Aven and Terje Aven are attempting to explain in their paper On how to understand and express enterprise risk. In the paper, they claim that different international standards, such as the AS/NZS 3460 Risk Management Standard, the COSO ERM framework and the ISO 31000 Risk Management Standard do not provide adequate guidance on these issues and lack the necessary precision. Thus, they establish their own framework, where risk has two main components, namely 1) the impact of events and consequences (outcomes), and  2) the associated uncertainties (probabilities).
Continue reading →

Risky decisions – just do it, or not?

2 Replies
Revised on: 2015-09-03

Choosing the right supplier is a risky decision. Chose the wrong supplier, and you may face a severe disruption in your supply chain. Chose the right supplier, and all goes well. Hopefully. But is it possible to judge supply risk objectively? In the end, all risk decisions are subject to the decision maker’s perception of risk. The question is, does risk perception influence risk decisions? That is what Scott C Ellis, Raymond M Henry and Jeff Shockley try to answer in Buyer perceptions of supply disruption risk: A behavioral view and empirical assessment. Here they operationalize and explore the relationship between three representations of supply disruption risk: magnitude of supply disruption, probability of supply disruption and overall supply disruption risk. This is an article that hits right home they way I view risk.

Continue reading →

State of the art in SCRM?

4 Replies
Revised on: 2015-09-12

A severe supply chain disruption has hit my own blog: More than a month without a post. It’s not that there is so little to write about, it’s just that there is so little time to do it, which is why I’ve decided to reurn to a once weekly posing schedule. Nonetheless, what better occasion could there be to resume my posting than the discovery of an article proclaiming to provide a review of the state of the art in supply chain risk management? The literature review and conceptual framework developed by Hans-Christian Pfohl, Holger Köhler and David Thomas clearly identifies the main principles of SCRM and develops a framework and definitions for disturbance, disruption, security, resilience and risk. Supply chain risk management, so they say, is a process with evolutionary steps, involving no less than 17 underlying principles. Phew…

Continue reading →

Risk and Vulnerability in Virtual Enterprise Networks

4 Replies
Revised on: 2014-07-30

A month ago I posted on my first publication, a book chapter on A Conceptual Framework for Risk and Vulnerability in Virtual Enterprise Networks in Managing Risk in Virtual Enterprise Networks: Implementing Supply Chain Principles, edited by Stavros Ponis from NTUA in Athens, Greece, and published by IGI Global. A month ago, the book was merely announced on the publisher’s website, now it is fully present. Not only do I have the honor of opening the book by being the first chapter, but  – as I just found out – I also have the honor of having the free sample chapter for download…making my thoughts available for criticism for the whole Internet world, not just the inquisitive  reader who stumbles upon this book in the university library and decides to read it.

Continue reading →

Not all risk is risk

2 Replies
Revised on: 2015-09-22

I had planned to post this yesterday, when I was taken by surprise by the most severe supply chain and transportation disruption ever to hit Norway and much of Northern Europe: Volcanic ash from Iceland grounds all Norwegian air traffic, and it’s not over yet. Today appears to become another day with no air traffic in my neck of the woods and the social impact is widely felt, to say the least. And today’s post is by no means unrelated to air traffic. My latest favorite author, Terje Aven from the University in Stavanger, Norway, takes risk research to new heights in his most recent article from 2010. In How to define, understand and describe risk he contends that the uncertainty surrounding risk assessments is perhaps more important than the risk value itself.

Continue reading →

Risk versus vulnerability

Leave a reply
Revised on: 2015-09-08

What is risk, and what is vulnerability? While connected, they are not the same, and perhaps, often confused? It is important to see the difference, and that is the starting point of Terje Aven’s 2007 article on A unified framework for risk and vulnerability analysis covering both safety and security. Risk is a more general concept, while vulnerability relates to a certain source. In this paper safety and security, normally based on different analysis approaches and using alternative building blocks, are brought together in a unifying risk and vulnerability framework that covers both accidental and malicious events.

Continue reading →

Security and continuity of supply

2 Replies
Revised on: 2015-09-03

Aah…the intricacies of the English language. Not supply (chain) security, but the security of supply, as in the continuity of supply. Do you see the difference? This conference paper comes from three Finnish researchers, working with VTT Technical Research Centre of Finland and was presented at ESREL 2007, a conference that will spark many posts on this blog. Today’s paper describes how Finland views logistics and supply as important to national security and how the LOGHU project was created to develop a framework for identification and ranking of threats and corresponding countermeasures. While the paper clearly shows that the project is still a work in progress, much wisdom and food for thought can be drawn from it.

Continue reading →

Supply Chain Risk Literature: a complete review

5 Replies
Revised on: 2015-09-11

Finally, here it is, the complete review of supply chain risk. At least by the looks of it. Supply chain risks: a review and typology, is a 2009 article by two scholars from the University of Kentucky, Shashank Rao and Thomas J Goldsby, who review, synthesize and typify some 160 or so articles in supply chain risk and risk management. But is it really a complete review? That’s what I wanted to find out.

Continue reading →

Risk and resilience in maritime logistics

Leave a reply
Revised on: 2015-09-26

This week’s focus are risks in the maritime supply chain and today’s paper sets out a framework for risk, vulnerability and resilience in maritime supply chains. Coping with risk in maritime logistics, by Bjørn Egil Asbjørnslett and Hallvard Gisnaas, is a conference paper, presented at ESREL 2007, the European Safety and Reliability Conference, in Stavanger, Norway, 25-27 June 2007. Asbjørnslett is not a newcomer to this blog; I have previously reviewed some of his works on the vulnerability of production systems. He is also a proponent of supply chain risk and a member of ISCRIM, and it was while trying to find more of his publications that I stumbled upon the 2007 conference paper. The contents were both surprising and unsurprising.

Continue reading →

Risk & Vulnerability

6 Replies
Revised on: 2015-09-11

Supply chains are increasingly becoming complex webs and networks and are no longer straightforward chains with just a few links between supplier and customer.  Supply chains have indeed become complex systems, and the system thinking that pervades Einarsson and Rausand (1997) An Approach to Vulnerability Analysis of Complex Industrial Systems is perhaps applicable to supply chains? Why?  Perhaps because, really, there is little difference between vulnerability in supply chains and vulnerability in complex industrial systems.

Continue reading →

Book Review: Managing Supply Chain Risk and Vulnerability

Leave a reply
Revised on: 2015-09-09

Another book by someone from the ISCRiM group? No, not this time, or perhaps, yes, after all. Managing Supply Chain Risk and Vulnerability: Tools and Methods for Supply Chain Decision Makers by Teresa Wu and Jennifer Blackhurst sounds like ISCRiM, but it’s not. If it were, it should have been noted in the ISCRiM Newsletter, but it wasn’t. Nonetheless, several of the ISCRiM members have contributed to the chapters in this book, which is well worth taking a closer look at, particularly if risk modeling and decision-making is your field.

Continue reading →

Risk and Uncertainty in Supply Chain Management

2 Replies
Revised on: 2015-09-26

I’ve searched and scoured numerous academic journals in order to find literature I can use for this blog. Sometimes my readers help me and suggest articles I am not yet aware of, and sometimes I stumble upon them myself, accidentally. Today I stumbled upon a 2004 working paper from the Copenhagen Business School (CBS): How risk and uncertainty is used in Supply Chain Management: a literature study of 136 articles since 1970 by Lars Bøge Sørensen, who finished his PhD at CBS in 2005, and who is now a Director of Operational Excellence at PricewaterhouseCoopers.

Continue reading →

Risks in virtual enterprise networks and supply chains

4 Replies
Revised on: 2015-09-05

It is not unusual for suppliers in a supply chain to come together and act as a Virtual Enterprise Network (VEN) and today’s supply chains exhibit many VEN-like features. Is managing risks in Virtual Enterprise Networks different from managing risks in supply chains? With this in mind I submitted a paper to MITIP2009, the 11th International Conference on the Modern Information Technology in the Innovation Processes of the Industrial Enterprises, to be held in Bergamo, Italy, in October.

Continue reading →

BBC World Debate: Disasters – Prepare or React?

Leave a reply
Revised on: 2015-09-11

Should we actually bother to spend time and money on disaster mitigation, or should we rather focus on preparing for disaster recovery?  Is re-active better than pro-active? The BBC World News has an interesting program called the world debate, that puts the important questions to those in the spotlight, and usually this is not the most exciting program. It’s a panel discussion, where representatives from global politics, finance, business, the arts, media and other areas come together and discuss various matters.  More often than not, for the few and selected, but not for the many, and not for me. This morning, however, the topics was disasters and risks, and instead of switching off, as I usually do, I kept watching, and I was taken aback by the diversity of the arguments.

 

Continue reading →

Does product design impact supply chain risk?

Leave a reply
Revised on: 2015-09-03

Is it possible that supply chain risk is a result of unfortunate product design? Is it possible that supply chain risk does not only relate to the supply chain itself, but just as much to what is in the supply chain? What is in the supply chain is determined by a design process, and consequently, is it possible to design supply chain risk out of (or in to) the supply chain? In Khan, Christopher & Burnes (2008) The impact of product design on supply chain risk: a case study, that is the question that is sought answered.

 

Continue reading →

The six ways of dealing with risk

3 Replies
Revised on: 2015-12-07

Classic risk management literature acknowledges four ways of dealing with risk after establishing a risk matrix:  Avoid, Reduce, Transfer and Retain or Accept. However, as it turns out, there are six ways, not just four ways to deal with risk, as the classic risk matrix indicates.  Two more are Exploit and Ignore. The former stems from Enterprise-wide Risk Management (DeLoach, 2003), while the latter is more of a sidenote in On the Value of Mitigation and Contingency Strategies for Managing Supply Chain Disruption Risks (Tomlin, 2006), but nonetheless an important observation.

Continue reading →

Risk Management: Contingent versus Mitigative

4 Replies
Revised on: 2015-09-08

The risk management literature separates between mitigative actions or strategies and contingent actions or strategies. It is important to keep these two perspectives apart. Why? Because risk management needs to address both sides of the risk: what lies behind the risk (source) and what lies in front of it (consequences). Here is my attempt at defining these two terms and explaining the differences, at least the way I see it, based on Asbjørnslett (2008), Tomlin (2006) and Jüttner et al. (2003).

 

Continue reading →