.
“The world around us is changing in ways that may have profound effects on the emergency management enterprise. Collectively, we must begin to think more broadly and over a longer timeframe if we are to understand these changes and their potential impacts. To this end, FEMA has launched a Strategic Foresight initiative (SFI), the objective of which is straightforward: to seek to understand how the world around us is changing and how those changes may affect the future of emergency management and our community…

“The SFI can serve as one important tool in the development of both strategy and plans. By understanding the potential future environment, organizations will better understand and anticipate risk while ensuring opportunities can be fully capitalized. For example, the SFI may identify new or increasing capability requirements as well as emerging capabilities that do not exist today. Such identifications could support decisions about future investments as well as planning activities and exercises. In a more indirect manner, the SFI can help establish a research agenda for the emergency management field by highlighting areas of emerging relevance and the key questions that remain unanswered.”

[On March 1, 2003, FEMA became part of the U.S. Department of Homeland Security.]

Anyway, this is in the intro (p5), and I found it a perfect encapsulation of a core problem in foresight thinking — quantitative vs qualitative methods — well worth retyping out to have on hand for reflection. Here goes:

“The story that I have to tell is marked all the way through by a persistent tension between those who assert that the best decisions are based on quantification and numbers, determined by the patterns of the past, and those who base their decisions on more subjective degrees of belief about the uncertain future This is a controversy that has never been resolved.
The issue boils down to one’s view about the extent to which the past determines the future. We cannot quantify the future, because it is an unknown, but we have learned how to use numbers to scrutinize what happened in the past. But to what degree should we rely on the patterns of the past to tell us what the future will be like? Which matters more when facing a risk, the facts as we see them or our subjective belief in what lies hidden in the void of time? Is risk management a science or an art? Can we even tell for certain precisely where the dividing line between the two approaches lies?
It is one thing to set up a mathematical model that appears to explain everything. But when we face the struggle of daily life, of constant trial and error, the ambiguity of the facts as well as the power of the human heartbeat can obliterate the model in short order.”

So this stimulates me to put down a few thoughts about risk assessment and its relationship with industry and strategic foresight as a whole. This is a big topic of course, but seeing as the categories are confused a lot, it’s worth tackling even if just in summary terms.

When I reach the topic of Risk Assessment in my ‘Industry Foresight and Business Future Strategy’ MBA elective, I use the ‘Adidas-Salomon: Incorporating Risk into Corporate Strategy’ mini-case [Ref: ICFAI 304-141-1; sourced via Cranfield’s Case Clearing house.]

The case is a useful baseline in risk assessment because it describes the various risks a multinational company typically faces: marketing risks (market change, brand image); operations risks (quality; reliability of processes and suppliers); social & environmental risks (workforce & natural resources compliance); legal (liability, regulation, patent); information technology (compromise or disruption); and financial risks (currency, interest rate, credit).

Business disruptors
In sum these are the things that could damage or disrupt the business. Isolating such factors, keeping vigilance over them, and having thought through or enacted counter-measures in advance, allows the organization to better control or reduce the impact should risk become reality.

All risks are future events, so a risk assessment is undoubtedly a future study, but assuming a company looks diligently across all these categories for potential and emerging hazards, how prepared is it for a changing world? What kind of industry foresight does this give managers? Is a risk assessment a futures assessment?

The obvious first answer is that a risk assessment is only half the equation. It’s oriented to the downside potential of changes not the upside; looking for threats not opportunities. Obviously that means that opportunities are less likely to be identified.

The second thing is that a standard risk assessment operates in the realm of known risks, in known categories, that may cause disruption and damage in a known way. It doesn’t have the mechanism to expand conceptions of what could go wrong, or how it could go wrong, or what the full knock-on effects will be. The types of mental-model-expanding techniques that fuller foresight offers are not built into a typical risk assessment.

Strategy questions
Third, risk assessments never really broach the question: is the business idea or business model good and will it keep on being good? That is, what products or services will be appropriate going forward, or how will models of supply or manufacture or marketing or fulfillment need to change, due to technology change or shifting consumer preferences.

In other words, risk assessment doesn’t ask strategic questions of managers. It is part of the day-to-day management vigilance necessary with reference to the future – the hygiene factors in running an organization. It is about keeping the business going as is, not about changing it for a changing word.

There’s nothing wrong with this. The point is, it’s just ‘first base’ in building a quality view of the future, and therein a robust point-of-view about what to do next. Although no doubt companies such as Google or Apple or Virgin, etc., assess and mitigate their risks, they didn’t become successful in their future by doing risk assessment and saying ‘That’s it, were done. We’re ready for the future.”

Peter Bernstein, the author of “Against the Gods: The Remarkable Story of Risk,” died recently at the age of 90. In memoriam McKinsey Quarterly reposted this recent Bernstein interview. I put it up here because it’s a timely and timeless lesson in thinking about uncertainty and threats, and avoiding simplistic (quantitative) approaches to managing them – one of core themes of “Future Savvy.” Bernstein offers and endorsement of real options and explains why sophisticated Long Term Capital Management (LTCM) mathematical models to control risk created “a math dependency” that was blind to, among other things, unexpected systemic feedback to its own emergence:

One of the first things Bernstein says is that risk implies that we don’t know what will happen, which could be good things happening too. Risk management, as it is currently understood, gets executives to look at what could go wrong in the uncertain future of the enterprise. (Somehow threats are easier than opportunties to get departmental budget for.) The standard approach is to break risks down into commonly understood threat categories: a typical analysis would illuminated risks posed by technology failure, communications failure, security failure, natural disasters, accidents, or market/reputation risk, liability risk, financial/credit risk, and so on. This negative-outcome identification is typically followed by strategies to monitor, minimize, or control the risk event or its impact.

Doing all this is great, BUT it is just a narrow part of enterprise and industry foresight. Why? First, industry foresight or futures studies for business is focused as much on the opportunities change offers as on threats. Second, foresight tools (when correctly applied) set themselves the task of enlarging perspectives or mental maps so that we can see more things, or more possibilities than the generally expected set (whether good or bad). Set against this, risk management is little more than the catalog of known threats. The unknown or poorly understood threat, or unseen opportunity missed (and grabbed by others) is likely to be more damaging to the enterprise.