The business of risk management is changing. Once a matter of human intuition, it is now increasingly determined by technology and big data. Richard Fenning was the CEO of Control Risks, one of the world’s biggest specialist risk consultancies, for 14 years. 

After stepping down, he released a book about his experiences in global risk management called What on Earth Can Go Wrong: Tales From the Risk Business.

FENNING: Risk is the calculated probability of some adverse action occurring that’s going to be to the detriment of the business. Assessing risk should be a logical calculation — a process of intellectual engineering: You put inputs into the process, and you get outputs out. 

Fear Clouds Judgment

But what I have experienced during years of dealing with businesses all around the world is that this process gets clouded by a much more visceral response — fear. Rather than being a careful evaluation of actual probabilities, fear is an impulsive response, often based often on what people are hearing and assuming about their everyday lives. 

As humans, we get preoccupied by things that grab our attention and scare us, while we tend to be much more complacent about things that are deeply familiar to us — but nevertheless risky.

Driving our cars, for instance, is in many cases the riskiest thing that most of us do, and yet we do it without any real consideration for the danger that we’re putting ourselves and others in. But we worry intensely about things over which we have very little control, such as a random terrorist attack. That is not to underestimate the awfulness of terrorism but to illustrate how habitual familiarity desensitizes us to actual risk.

Likewise, our response to the COVID pandemic has been an extraordinary confusion of changeable scientific truth, fear and complacency. It has been a near impossible challenge to disentangle rational action from irrational behavior. From a corporate point of view, a lot of risk management is about disentangling that emotional human response.

The Scale of the Problem Can Dwarf a Company

BRINK: Would you say that companies have generally got better at navigating the risks they face?

FENNING: They have, for sure. Risk management as a management science has moved from the peripheral vision of executive life to something that now dominates every board agenda pretty much everywhere in the world. It is no longer treated as an afterthought. 

But at the same time, the scale of the problem has pulled away from them. A large modern corporation can be an extremely unwieldy beast to control. Just the sheer size of multinational corporations can cause the mechanics of risk management to be overly reliant on a false sense of comfort from compliance with auditable standards.

So while we are more sophisticated in the management of risk, the likelihood of bad things happening has not gone down, and the impact it can potentially have on organizations has, in many ways, got much worse. 

Often, there is little flex in the system. With the COVID pandemic, there has been this realization that companies and governments can be very vulnerable, because supply chains are so globally stretched. That is probably OK if it means table-ripe avocados are late getting to supermarkets, less so if hospitals are running short of respirators.

The Delta Between What We Know and What Technology Can Do

BRINK: Are the new types of risks being faced by companies, like new technology or climate change, now so large and moving so fast that it is harder for companies to mitigate and manage them?

FENNING: Technology is the big game-changer. The positive impact that technology has had on corporate life is obvious. In the last year, we never thought we’d be able to run big complex organizations from home, and guess what? We can. The technology was largely there without us realizing that it was.

As organizations have got more complex in their operations, more attributes have been vested in fallible human beings, who are deified as CEO gods and paid extraordinary sums of money.

But with the huge opportunities that are opening up with AI or quantum computing, it’s almost impossible for our analog brains to understand the magnitude of what’s occurring. And therein is the problem, because we essentially have the same brain with the same cognitive capacity that we’ve had for hundreds of thousands of years as human beings.

A small proportion of the population has managed to devise and harness technology to do the most extraordinary things that the vast majority of people cannot even begin to comprehend. That delta between what most of us can grasp and what this technology is now designed to do is very, very risky for us. 

It’s such a positive in so many ways, and yet we just don’t have the intellectual horsepower as ordinary people to be able to understand what’s happening.

The Risk of the CEO As God

BRINK: What are the most common mistakes that CEOs make across different sectors? Is there any commonality?

FENNING: Most corporations still essentially operate on a hierarchical pyramid, where at the top of the pyramid you ultimately have one individual.

As organizations have got more complex in their operations, more attributes have been vested in fallible human beings, who are deified as CEO gods and paid extraordinary sums of money, sums that previous generations of CEOs just can’t even begin to comprehend and recognize. 

So there are two things working against themselves: the creation of this all-powerful, charismatic CEO, and at the same time, that person realistically cannot be expected to comprehend everything that is happening in the organization. And as a result, our expectations of the impact that one person can have on an organization becomes wholly unrealistic. 

Organizations are now so big you have to use technology to understand some risks. But increasingly, the risk is not visible to the human eye and can only be detected by another machine. We are living in an age where we have to be dependent on systems, software and technology to be able to identify, quantify and rank risk — and yet, there’s still got to be a human mind overseeing all that. 

The idea that we can go back to gathering intelligence about what’s happening in our dispersed multinational organizations only using human judgment is just not going to happen.

Dealing With Blind Spots

BRINK: So there isn’t a common blind spot that CEOs have when they are dealing with risk?

FENNING: The competence and capability of people to see the world in a clear-eyed way is never uniform. But the capacity of people to suppress what they might regard as bad news and only focus on good news is extraordinary. And you see the way in which people are so attracted to a stereotype.

So if you step away from corporations for a moment to think about individual countries, we’ve seen it with China, of course, where there’s a suppression of potential bad news about markets that everybody is clamoring to have a part of. Then suddenly the geopolitics changes. 

Very smart, very committed people allow themselves to suspend belief and go along with a narrative that, in the cold light of day later, seems crazy.