Q&A talks about risk assessment with Michael Bechara, the creator of Enlighten Software, a product designed to simplify and demystify corporate risk assessments. Bechara, whose background is with Granite Consulting Group, was among the presenters at last month’s Institute of Internal Auditors, General Audit Management conference in Las Vegas.
Q: You’ve developed a risk gathering and processing system. What are some of its highlights?
A: Corporate America has suffered through a number of intellectually bankrupt approaches to risk assessment for some time. There have been many attempts to identify and mitigate corporate risks, from developing mind numbing “risk universes” to utopian attempts to prevent any “negative event” from occurring.
Corporate risk management is an area sorely in need of logic, clarity and practicality. Accordingly, our approach makes some fundamental distinctions:
• Any discussion of risk is pointless unless done through the lens of company objectives. Objectives are the main goals of a company as of a point in time. For example, if my objective is to stay home and watch TV, should I be concerned with my car getting a flat tire?
• The best source of risk data is from those trying to achieve the company’s objectives — its people. Those trying to attain an objective know exactly what obstacles and threats they face on a daily basis.
• Once you have objectives and risks, you need to identify risk patterns or dangerous combinations of risks. Ask any emergency response professional, “How did this accident occur?” and their response will be “It was a combination of a few things.” Singular risks are easy to mitigate — it’s the combination of risks that lead to catastrophic events.
• The only way you can hope to identify risk patterns is with technology. For example, a company with just 10 risks has over 3.6 million possible risk patterns.
Q: How do you incorporate a company’s objectives as the basis for risk identification?
A: Many people involved in risk assessment not only do not understand the company’s objectives, but are actually unaware of them in some cases. Businesses exist in the real world, where there are ups and downs and unexpected events. In addition, any executive who has managed a business can tell you that good people sometimes make mistakes; the best laid plans can become obsolete before they are implemented and the “sure thing” often turns out to be anything but.
Identifying and understanding business objectives is a fundamental responsibility of those in risk management. Once objectives are understood, we then focus on the obstacles to achieving them. “Tell me where you want to go and I will tell you the risks that may prevent you from getting there.”
Q: You make a good observation that looking at risks in a vacuum is a leading cause of confusion. Does this mean that people over think their risks? Is it paralyzing to plan for every last contingency?
A: Corporate risk assessment tends to be dominated by those that have a “checklist” mentality toward risk assessment. This bias becomes glaringly apparent when we see a voluminous number — I mean thousands in some cases — of risks being identified, catalogued and then “rated” by looking at each risk separately and in a vacuum. This process is typically called developing the “risk universe.” The name itself is indicative of its chances of success.
Understanding a wide number of company risks may be useful in certain cases, but the disaggregation and isolation of risks when evaluating them really raises eyebrows.
Q: You say a manually performed, linear analysis of risk data is not only time-consuming but will lead you to the wrong conclusions. Why is that?
A: Linear thinking can be simply translated as a failure to see the “big picture” or to “connect the dots.” Linear thought is misleading because it prevents us from using the interrelationships in the data to reach the right conclusions. Our own brains do not see the world linearly, rather we interrelate risk data to form logical conclusions.
A humorous example would be to ask a woman the following series of questions:
Question: Would you be upset to see your husband writing down his phone number?
No
Would you be upset to see your husband smiling?
No
Would you be upset to see your husband talking to your college roommate?
No
Would you be upset to see your husband writing down his phone number, smiling and speaking to your college roommate?
Yes.
