Let’s talk about Deciding
The focus today among leading ‘risk’ thought leaders, including at COSO, is on decision-making. For example, COSO ERM says: “From day-today operational decisions to the fundamental trade-offs in the boardroom, dealing with risk in these choices is a part of decision-making”.
Think about it. How can we or our organizations be successful without sound decision-making?
How can we, as practitioners, help leaders make informed and intelligent decisions that consider all the things that might happen?
Some years ago, Grant Purdy (the grandfather of Australia/New Zealand’s risk management standard 4360, the precursor to the global standard, ISO 31000) told me that when he is engaged to help an organization upgrade its ERM program, he doesn’t talk to management about risk. Instead, he asks:
“How do you make decisions?”
Grant has teamed up with a fellow Aussie, Roger Estall, to bring us Deciding: A Guide to Even Better Decision-Making.
The book is an interesting read, with some useful perspectives and advice. It will help you challenge your and others’ decision-making processes.
Over the years, both Grant and I have been on a journey of discovery. We have both moved away from what I would call traditional risk management, recognizing that it really is not helping leaders make those all-important strategic and tactical decisions. It’s a compliance activity.
We haven’t always been in sync on our journeys, reaching points at different times. In addition, we have different background and experiences, so we sometimes use different language.
But we have always agreed far more than we disagreed. Neither of us like the word ‘risk’ any more, but it has taken us time to get there.
For example, I talk about managing the likelihood of success instead of focusing on the potential for harm (which is unfortunately what most ‘risk’ practitioners do). Grant and Roger talk about achieving a sufficient level of certainty of the outcome of the decision.
Those are essentially the same idea. The way I think about it is that leaders (both executives and board members) are looking for an acceptable level of certainty/likelihood that they will achieve the objectives/goals of the organization.
If we can help them understand where they are against their objectives and how what lies ahead might affect their success, we are adding huge value. What lies ahead is what some call ‘risk’ or ‘risk and opportunity’.
Grant and Roger help us understand a number of things, including what they call a global process, about making informed and intelligent decisions.
One area I like is the discussion about assumptions.
Far too often, people make assumptions without thinking of how uncertain they are. I have seen many proposals and plans that list assumptions without any thought to assessing the likelihood that they will in fact happen.
Grant and Roger talk about how it is important to understand how critical each assumption is so that the most significant can be monitored. This way, as soon as it looks likely that an assumption will not hold, actions can be taken – including revising the decision.
As I said, it’s an interesting book and it should make you think about how you and those in leadership positions make or should make informed and intelligent decisions.
Are you concerned about the quality of decision-making?
What are you doing about it?
Leave a Reply
Norman Marks on Governance, Risk Management, and Audit 
Thanks Norman.
It’s true we have been travelling the same road for a while now.
Roger and I saw the need for this book because understanding and dealing with uncertainty is fundamental to making sound decisions and yet, doing so presents practical challenges. Although you describe COSO as thought leaders, I’m not sure that is necessarily illustrated by the quote you gave!
After long careers we have come to realise that attempting to resolve uncertainty via the constructs of ‘risk’ and ‘managing risk’ had not only failed but ultimately, could never succeed. (You will have seen that we explain why in the book.) This is also borne out by multiple surveys that show that risk management ‘maturity’ (whatever that means) is persistently low – as you mentioned in a recent blog post.
There are two obvious reasons for the failure of ‘risk management’ to produce good decisions:
1. the foundation word ‘risk’ has literally dozens of meanings and so has no utility or transactional value;
2. it is fanciful to imagine that any approach based on a one-size-fits-all complicated system of ‘risk management’ can or will be ‘integrated’ into the highly individual ways through which organisations function.
Indeed, across our 40+ year careers we realised that we had yet to find an organisation asserting to practice ‘risk management’ that did not, in reality, have separate processes for ‘risk management’ and for actual decision-making. We realised that whatever ‘risk management’ is thought or claimed to be, it neither does, nor can ensure effective decision-making.
So, our underlying approach in writing Deciding, was to respect the way that organisations (and individuals) operate (which they do by making and implementing decisions according to their own practices) rather than suggest they do something entirely different. The most obvious reason for this is that most organisations (and individuals) make many good decisions every day. Were that not so, there would be widespread failure. So, our focus in Deciding is on leveraging their existing practices to make even better decisions.
We realised that in broad terms, everyone makes decisions in the same way – that there is in fact, a ‘universal method of decision-making’ (N.B. rather than ‘global’ as you suggest). The only differences between Deciders is the extent to which they are aware of the method as they apply it, and their skill and experience in its application.
Anyone interested can read more of these thoughts at https://sufficientcertainty.com which also provides links to Amazon’s various sites where the book can be found (in paperback or Kindle versions).
Mark, as so often before – I could not agree more if I tried. Address and model the uncertainty of your assumptions as well as the impact range and likelihood of un-planned issues and events that may affect your performance. Monte Carlo simulate at find the likelihood of meeting targets as well as key issues to address if you wish to enhance this likelihoid.
Norman
Thank you for your recommendation about the book Deciding. It was a great read.
The authors deserve accolades for rejecting jargon and writing in plain English with words having their normal meanings. As they say, “let’s face it, the human race functions very successfully communicating in its normal languages”. How right. I’ve never heard two people use the word ‘risk’ in the same way which, as the authors say, makes it a wholly useless word.
As both a former special forces officer and a kidnap response consultant, I also agree entirely with what the authors say about making decisions under pressure. Even though such decisions must sometimes be made almost instantly, only if the ‘Decider’ is skilfully applying the ‘universal’ method as described in Deciding will he or she have sufficient certainty about what at times, can be life and death outcomes. However, I have also found that the same applies to decision-making in the comparative tranquillity of the business world.
The chapter and supporting Appendix about detecting any changes between what was intended and what results, as well as future changes in context (i.e. ‘monitoring’) are also very apt. Decisions are not ‘fire and forget’. The example in the book about the conventional taxi industry that found itself flat-footed when Uber arrived is a great example. Indeed, the Appendix relating to creating and avoiding disruption is a ‘must read’ for businesses in these COVID times.