If not an outright failure of risk management, the recent financial crisis and related economic downturn have at least emphasized the need for a re-evaluation of the discipline. While the risk management community often suggests that we respond to such challenges by redoubling our efforts, it may not simply be a case of "more is better." Organizational risk managers need to realize that as long as their approach to risks remains fragmented, there can be no true progress toward solving the big issues and these large-scale risk crises are bound to reoccur.
The solution lies not in more intensive introspection, but in understanding the wider scope of the risks we face. Risk management must now recognize differences in the context of risk. Very simply, worrying about our own segmented domain--be it organizational, social, economic or political--may not be an effective strategy in a highly interdependent world. Progress leads to a mote complex society. We must learn how to deal with that complexity. And that cannot be achieved if we continue to practice risk management in a limited context.
Thinking too narrowly leads to the growth of large-scale risks. Consider a simple example from the day-to-day management of organizational risk. A candy manufacturer may identify the level of public concern about obesity and related health problems as a critical risk. These concerns may challenge company viability, in that, if widespread, they could significantly diminish sales. The wider public good is served by the notion that we should reduce our processed sugar intake, however, especially among youngsters. Is the proper risk management strategy then to preserve individual company interests or work toward social goals that can ultimately improve conditions for everyone?
Likewise, judged within a limited context, subprime mortgage loans may have been a perfectly sensible way to preserve a bank's financial position amid intensifying competitive pressures, especially given the fact that such loans themselves appeared to be guaranteed by quasi-public "insurers." It would seem that the effectiveness of risk management in this setting can only be proven wrong through hindsight. The risk management systems within these institutions did not register anything unusual because, from their vantage point, nothing was unusual.
The great challenge in breaking risk management out of this narrow view is that individual organizations must be willing to sacrifice some individual gains to contribute to the greater good (including, ultimately, that of its own stakeholders). Persistent contextual myopia in risk management endangers everyone. The benefit of a more coordinated risk management is in recognizing these interdependencies before it is too late. The first step is mustering the moral, economic and political strength to make a change.
Tragedy of the Commons
The problem of using a narrow context in managing large-scale risks can be summed up in a modern parable first presented by biologist Garret Hardin. Known as the "tragedy of the commons," Hardin describes a hypothetical community in which farmers let their cattle graze at will on a common pasture (the "commons"). This individual optimization of purpose leads to over-use of the pasture and the eventual collapse of the community's biological support system. The tragedy lies in the fact that individualized behavior led to destruction of the group. When individual actions can have social impacts, our risk management duty must include avoiding commons-type problems.
What might we do then to encourage an expansion of the risk management context to larger social issues? Recognizing the importance of interdependence in the financial arena (something we now call systematic risk) several world leaders have called for increased regulation in the form of coordinated oversight, including some form of a super-regulator or "risk czar. …