Comment mesurez-vous le succès de la réduction des risques?

From early in the process of development of a risk strategy, there should be factual direct products of risk management, preparations, historical outcomes and statistical possible outcomes obtained through the use of pertinent data. Without a benchmark of multiple accurately and quantifiable (that is why the reference to historical data previously) outcomes, there is no possibility to obtain or even prepare appropriately the success of risk reduction. Clearly we need to know the past what, when, and how to be able to start trying to aim at those same questions for the present and the future. This means establishing multiple environments (the well used and abused "scenarios") but much more complex to reflect data driven real conditions.

It is important to be honest about the potential worst case scenarios and what that would look like. Too often people dismiss considering the worst case because it likely will not happen. In those rare instances that it does, a solid risk management plan will have already considered the consequences and have appropriate contingency response plans.

To gauge the effectiveness of risk reduction efforts, a straightforward approach is to compare actual project outcomes with the baseline estimates made before implementing risk response strategies. For instance, comparing actual project costs, schedule, scope, and quality with the planned values allows for calculating variances and deviations. Let's say a software development project estimated a timeline of six months for completion. However, due to the implementation of effective risk response strategies, the project was completed in five months. This positive variance showcases the success of the risk reduction efforts in achieving the project's time-related goals.

One thing that needs consideration is the range of consequences that can occur when a given risk actually happens. For example on the Deepwater Horizon catastrophe the risk of a “kick” was identified in the BP risk assessment. Yet the maximum consequence never considered. And that is just one example in just one industry. So it’s not just about risk, it’s also about safeguards in place to manage the worst consequence.

In my experience Baseline Comparisons are the most useful when there is a standard risk, and a standard risk reduction process. An example is preventive maintenance in similarly used machines. It’s possible to measure the impact of the maintenance as long all the machines are used in the same way and undergo the same maintenance process. In cases where the risk reduction is being applied to systems which vary a lot, or if the risk reduction process varies a lot, this method won’t work well. So, if the machines were doing different tasks or handling different loads, or if the preventive maintenance performed on them varied a lot from machine to machine, there would be no way to isolate the effect of these changes in the outcomes.

Calculating risk exposure reduction may not always be straightforward due to challenges in accurately quantifying the probability and impact of risks. Some risks may be difficult to predict or interconnected, making it challenging to measure their precise effects on the project. Additionally, risk exposure reduction may not account for the emergence of new risks during the project's execution.

Risk exposure reduction is in my view and almost philosophical byproduct of a concrete set of numbers. Without the perception that confidence has been achieved or incremented, there is no possible risk reduction. At the end of the day, is the perception within multiple participants in the market, in a specific organization, or a regional/global economical level, that confidence overturning the specific odds and percentages of risk reduction are working. What I am trying to expose is that 90% factual data reduction could be fatal if the perception of confidence as opposed to risk, has not been achieved. Viceversa, a modest 5% reduction in a given parameter could mean absolute victory in the major magnitude of perception and thus success.

Risk exposure reduction is a more informative measure than baseline comparisons because it allows us to compare risk reduction strategies that may reduce one of those components while increasing another. For example, a bank reducing a credit card limit when a cardholder loses employment increases the chances of default but lowers the chances of a big loss. On the other hand, temporarily increasing the limit may reduce the chance of default as the cardholder could find employment again, but increases the chances of a big loss. By measuring the exposure it allows us to compare those two strategies.

Calculating risk exposure reduction may not always be straightforward due to challenges in accurately quantifying the probability and impact of risks. Some risks may be difficult to predict or interconnected, making it challenging to measure their precise effects on the project. Additionally, risk exposure reduction may not account for the emergence of new risks during the project's execution.

Let's consider a construction company that conducts a risk maturity assessment for its infrastructure projects. Before implementing risk response strategies, the assessment reveals that the company has a moderate risk culture, well-defined risk processes, but limited use of advanced risk tools and skills. After incorporating new risk response strategies and enhancing risk management practices, the post-assessment shows significant improvements in all aspects, including a more proactive risk culture, streamlined governance, and the adoption of cutting-edge risk management tools. This demonstrates the positive impact of risk reduction efforts on the company's overall risk management capabilities and performance.

Additionally to the previous; the framework of reference needs to use indicators based on future events. Yes, using past data, but the main point is advancing, corralling so to speak the events to occur in the future. We cannot wait for those events to be present or the larger point of risk disappears fully and is useless at that point. Risk maturity, yes, can asses the immediate moment based in certain parameters, that as we showed previously could be perceived and quantified. But the authentic value of maturity assessment will come when we somehow narrow, compare and especially advance in time the risk factors with which the organization will be faced in the near, medium and long term. Accuracy here will determined a good assessment.

Risk maturity assessments are best used when the risk being measured are complex and (at least partly) qualitative. They rely on senior management or subject matter experts to list out the various aspects of the risk being measured and also to rate the effectiveness of the risk reduction being applied. The fact that these assessments are subjective doesn’t make them less accurate. If anything, if the framework and measurement are well administered, these assessments can provide a comprehensive picture of the risks and challenges and, therefore, serve as the first step in crafting an effective risk reduction strategy. The main drawback of this method is the large effort involved and the requirement for a well trained assessor.

Here we go back to the points previously commented about a correct frame of reference based on the past, that should have assimilated and taken into consideration all of the stakeholders, and have established the correct when, what and who with the view in the future. An immediate rate (feeling) of satisfaction by all or some of the stakeholders could in fact be a misleading ratio of confidence and in fact put in peril the entire risk management function by giving those managing a wrong sense of confidence that could, and have been, demonstrated to be inaccurate. The stockholder is not always right. In fact the stockholder could be appreciating a warped view of reality. This is why, the risk needs to be uncompromising and visionary.

A classic example of this is financial portfolio hedging strategies where one can buy options or other derivatives to reduce the risk of the portfolio. As both the risk (usually a measure of the expected loss of the portfolio) and the return (the cost of the option or derivative) is clearly known, it is easy to calculate and compare the risk return ratios for various risk reduction strategies.

In addition to the numerical, quantitative results risk return ratio should add other quantifiable as well but "non-numerical" (at least initially) effects of each project. It would be, in my opinion, shortsighted to just reflect dollars and cents, without incorporating the multitude of collateral effects of risk management, or perhaps we should defined it better as ratio of confidence, or confidence return ratio, that should include multiple non-directly correlated immediate economic effects, but that most certainly will ocurre to secondary, tertiary, etc., stockholders or just spread into society in general, as we have experience one more time in the not so distant past. Confidence management needs to add these variables.

Key Risk Indicators (KRIs) Are very similar to Key Performance Indicators. KRIs are more applicable to organisational risk management than the above approaches as they don’t rely on a clear start and finish point. KRIs are helpful to public sector and third sector organisations when the primary measurement is not money/profit. A KRI is usually quantifiable and so you are able to say what ‘direction’ you expect the numbers to go in as a result of your mitigating activity. You can then check and test these as you progress. KRIs are also essential as Early Warning Indicators if a risk is getting worse. You can set a numerical threshold and if the numbers go above/below this threshold they trigger additional mitigating activity.

In my experience, risk management needs numerical parameters as well as new ideas and perceptions that will conform the reality in the future, otherwise it will be useless, or will expire by the time the report is published. Either confidence assessment/risk management, attempts to scientifically and philosophically detect the future and trends of the economic times or it will fail. In turn, if there is vision and high levels of due diligence work involved to attract and approximate that future, it will succeed.