Grant, Author at Sufficient Certainty

Vale Roger Estall

My dear friend, mentor, collaborator and co-author Roger died suddenly and unexpectedly on Wednesday 21 June 2023.

Roger was visiting the city he was born, Christchurch in New Zealand, with his partner.

Roger’s passing leaves a big hole in the world. It is said that he saved more lives in New Zealand than anyone else through his dogged pursuit of smoke alarms and fire sprinkler systems.

I’d like to recognise the wisdom and friendship he gifted me over many years. He taught me never to compromise on logic and to challenge anything that, quite simply, did not make sense. A trait I know he helped many others develop.

We can only aspire to make the positive impact on mankind that Roger achieved.

Rest In Peace my dear friend, you will be missed for ever.

Making decisions unburdened by ‘risk management’ myths

This year Grant Purdy is speaking again at RAW2020, giving a workshop prepared by himself and Roger Estall.

The workshop will run on 12 October and details are here.

During long careers Grant and Roger have often been engaged to investigate decisions that have gone spectacularly wrong or resulted in other than the intended outcomes. This has helped them develop an objective appreciation of what ‘good’ decision-making looks like and therefore, what characterises a ‘good’ decision.

This workshop will describe the universal method of decision-making – which is what all decision makers actually use – and explain how the combination of understanding and awareness of that method, and mastery of its elements, is what differentiates between successful and unsuccessful decision-makers.

There will be, therefore, focus on clarity of Purpose because it is in the pursuit of purpose that all decisions are made, and we will explain – with reference to assumptions and subsequent changes in the context in which decisions are made – how the outcomes of decisions can differ from those intended or desired.

While a fundamental part of making decisions requires understanding and dealing with uncertainty, as Grant and Roger explained in RAW last year, attempting to take account of and resolve uncertainty via the concept of ‘risk’ the and constructs of ‘risk management’ is neither an effective nor a logical path to adopt.

Hence, they will explain again this year how, by drawing attention away from the universal method of decision-making, the distraction of ‘risk management’ often leads to poor decisions. On the other hand, they will show how awareness and skilful application of the universal method of decision-making enables Deciders to achieve sufficient certainty that their decision will contribute to purpose and deliver the intended (rather than unintended) outcomes.

Conversations with Mark Siwik

Mark Siwik, CEO of SandRun Risk is hosting a series of three conversations with Grant Purdy on the company’s Blog.

First instalment, September 2020

You can read the first instalment here.

Part 1 of the monthly conversation concerns Grant’s background and experience from working more than 40 years on practical applications of risk management and how he has focussed on helping people make even better decisions.

Second instalment, October 2020

The second instalment is here. This focuses on the book Deciding.

Third instalment, November 2020

The third instalment is here. The deals with how to make even better decisions.

The IIA’s Three Lines Model

The Institute of Internal Auditors has recently updated its Three Lines of Defense Model, which is now called the “Three Lines Model”.

Last year’s review and my comments

Last year, when the IIA initiated its review of the existing Three Lines of Defense Model I was asked by them to comment on the main weaknesses of the current model. I replied:

The main weaknesses in the Three Lines of Defence Model

The model is totally artificial. It does not represent how organisations and the people in them make decisions to help them achieve their organisation’s purpose. It wrongly promotes technical silos (the 2^nd line) who take on responsibilities that rightly should be management’s. While this may inflate the egos and incomes of those heading up the silos, the net effect is detrimental for the organisation.

My greatest criticism is that it is not about the monitoring that should be taking place to ensure organisations pursue success through the normal process of decision making in order to achieve their purpose. Rather, the focus has become the organisational structure and the labels attached to support departments who in truth should always be under the direction of management and to provide support to decision makers. This is particularly true of Internal Audit – which really does not need to exist as a separate, autonomous organisation: management may need some independent reviews of decisions it has made and of context and changes to that, but an internal regulator is not needed and is counter-productive.

The language of the model also supports the defunct concepts of risks and controls – ‘things’ that somehow ‘exist’ and have to be recorded and tabulated. While, in reality, controls are just ordinary aspects of an organisation that exist because someone decided (often at some time in the distant past) that they were needed to ensure that the outcomes of a particular decision were as desired. In other words, they were secondary elements of some past decision.

However, these labelled ‘things’ gain a life of their own, disassociated from the original decision, listed and checked – even if their true rationale has been lost. As a consequence, enormous resources are wasted and mis-directed monitoring these ‘things’ that often don’t really matter anymore, while others that do are ignored.

Similarly, with risk and risks: two terms that are used to strike up fear and concern when, in reality there is almost no agreement on what they are and what they mean, even among (so-called) risk management experts. The terms are so ambiguous and have become so discredited that its simply better to move on and leave them behind. Labelling a particular advisory department, the Risk (or Risk Management) Department only allows decision makers to abrogate their responsibility to ensure that with decisions they make there is sufficient certainty the desired outcomes will be achieved.

Calling such advisors (if they are that) a line of defense both removes management accountability and also allows large amounts of resources to be mis-directed to the confections and processes those advisors and their silos think are important (to them). If you doubt this is true, ask anyone in the rest of an organisation how they think the ‘risk department’ creates value; even if they can answer this, few if any people will express belief in their own response if pressed.

What the model lacks is a fundamental recognition that it should just be about the strategies for monitoring (and not who does it). Specifically, how those who make decisions check that:

implementation of the primary element of a decision does not proceed as assumed or intended; or
the secondary elements of a decision are either not properly implemented, malfunction or deteriorate over time;
over the life of a decision (i.e. the duration in which its outcomes will continue to be experienced) changes in context occur that were not allowed for in the decision with the result that the actual outcomes change, and/or the decision no longer provides the best response to the opportunity that it was intended to exploit.

The primary elements of a decision are those features intended to exploit an opportunity in order to realise an organisation’s purpose. Secondary elements are those that make it more likely that the primary purpose will be realised. Secondary elements include ensuring those implementing the decision correctly understand what is required of them and what the decision is intended to achieve; ongoing monitoring to detect change and contingent arrangements intended to be activated in foreseeable circumstances that otherwise could be disruptive or thwart achievement of the primary purpose.

What issues should have been addressed

When asked what “issues had to be addresses in the refresh”, I replied:

Drop all artificial language and concepts like controls and risks. Focus solely on the processes for monitoring and how these should be deployed in response to the needs of decision makers to ensure that decisions are sufficiently certain of achieving the desired outcomes – and that past decisions remain valid and continue to support the organisation achieving its purpose.

The new model

However, sadly, on reviewing the new model it is clear that the IIA has missed another opportunity to write something clear and simple. Instead, we have another word soup of jargon and confused ideas.

As soon as I read the introduction, I realised that instead of clear ideas, carefully expressed this document relies more on sophistry than common sense and practicality. How, for example can you say that organisations can bale the achievement of objectives “while” supporting strong Governance and “risk management”. Surely, we have a Venn diagram here of three concentric circles. Surely “strong governance” must include good risk management” and governance can only be about the way the organisation makes decisions that allows it to achieve its purpose (“objectives”?).

Of course, ambiguity is ensured (and hence consultancy income) by the document not defining what it means by ‘governance’ and ‘risk management’, let alone ‘risk’. Also, the ‘r’ word is used variously as a noun a verb and an adjective.

We also have ‘managing risk’, ‘risk management’ (which seems to be an “action”) and also ‘risk-based decision making’ – which is a variant on the made-up term of ‘risk based thinking’ in ISO 9001.

The more I read this, the more confused I become. For example, I’m told that the “objectives” of ‘risk management’ are “compliance with laws, regulations, and acceptable ethical behaviour; internal control; information and technology security; sustainability; and quality assurance”. Is that it? No mention of making decent decisions here. And how can “objectives” be processes such as ‘quality assurance’ or vector qualities such as ‘sustainability’ – and what do all these terms mean, anyway?

When I get to the short section called “Applying the Model”, I realise the authors have both run out of intellectual steam and are beginning to cotton on that none of what they have written before makes much real sense in the real world. Despite the firmness of the previous advice, it seems you can choose how to adapt it how you like according to your “objectives” and “circumstances”.

So rather than being some fundamental truth of life, all this document really it is a web of interconnected and ambiguous words and half formed thoughts.

Consultants and internal auditors will love this – as it justifies their existence.

COSO ERM in a COVID 19 World

Many wonder whether the current pandemic is another example of ERM failing. The same question was asked more than a decade ago during the financial crisis. While there will undoubtedly be risk management lessons learned from this crisis, it’s a reminder that ERM is more art than science. As long as people are involved, some risks will be missed and failed judgments will occur. But ERM and internal control frameworks can still provide valuable principles and insights as organizations start to emerge from this crisis. Over the next several days I’ll be posting thoughts on how COSO frameworks can help during the coming months.
Paul Sobel Chairman of COSO in LinkedIn

Why COSO ERM Will Not and Cannot Help People Make Better Decisions About COVID-19

Paul, ERM is not even an ‘art’. Its just a belief system with no settled, academically-supported or proven global body of knowledge.

Although aspects of ‘ERM’ activity might well draw on scientific and other validated areas of true knowledge – such as the mathematical calculation of probabilities – this does not validate the belief system envelope in which these skills are applied. ERM was a label invented by RIMS to distinguish a new business offering from its original insurance-based services. It’s just a three letter acronym invented for marketing purposes!

COSO just jumped on the concept when it wanted to make its ‘Internal Control Framework’ more relevant and its members wanted to counter the drop in revenue after the failure of Enron and subsequent restrictions on provided conflicting services.

All belief systems with three letter acronyms that attempt to resolve uncertainty in decision making via the constructs of ‘risk’ and ‘managing risk’ will not only fail but ultimately, can never succeed. This is also borne out by multiple surveys that show that ERM ‘maturity’ (whatever that means) is persistently low.

There are two obvious reasons for the failure of ERM and other forms ‘risk management’ to produce good decisions:

the foundation word ‘risk’ has literally dozens of meanings and so has no utility or transactional value;
it is fanciful to imagine that any approach based on a one-size-fits-all complicated systems of ‘risk management’ can or will be ‘integrated’ into the highly individual ways through which organisations function.

Indeed, across my 40+ year career I’ve realised that I’ve yet to find an organisation asserting to practice ‘risk management’ that did not, in reality, have separate processes for ‘risk management’ and for actual decision-making. Whatever ERM is thought or claimed to be, it neither does, nor can ensure effective decision-making. So why waste so much time and money on it?

You’ve got to wonder, if COSO ERM was so good and useful, why every survey, every year seems to show such a low level of ‘maturity’ (whatever that word means) and why the constant response is that management and Boards don’t ‘get it’.

On the other hand, there is clear evidence that these people do ‘get it’, and realise it’s a con job that destroys rather than creates value – except for the consultants who are called in to help ‘implement’ it. Organisation’s only spend the minimum on the ERM artefacts, just to keep regulators happy and so that they can boast about it in annual reports.

The bottom line is that there is no evidence that ERM improves organisational performance. Although there are some faint correlations between organisations that are successful and those that adopt the risk management paraphernalia, correlation is not causation.

Any apparent correlations could be explained by already-successful organisations being able to afford to construct a ‘risk management’ edifice or being subjected to regulatory coercion.

None of the organisations I deal reached for their risk register when they had to decide how to respond to the disruption caused by COVID-19. Also, none of them consulted their risk appetite statement or ‘risk matrix either. Interestingly, none of them seemed to use their business continuity plans!

This is not surprising actually because what they all wanted to do is reduce their vulnerability to such disruptions and not, necessarily, return to their post-disruption state.

Many also saw and decided how to exploit the opportunities resulting from the disruption and, in some cases, the decided to exploit the vulnerability of others to gain an advantage. While clearly COVID-19 is having a devastating effect on organisations (and people) across the world, in the words of Winston Churchill: “never let a good crisis go to waste”!

The ‘Mess’ Risk Management Has Become

Norman Marks in his blog post called "Time to wake up to risk reality" said that "This is a post about news we should have known for a long time.
It’s time to recognize the truth about risk management." I responded as below.

How did we get in this mess?

42 years ago when I first started looking at what could go wrong, what it would lead to and how likely the effects were, it was quite clear that my role was exclusively to help those charged with making decisions. I did not seek to impose my arcane language and concepts on the decision makers. Indeed, a big part of my job was understanding their needs and the context and then after I had carried out my analysis, framing the information I gave them using terms and concepts that were meaningful to them. I did not insist they contort their language and ways of thinking to suit mine. I did not insist they either replace their business processes with mine or to run my processes in parallel.

I only worked for the decision makers, and if they could not understand and appreciate what I was telling them, that was my fault, not theirs.

Since then, and despite the Frankenstein monster ‘risk management’ having no solid foundation or universal meaning, the advocates of its many guises (normally with three letter acronyms) have created a perception in those responsible for the governance of organisations that ‘risk management’ was ‘good’ and should therefore be adopted.

This ‘Risk management’ belief system has been promoted as something that is both valid and indispensable: in effect something to be believed in as essential to good governance. But it is only a belief, there is little tangible evidence that ‘risk management’, whatever that term means, actually helps organisations make better decisions and thereby enhances their performance.

Organisations have been encouraged by ‘risk management’ advocates to give effect to this belief by superimposing a ‘risk management framework’ across the organisation comprising various edifices. Common examples included ‘risk committees’ of the Board, ‘Chief Risk Officer’ positions and various ‘risk management’ structures, policies, reporting requirements and so on. The purpose for establishing this paraphernalia, has been seldom transparent, explicit or understood. Consequently, to the extent that it actually existed, this ‘framework’ is seldom integrated with day to day decision-making – because, in fact, it can’t be. If it exists at all, this is only in a parallel universe to the real world where businesses are run and decisions are made.

This belief system has been bolstered by the many national stock exchanges that now included practice of ‘risk management’ as a necessary condition for a stock being listed on their exchange. The (entirely untested) belief is that practising ‘risk management’ (in whichever guise) is prima facie evidence of, and a prerequisite for, sound management. The myth they have perpetuated that investors could and should have greater confidence in such companies.

However, this has been proved repeatedly to be a fallacy, best illustrated by the extraordinary failure of the Enron Corporation and by many recent and spectacular examples of corporate failure such as that involving Boeing’s new 737MAX aircraft that took 346 lives in 2019.

It seems clear to me that if, after all the time and effort that has been invested in ‘risk management’ over the last 30 years, it still isn’t helping decision makers to consistently and competently make better decisions, we simply need to dump it.

We should simply go back to where I was, 40 years ago – understanding how people make decisions and how we can help them understand their assumptions, the context and how they can become sufficiently certain of their desired outcomes.

The ‘risk management’ emperor has no clothes!

Go Hard and Go Early

This was posted recently on LinkedIn and attracted many comments, most supportive.

Some of you will know that I’m critical of the monstrous belief system that risk management has become; with its own language, codes, symbols, rituals and high priests. Few would now dare to say they don’t believe in ‘risk management’ – even those most (if not all) don’t know what that phrase means. It’s certainty transmogrified (like Frankenstein’s monster) from a simple activity involved with the testing of assumptions as an input to decision making to the vast, self-serving edifices we see today.

I’ve previously said that you won’t find many leaders in the world who are making difficult decisions during the current global crisis reaching for their risk registers or risk appetite statements. One thing we know about good leaders is that they are great at decision making: they are decisive and don’t procrastinate. They gather the views of others about context, look at a range of options and make sure they are clear on the assumptions and the level of certainty each option will lead to their desired outcomes. Then they decide and act swiftly.

All this is true of great surgeons, corporate raiders and generals. They all act hard and act early. (And most would not know a risk register if they tripped over it!)

An excellent analysis has been produced by the (Australian) ABC and shows clearly the difference in the rate of Coronavirus infections and the spread of the disease in countries whose leaders acted hard and early, and those that were or are still dithering. You can access it here.

I’ll let you form your own opinion of your country’s leaders and their decision-making based on this transparent analysis. One thing is clear though, if leaders’ procrastinate – because, variously it will damage their election chances, their population has a good diet, or their people don’t get sick – then it will cost many lives.

Coronavirus and the effect on ‘risk management’

Norman Marks, in his blog post called "How will risk management change as we emerge from this crisis?" pointed of that "Even before the crisis, few on boards or in executive management believed their risk management programs were helping them run the organization for success. At best, it helped anticipate and avoid failure – which is hardly the same as achieving success. At worst, it was a cost center that helped comply with regulations."  Here is my response.

Norman,

Crises like that from the Coronavirus that we all face now, just expose the total folly of the ‘risk management’ edifices organisation’s have built. Leaders are making decisions that in some cases, and often quickly in retrospect, either prove inspired or, mostly, highly defective. But the overall impression is that, despite the claims of the risk management fraternity (or whatever three letter acronym you like to label yourself particular brand of belief system with), its all very ‘hit or miss’!

Form what I can see, no one is reaching for their ‘risk register’ or ‘risk appetite statement’ or ‘risk matrix’ (etc. etc.) to help them make a decision. Some decision-makers are clearly listening to others, thinking out assumptions and choosing between options so that they end up with a decision which they are sufficiently certain will lead to the outcomes they desire. However many, including some of the most important ‘leaders’ in the world, are making decisions based simply on gut feel, ignoring the advice of others or the experiences elsewhere. They seem to lurch from crisis to crisis, with precious little monitoring taking place to see if decisions lead to the outcomes desired or whether the original basis for a particular decision still remains valid.

Some misguided politicians are still bandying around nonsense words like ‘risk’ and ‘risk management’ as though just uttering those phrases as part of their ‘spin’ will solve problems and pacify people. Fat chance!

In my real world, practical experience over the last few weeks I’ve seen clear evidence that the distraction of ‘risk management’ has in some case led to poor decisions or, mostly, just impeded the process of making a decision with sufficient certainty of outcomes. Similarly, most organisation’s Business Continuity Plans (another three letter acronym) have proved useless because they focused on specific events and not generally the organisation’s vulnerability and how that can be reduced, and how decision making can be enhanced when a disruption occurs. Mostly, they’ve been cast aside by decision makers as totally irrelevant!

At this time, mankind needs leaders (not politicians worried about getting elected) who are capable of making the best possible decisions – for the sake of us all. Even if people say this is ‘risk management’ they are simply deluding themselves.

If anything, this awful crisis just proves we have wasted years and $billions building ‘risk management’ edifices that have ended up like the Maginot Line in WW2: they have created a false sense of security, and exposed us all to the perils of inflexible strategies, poorly defined assumptions, insularity and blindness to wider context and ineffective monitoring.

Now we are facing our biggest challenge in a generation, our various ‘risk management ‘frameworks’, ‘systems’ and ‘programs’ and all the paraphernalia that comes with them, manifestly are not only failing to respond but are actually impeding good decision making.

When we get through this, we must remember all this and never fall for a similar ‘con job’ again.