This article is a rewrite of an article I originally wrote about six years ago on a now discontinued blog aptly titled “complexity risk management”. I am reviewing a paper on risk management and felt it relevant to update this post as an additional comment to one of my review points.
Whenever I speak about risk management, I insist on performing an initial static assessment of the situation in which you are implementing a risk approach, which I refer to as the static risk management phase, to be followed by recurring, significantly lighter phases which I call the dynamic risk management phases. People eventually ask the question on why I insist using both an initial static and the recurring dynamic phase. The simple answer is that there is no real fundamental difference between both phases.
But the actual, real in-depth answer is a bit more complicated than that. While there may not be significant differences in the steps to be executed in each of the phases, the context in which these steps are taken are significantly different. These contexts impact both the scope of the step and the duration and related investment in the step. Static steps are broad in scope, take a significant amount of time and therefore investment, whereas dynamic steps are narrower in scope and take significantly less time. This actually is the essence of the methodology. That is the theoretical explanation. Let me illustrate this with the example I’ve been using since 2002.
You and a box on the North Pole
Imagine yourself suddenly transported to the coastal regions of the North Pole area and left there with a large box and assurances that most of what you need to survive is present in that box. What do you do? Well, after screaming for a bit, you will eventually settle down and …
… you will scan your surroundings, making sure there are no immediate threats to your well being. So you go ahead and scan your environment in order to assess the situation and the event potential around you. Once you are fairly certain nothing can directly impact you, you will open the box.
On top of a lot of other tools you find a wonderful, white, warm jacket and a pair of polar pants. There is also a cute little red hat and a pair of sunglasses. You put on the pants, the jacket and the red hat (remember, it’s freezing cold on the North Pole) and you put on the sunglasses and do another 360° observation scan. Once assured nothing threatens you, you examine the other contents of the box: you notice it’s a very large box, with in it a big gun, labeled ‘point in the direction of polar bear and pull trigger to discharge, only when life is threatened’. Oh, and there is also a fold-up chair. The box contains some army meals which heat up when you pull a tab, and a large thermos of warm coffee. You take out the chair and decide to have a bite to eat … which you do.
In essence, you have assessed a new situation in which you have been put, as completely as possible with the available tools, and you have dealt with key concerns such as hunger, thirst, safety and comfort.
You are now quite comfortable in your chair, looking around and deciding the arctic region is, in effect, a very nice region to be in …
The static phase entails an as complete as possible inventory of key risks which could threaten the objectives. In case of an individual, this would be survival, in case of an organisation, survival will be defined quite differently but will be a key element too. After this time-intensive first priority inventory and assessment, corrective actions need to be taken. Quite often these actions need to be developed from scratch, and this too requires time and effort. The static phase is therefore time and resource intensive.
… when suddenly, you become aware of the relative heat of the sun on you new jacket. It is getting hot … but you quickly figure out there are a number of zipper controlled ‘vents’ in the jacket which you can use to control airflow through the vest.
Having dealt with this, you turn your attention to your surroundings once more, and you notice a small spec in the distance. You dig in the box for your binoculars, and focus on what appears to be … oh no, a polar bear with a very hungry and determined demeanor, at full speed, running straight at you. You intuitively check whether you consider your life to be in danger. The answer, alas, is yes, so you turn around, grab the gun, aim and fire at the polar bear … But you are not a very good shot. You have missed. You aim again, pull the trigger again, and are rewarded with a small “snap” sound of the trigger hitting the backend of the trigger guard. You are out of bullets.
Meanwhile, the polar bear is getting dangerously close. You reassess your options and quickly scan the small letters on the side of the box. You have not read these small letters, which state “Will protect one (1) person from polar bear attack.”
You jump in the box, slam the lid shut, but not before smelling the foul breath of the polar bear … but you are safe … and you fall asleep, happy to have survived this ordeal.
In essence, you have reassessed the known situation based on the changes in this situation, and focused only on dealing with the changes, not with the rest of your reality which remained unchanged and under control.
The dynamic phase entails an assessment of the changes in a known situation which is initially, after the static phase, considered under control. Any change with a potential of threatening the objectives needs to be dealt with, but after the initial and significant investment of the static phase, the subsequent investment in dealing with these changes is significantly lower. The economy of using a layered approach comes to bear (pun very much intended) only during the dynamic phase.