You
can't make people care about what they don't. Sure, you can get people
worked up about Darfur or Global Warming with some good photos or a
stirring editorial, but soon enough it becomes abstract to them again.
If you want to get people to care about something you have to frame it
in personal terms, show them how it affects them personally. So when I
talk to business people about Global Warming, I frame it in terms of
business risk, business sustainability, and business resilience. These
are things they care about.
Some definitions:
- Business Risk:
The possibility of the business suffering loss, harm or danger. It is
the product of the probability (likelihood) of adverse events
occurring, times the consequence (severity) of these events should they
occur.
- Business Sustainability: The capacity of the business to remain in existence.
- Environmental Sustainability:
The capacity to be continued indefinitely with minimal long term effect
on the environment. Often shortened to just 'sustainability'. Business
executives don't really care about this, but they do care about their business' sustainability. You have to show them that the two are connected, and how they are connected.
- Social (and Environmental) Responsibility:
A duty of care to safeguard the well-being of people (employees,
customers, community) and the environment. Business executives don't
really care about this either, unless their indifference exposes them to business risk.
- Business Resilience: The capacity of the business to adapt to or recover quickly from adverse events.
There is a well-established framework that positions risks in terms of
likelihood (the probability of them occurring) and severity (the
consequences if they occur). It's an imperfect model for several
reasons:
- both the probability and consequences of most risks
increase over time, so a chart that depicts short term and one that
depicts long term risks will look very different
- the consequences often depend on who you are
- the consequences can be depicted different ways (dollar
cost, loss of life, loss of quality of life) and these depictions can
vary widely
- both likelihood and consequences are very subjective --
they're a matter of prediction, and humans are notoriously bad at
predicting, and tend to underestimate the likelihood and consequences
of adverse events
Despite these imperfections, charts that depict risks in these terms
do tend to attract the attention of business. Most recently the Davos group
produced this chart of its '26 greatest global economic risks' (NPT=
nuclear non-proliferation treaty; CII= critical information
infrastructure):
From Davos World Economic Forum Global Risks 2008 Report
As interesting as this chart is, the problem is that its developers
don't know much about what the risks really are. The likelihood of a
pandemic, for example, as anyone knowledgeable about the topic will
tell you, is more than 6% in the next decade. Likewise, to suggest the
risk of significant global freshwater loss in the next decade is only
6% indicates a serious ignorance of ecology.
There are of course other ways to parse risks and the adverse events or crises that produce them:
- by how suddenly they occur or their likelihood of recurrence
- by the nature of the crisis (social/economic, natural, technological)
- by whether it's caused by internal (to the business) or external occurrences
The
potential suddenness of a crisis affects preparedness and mitigation
strategy. Risks that are due to internal causes (failure to adhere to
regulations or social norms; internal sabotage) are generally more
controllable than those due to external causes, and hence require
different strategies that focus on prevention and not just adaptation.
But generally, the variables that are most important to business are
the two in the chart above -- likelihood and severity, in the short term (two years or less). Multiply the two together and the higher the result, the more attention business will pay to it.
Risk strategies generally focus on five things:
- prevention (for those risks that are controllable), provided the cost is not uneconomic
- early detection (gathering, sensing and listening to credible information and early-warning signals)
- mitigation -- taking early steps to reduce severity
- response -- adaptation and recovery once the event has occurred
- learning -- revising the strategy after the event in order to be better prepared for recurrence
While
planning can help (especially when a key component of the plan is
training and rehearsal), perhaps a more important aspect of risk
preparedness strategy is improvisational capacity. Aid workers during
the Katrina disaster, for example, relied on networks of skilled
collaborators connected continuously by satellite phones, who would
'huddle' impromptu as unanticipated issues arose and assess the wisest
course of action.
The key elements of crisis mitigation and response are information-gathering, coordination and decision-making,
and in a crisis none of these tends to go 'according to plan'.
Businesses that are agile and improvisational are often better able to
cope with crises than those with extensive, complex, rigid plans. Plans
are based on assumptions, and when the assumptions prove false (e.g.
the assumption by FEMA that, in the advent of a hurricane, backup
systems would ensure electronic communications were functional)
organizations that can't improvise add to the crisis instead of
alleviating it.
With these assessments so subjective, there is a danger that such
charts simply lose all credibility, and business people cease giving
them any attention. What could be done to increase the credibility of
these assessments?
If you've read The Wisdom of Crowds,
or frequented any Prediction Markets, you probably know my answer:
Instead of asking so-called experts, get the 'crowd' to make the call.
Average out their predictions, and you're likely to have a much more
accurate assessment of both the likelihood and severity of different
types of risk than the 'experts' at Davos could hope to muster.
To help them do that, you need first to decompose the risks. The
simplistic scatter chart of the Davos gang overlooks the fact that
many, perhaps most, of these risks are interrelated: The occurrence of
one increases (or occasionally decreases) the likelihood of many of the
others. When it comes to assessing the business risk from global warming, for example, businesses need
to assess two short-term risks and at least five longer-term risks:
- regulation risk (risk of new carbon taxes and caps, and restrictions to supply and operations)
- reputation risk (risk of boycott for notorious emitters of global warming pollutants)
- risk
of water shortages (related to glacial melt, evaporation and droughts)
-- every business needs water and some use staggering amounts of it
- risk of energy shortages (as oil supplies are depleted and become vastly more expensive and restricted)
- risk
of pandemics (as infections spread beyond their normal tropical habitat
to areas with no natural resistance, affecting humans and they animals
they eat)
- risk of pestilence (as insects likewise spread beyond tropical
areas and attack trees and agricultural plants with no natural
resistance, wiping out crops and making food, paper and wood unaffordable)
- risk of sea-level and sea-temperature rises (engulfing low-lying cities and growing areas, and affecting aquatic life)
The global warming business risk can also be broken into:
- risks
that arise because of actions the company takes, or neglects to take,
that contribute to global warming or reduce impact on global warming
(e.g. cost of reducing pollutants, and taxes paid on emissions)
- risks that arise because of the consequences of global warming on the company's operations (e.g. water shortages)
So
a chart of the major real risks to a business, at least in the longer
term (20-50 years rather than ten) might look like this:
The risks that are not considered to be significant short-term (less
than two years) risks are in the upper right corner, and as long as
business is only concerned with the short term, these risks are
perceived to be lower-left corner risks, not worth being concerned
about. Besides, most businesses perceive these as largely unpreventable and unmitigatable anyway,
so their approach is to worry about them if and when they occur.
Here's a brief summary of these 15 types of risk:
| Type of Risk | Probability % | Consequence $ | | 1.Major Fraud or Litigation Risk: A large-scale theft, governance or human error or litigation sufficient to threaten business continuity. (I/E) | Low | High | | 2. Major Transaction Failure Risk: Collapsed merger or acquisition or reorganization. (I) | Low | High | | 3. Major Security Failure Risk:
A war, control breakdown, system failure or industrial sabotage
severely disrupting business operations, solvency or continuity. (I/E) | Low | High | | 4. Reputation Risk: A
scandal, massive boycott, product tampering, industrial accident or
other event that destroys customer confidence e.g. major product
quality, service or delivery problems. (I/E) | Medium | High | | 5. Regulatory Risk: Major new legislation that is prohibitively expensive to comply with. (E) | Medium | High | | 6. Major Supply Chain or Marketing Failure Risk: Loss of a major source of critical supply, embargo, or disastrous new product/market launch. (I/E) | Medium | Medium | | 7. Customer Credit Risk: An economic crisis severely hampering customers' liquidity, solvency or ability to buy, or pay for what they've bought. (E) | Medium | Medium | | 8. Natural Disaster or Terror Attack Risk: A localized major destruction of infrastructure and human habitat. (E) | Medium | Varies | | 9. Competitive, Market or Demographic Shift Risk: Innovation, new competitive threat or major shift in customer or employee market e.g. skill/talent shortage. (E) | Medium | Varies | | 10. Labour Disruption Risk: Strike, embargo, loss of access to employee market, or sudden change in cost or availability of workers. (I/E) | Medium | Low, these days | | 11. Minor Litigation or Regulatory Compliance Failure Risk: Small lawsuit or infraction of the law. (I) | Medium | Low | | 12. Global Currency, Debt or Trade Crisis Risk:
An economic recession or capital market crisis brought on by currency
collapse, or unsustainable national debts or trade imbalances. (E) | Low/High* | Low/High* | | 13. Energy Supply Risk: Major shortage of energy supply or spike in energy price. (E) | Low/High* | Low/High* | | 14. Global Warming Risks: Chronic
water scarcity, flooding of ports by rising sea levels, pandemic
disease outbreaks in people and animals, insect plagues destroying
crops and forests, droughts, uncontrolled forest fires and other
consequences of global warming. (E) | Low/High* | Low /High* | | 15. Interest Rate and Inflation Risk: Jump in interest and/or inflation rates sufficient to create a type 7 or 12 crisis. (E) | Low/High* | Low/High* |
*
Low in the current perception of business; high according to economists
and scientists. (I) = Internal cause risks. (E) = External cause risks.
The
above perceptions of risk probability and consequence will vary from
business to business and are, of course, subjective. How might we use
the Wisdom of Crowds, and Prediction Markets, to make them less so?
To
assess these business risks would require two different 'crowds': one
familiar with national and global economic, social, technological,
environmental and political conditions (for the risks that have causes
external to the business), and a second familiar with the company
itself (made up, say, of employees and customers, for the risks with
causes internal to the company. We could set up global and regional Prediction Markets
for each of the external-source risks, and then tie them into Wisdom of
Crowds assessments of the business' employees and customers for the
internal-source risks. By looking at the median and standard deviation
assessments for both probability and consequence of each risk, we could
place each risk on the chart above for each business, with a tight dark
circle representing risks where there is great consensus and a large
light circle or oval representing risks where there is considerable
divergence of opinion. Both short-term and longer-term risk assessments
could be plotted for each type of risk.
Each of the stakeholders
in the business -- management, employees, customers, investors,
suppliers, community members etc. could then use this risk chart to
make decisions in its own areas of interest. Customers might be more
interested in reputation (#4), supply chain (#6) and innovation (#9)
risk for example. Management could focus risk management decisions on
upper right quadrant, short-term risks, while institutional investors
could focus investment decisions on longer-term risks.
The
risk chart could then be the basis for a comprehensive risk management
strategy for businesses, using a methodology something like this:
- Develop a process to continuously reassess the likelihood and potential severity of the risks facing the business.
- For
each risk that is controllable by the business, identify
cost-beneficial prevention actions. The costs of these programs should
include the costs of over-regulating the business, bureaucracy, and
stifling creativity and connectivity by restricting access to new
technology.
- Develop a process to detect early-warning signals
of these risks, and a mitigation program to put into effect when they
are detected.
- For all risks, develop an adaptation and recovery
plan. For major risks that could arise suddenly, use scenario planning
to understand how the risk would likely unfold, train people to know
what they should do, and do a 'table-top' and other exercises to
simulate and practice coping with these risks and increase business resilience.
- After recovering from an adverse event, assess learnings and review and change the strategy as appropriate.
This
is the approach I'm taking when I talk with businesses about
environmental sustainability and social and environmental
responsibility. Tie environmental sustainability to risks to business
sustainability, and social and environmental responsibility to risks to
business reputation, business continuity and business resilience.
I'm
convinced that business cares about these risks, and is prepared to
take steps to manage them, and that, by doing so, they will become more
sustainable and responsible. The businesspeople I speak to want to do
more, personally, to make the world a better place and to be better
corporate citizens, but to justify doing so they need these actions to
be couched in business risk, business sustainability and business
resilience terms.
I'm not saying that this is all that it will
take. Our markets are distorted and far from perfect, and regulation is
also needed that equitably forces businesses to reduce their adverse
impact on the planet and on the social fabric of the communities in
which they operate. What business managers tell me is that, provided
the regulation is equitable, enforced evenly, and provides a level
playing field for all players in their industry, they don't have any
problem with regulation that will reduce their adverse social and
environmental impact. In fact, quietly and off the record, they tell me
they'd welcome it.
This
means that race-to-the-bottom 'free' trade agreements need to be
replaced with fair, regulated trade agreements that put people and the
environment ahead of profits. We can never achieve a level regulatory
and competitive playing field as long as these laws (which
irresponsible global corporatists strong-armed weak and gullible
governments into signing) encourage offshoring, exploitation,
pollution, waste, cost 'externalization' and the dumping of toxins in
struggling nations.
When the laws are
equal, and the risks are equal, we just might find that business
becomes more responsible and sustainable than we, its customers, are.
Worth dreaming about, anyway.
|
8:37:12 PM 
|
|
MADE IN CANADA
trust your
instincts 