Presentation 1: Risk, Uncertainty and the Public Sector Conundrum Andrew Graham School of Policy Studies Queen’s University Kingston, Canada 1 Workshop on Risk and Enterprise Risk Management Southern Africa Development Community April, 2014 Gaborone, Botswana

The Salience of Risk in Political Discourse “ Political risk is a reality faced by every practising political actor. Politicians judge and seek to manage it, political advisers assess and counsel on it, bureaucrats often bemoan it, and media commentators make a business of reporting it.” Catherine Althaus, Calculating Political Risk

“There can be no safety without risk” Aron Widalvsky, 1988, Searching for Safety 3

Risk Management is the Business of Government: Well Beyond the Political Risk to society: natural, man-made Programmatic risk: the impacts of what governments do Regulatory risk: controlling or directing the behaviour of others Management risks: more later Trust and confidence risks 4

The Public Sector Conundrum As we grow our understanding of risks and uncertainty, we create expectations abut their mitigation We are still in rough terrain in government about what risk is We still have a wide divergence between the public and the expert Addressing risk does not necessarily mean resolving it. The concept of risk, as central as it is becoming and as sophisticated we have become in its application, remains an elusive idea. 5

Risk: what is it? 6

Contested Linguistic Origins Arabic risq: “anything that has been given to you by God and from which you draw profit” Latin risicum: challenge posed by a barrier reef to a sailor Spanish risco: to sail into unchartered waters Greek rhiza: hazards of sailing too near to the cliffs. 7

“ The revolutionary idea that defines the boundary between modern times and the past is the mastery of risk ” - Peter Bernstein, Against the Gods Bernstein’s central argument is that the concept of risk has allowed humanity to move from a mind-set of fate to one of choice. 8

9 ProbabilityUncertaintyRisk

10 Crisis ThreatUncertaintyUrgency Risk Potential for Disruption Future Orientation Uncertainty

What It Isn’t: Difference between risk and crisis management 11

12 What is a risk? Any event or circumstance that can prevent an organization from achieving it goals. “Risk comes from not knowing what you are doing.” Warren Buffett “Risk is a choice rather than than a fate.” (Bernstein, 1996)

13

Risk the emotion and risk the calculation Risk is detected in both the gut and the head – Dan Gardner, The Science and Politics of Fear. Risk cannot always be stripped down to cold numbers especially in so much of what the public sector does. Key to understanding how risk plays through public policy and management. “The policy of being too cautious is the greatest risk of all.” – Jawalarlal Nehru 14

Political risks People risks Financial risks Delivery and Service Risks Information risks Policy risks Reputation risks 15

What is Risk? Risk A Measure of Uncertainty = Likelihood/Probability Impact Not all risks are equal, not all risks require action – this is about priority setting 16

Typical Risk Map 17

18 Why Do It? Due diligence: what did you know, when did you know it and what did you do? Degree of change in the organization and/or the working environment Degree of change in senior management Appetite for: – governance (actual and optics) – clarity of decision making Part of good corporate management – follows logically from sound planning, good direction and strategic outlook An powerful tool in allocating resources – not just money A communication tool within the organization and with key stakeholders

19 Why Do It? Gives greater assurance in an increasingly uncertain and complex world We are getting better at both identifying and measuring risk in our environment Effective risk management better prepares an organizational for an uncertain future, enables it to match its predictive capacity to resource management and priority setting and better allocate accountability Increasing demand from oversight bodies for systematic management of risks (financial, operational and social).

Complacency is the enemy of risk management When anyone asks me how I can best describe my experience in nearly forty years at sea, I merely say, uneventful. Of course there have been winter gales, and storms and fog and the like, but in all my experience, I have never been in any accident of any sort worth speaking about. I never saw a wreck and never have been wrecked, nor was I ever in any predicament that threatened to end in disaster of any sort. You see, I am not very good material for a story. Edward J. Smith, Captain, RMS Titanic 20

The enemies of good risk management * Seeing mistakes as just failures. * Inability to learn and adapt. * Fear of all risk – the catatonic leader. * Parts that don’t work together – control and audit outside of operations. * Policy systems that are disconnected from their targeted reality * Arrogance about the organizational capacity to manage problems and change * Ignorance of what is going on 21

What options for action are there? 22

Risk Perception and the Public Discourse 23

24

Framing a Public Policy Issue Imagine that your country is preparing for the outbreak of an unusual Asian disease, which is expected to kill 600 people. Two alternative programs to combat the disease have been proposed. Assume the exact scientific estimate of the consequences of the programs are as follows: Program A: "200 people will be saved" Program B: “There is a one-third probability that 600 people will be saved, and a two- thirds probability that no people will be saved" From Tversky and Kahneman

Framing a Public Policy Issue Imagine that the your country is preparing for the outbreak of an unusual Asian disease, which is expected to kill 600 people. Two alternative programs to combat the disease have been proposed. Assume the exact scientific estimate of the consequences of the programs are as follows: Program C: “400 people will die" Program D: “There is a one-third probability that nobody will die, and a two-thirds probability that 600 people will die" From Tversky and Kahneman

Framing a Public Policy Issue Program A: "200 people will be saved" Program B: “There is a one-third probability that 600 people will be saved, and a two- thirds probability that no people will be saved" Program C: “400 people will die" Program D: “There is a one-third probability that nobody will die, and a two-thirds probability that 600 people will die" From Tversky and Kahneman

Conundrums in Public Sector Risk Communication Admitting risk can be risky: why did Tokyo Electric not put robots into nuclear power plants? Risk as blame avoidance or the risk of blame – where does that fit in? Expert versus public: statistical versus the person Media focus on urgent, individual, 5 W’s  “Social amplification of risk” – Roger Kasperson, Risk Analysis, Vol. 8, No. 2, “The investigation of risks is at once a scientific activity and an expression of culture.”

Behavioral Concerns Various well-documented fallacies can cause inaccurate or biased estimates of values, probabilities, etc. E.g., – Anchoring fallacy: bias toward an initial value – Intentional blindness: concentrating in one area can induce blindness to other events – Availability fallacy: immediately-available examples have a perhaps undue influence on our estimates Car accidents post

People are bad risk calculators … or often said to be bad when 1. Presented with percentages, large numbers, or single-event probabilities 2. Experts tell them the risk 3. Presented with incertitude (versus variability) 4. Risk is seen to be imposed 5. Risk is out of personal control 6. Rare events are observed - representativeness 7. When children are at risk 8. etc. 30

Characteristics of the Hazard that Influence on Risk Perception Acceptable Risks:  Voluntary  Under your control  Clearly beneficial  Fairly distributed  Natural  Statistical  From a reliable source  Familiar  Those that affect adults Fischhoff, et al., 1981 Unacceptable risks:  Involuntary  Controlled by others  Of little or no benefit  Unfairly distributed  Man-made  Catastrophic  From unknown sources  Unfamiliar, exotic  Those that affect children 31

Risk Tolerance Is zero risk tolerance possible? What does risk averse mean, really? Quantitative versus qualitative tolerances. Policy and political risk calculations are a mix of gut and evidence. Good public policy recognizes this. Good management of public enterprises foresees risk, embraces error as a way of learning of emerging fault lines or changes and adapts. Good risk calculation in public policy and management foresees the unforeseeable and advises on it. 32

In the end, it may not be pretty but it can work: curb-side risk management 33

Problems and Limitations of Risk Assessment 1.The process by which policy and expertise are mixed together in a risk assessment is poorly understood. 2.Its ability to provide a “Bright Line” has been overstated by risk assessors and overused by regulators and lawmakers. 34

Problems and Limitations of Risk Assessment 3.The data quality objective for the different goals and types of risk assessment is poorly understood. 4. There is often a substantial gap between the data quality objective of the decision maker and the degree of complexity of the assessment, with unnecessary analyses confusing and delaying response. 35

Problems and Limitations of Risk Assessment 5.Risk assessment often obscures the substantial gap between the data needs for good public decision making and the paucity of available data. 6.Risk characterization should be extended beyond a probabilistic statement of risk to include considerations of other endpoints. 36

Problems and Limitations of Risk Assessment 7.Risk assessment is secondary prevention rather than primary prevention. 37

Limitations of Technical Risk and Need for a Broader View “The technical concept of risk is too narrow and ambiguous to serve as the crucial yardstick for policy making.” Reliance on so-called pure science, expertly supportable probabilities and quantitative justifications simply do not fly: risk is deeper, more ambiguous and as flawed as it is vital. Risk is subject to elements of social amplification that pass its definition and meaning through several channels and stages to render is a public issue as fully defined, not just a singularity. 38

Source: Canadian Food Inspection Agency 39

Social Amplification of Risk: Processing Agents 40 Risk Event/Object Expert Technical Risk Management Agency: risk Owner Media Engaged Social Organizations Opinion Leaders Victims and Potential Victims Other Public Agencies

Social Amplification of Risk: Key Amplification Steps – Applies to Each Agent 41 Filtering of signals: reducing incoming information Decoding of signal: assigning meaning Processing of risk signals: drawing interferences and available heuristics Attaching social and political values to signals Sharing and expanding signal information to relevant groups and peers Forming views about risk tolerance, mitigations or call for action Engaging in group or individual actions to accept, ignore, tolerate or change the risk

The Economics of Effective Risk Management $1 Prevention $7 Short Term Crisis Response Savings $15 Long Term Response and Consequences Costs From, Myopic Voters and Natural Disaster Policy, Andrew Healey and Neil Malhotra, American Police Science Review, August,