Practical Word Choices for Risk Managers
April 2006
Risk specialists use specific words to communicate
with each other. This is important for theoretical reasons, but the words they
use to communicate with their nonspecialist colleagues may be of greater practical
importance. This article reports on some effects that are already shown by experiment,
and suggests some others that need more attention.
by Matthew
Leitch
Corporate risk managers, internal auditors, and internal control managers,
as specialists, have their own special language. We frequently debate the meaning
that words should have within our own specialties.
No official framework or standard for internal control or risk management would
be complete without definitions. As so often, it is the most used words that
lead to the most alternative meanings. For example, we often refer to "a risk"
and "some risk" and yet very, very rarely acknowledge that these must refer
to two different concepts—one countable, the other not countable but potentially
measurable.
In places our jargon has departed from nonspecialist use of the same words
or phrases. For example, most leading specialist opinion now agrees that risks
can have unexpectedly positive impacts as well as negative impacts, though this
is controversial and different from nonspecialist use of the word "risk" which
is overwhelmingly negative.
If we use our specialized language with nonspecialists, for example in workshops
or self-certification documents, the results could be disappointing to say the
least. On the other hand, get it right and implementation of risk and control
ideas could be considerably easier than it usually is today.
Results from Experiment
A little while ago I ran an online experiment to test four alternative ways
to ask people to list risks and actions. The results showed that the words used
had a profound effect on the balance of negative, positive, and neutral "risks"
listed, and on the types of actions people suggested to deal with them.
Volunteers for the experiment, of which there were 36, visited a Web page
where they chose one of four scenarios:
- Planning a wedding
- Buying a company
- Building an extension to a house
- Looking for a new job
In the next stage they were asked to, either:
- List risks
- List sets of risks
- List risk factors
- List areas of uncertainty
The choice of wording was random and allocated subjects nearly equally between
the four wordings. They were also asked to list actions they might take in respect
of each item.
The items people wrote down were varied, but two common types of item predominated.
One type was an item expressed in terms of failure to achieve something that
would be an objective for the project. For example, "Failure to complete the
build within budget." Actions for these items tended to be different ways of
trying harder to do the thing that was at risk. The other type of item was an
unknown: for example, "The cost of the build." Actions for these items tended
to be different ways to find out more, either immediately or as the work proceeded.
The scenario clearly had an effect on behavior. For some reason, people tended
to list possible failures in connection with weddings, jobs, and building, but
when buying a company, preferred to list unknowns. Probably it is the tradition
of due diligence in company acquisitions that cues these items and the resulting
actions. However, there was also a strong effect from the wording of the instructions.
All three instructions that mentioned "risk" had the same effect, which was
to trigger a high percentage of potential failure items. In contrast, the "areas
of uncertainty" wording triggered more unknowns.
If you want to encourage people to be less introspective and negative, and
to pay more attention to missing information, then you should ask them for "areas
of uncertainty" and not mention the word "risk."
My observation is that most risk registers resulting from workshops pay far
too little attention to uncertainty, and consequently many actions are things
that would be done even if the world was without uncertainty. For example, people
will suggest the risk, "Failure to complete on time" and then the action "Carefully
plan the project." This is not risk management because you would plan even in
a world without risk. This is just going through the motions.
Another point from this research is the failure of respondents to distinguish
between "risks" and "risk factors." Clearly these are not the same, but when
asked for "risk factors," people did not list risk factors, i.e., things that
were true, or very likely to be, and would be drivers of the risk involved.
Using risk factors is a powerful way to evaluate risks, but if people do
not distinguish between the two, this cannot work. The research does not show
what wording to use instead, but we should be aware of this problem and give
extra instructions, including examples to make clear what is intended, and look
for better words.
The research is written up in full in "Results
of an experiment in risk and uncertainty management."
Other Words That Could Be Crucial
In your organization, are people asked to "identify" risks or to "define"
them? Almost certainly they are asked to "identify" risks, and yet there is
an overwhelming practical reason for saying "define" instead.
A common problem with risk register items is that it is hard to tell what
is included in the item. They tend to be vague, rather general, and to lack
details necessary to properly assess them. Pick a sample on most corporate risk
registers and think about each critically. The chances are you will conclude
that nearly all of the items have this fault.
This may be, in part, because people think of "risks" as things that already
exist, have clear boundaries, already given, and therefore need only be named.
This is the frame created by the instruction to "identify" risks. As soon as
we say "identify" we have people thinking that the risks need only be named.
In contrast, if we say "define" the risks, this promotes a different frame,
one in which risks do need to be explained
and defined. And they do, don’t they!
Another wording that may help to encourage good explanation of risks is to
ask for "areas of" risk/uncertainty. If we say "areas" this again suggests a
concept that has a boundary, and therefore needs some definition.1
Moving on to another topic, if you are interested in getting people to consider
"upside risks" as well as downside risks, then you face a particular challenge.
As already discussed, if you mention "risk," this is interpreted as negative
by most nonspecialists. As an alternative, some have tried asking for "opportunities"
instead. So far, my informal observation is that this tends to trigger a lot
of statements about things that are opportunities existing now, rather than
ones that might arise in the future, which would be closer to the idea of an
upside risk. Worse, the "opportunities" that pop up immediately in workshops
tend to be suggestions the participants have made in the past and which were
not acted upon, usually for good reasons.
At the very least, we need to add to the explanation and perhaps experiment
with alternative wording, such as asking for "potential future opportunities."
Summary
The evidence so far is that the words we use to get people thinking about
how uncertainty should affect their actions can have a profound effect on how
well they perform. This is not just a theoretical debate between specialists,
but a vital practical concern that affects whether risk management programs
make headway or not.
We need more research, but already it is clear that asking people to "identify
risks" is far from the best way to proceed.
Opinions expressed in Expert Commentary articles are those of the author and are
not necessarily held by the author's employer or IRMI. Expert Commentary articles
and other IRMI Online content do not purport to provide legal, accounting, or other
professional advice or opinion. If such advice is needed, consult with your attorney,
accountant, or other qualified adviser.