Partner, RSD Solutions Inc.
I have a confession; my first training and career was as a physicist. As a physicist we calculate natural phenomena to astounding degrees of precision, often under highly controlled laboratory conditions. Yet, with all of that precision, and hundreds of years of theoretical and experimental development, physicists still embrace and accept the concept of complexity as the term is scientifically defined.
Conversely, in finance and risk management – fields with much shorter histories of study, and nothing like laboratories with controlled conditions – we insist on making measurements to ever higher degree of precision (such as in option pricing), even though it is widely accepted that the models may be incomplete and the input data subject to uncertainty or interpretation.
In the sciences there is a classic distinction between those processes which are Basic, Complicated and Complex processes and systems. The best explanation that I have ever read is in the book “Getting to Maybe: How the World is Changed” by Frances Westley, Brenda Zimmerman, and Michael Quinn Patton, with a forward by Eric Young. (Random House 2006) [1] This book has nothing to do with risk management but I would most highly recommend it to every risk manager as one of the best books on how to think about risk management and how the practice of risk management might evolve.
In Getting to Maybe, the authors explain Basic, Complicated and Complex systems using the analogies of “Baking a Cake”, “Sending a Rocket to the Moon” and “Raising a Child” respectively. Their description, greatly summarized and adapted, is as follows. In baking a cake it helps to follow a recipe and it helps to have experience, but even if a few mistakes are made, and a few measurement errors are incorporated it is likely that something resembling a decent and edible cake will be produced. In sending a rocket to the moon it is critical that each and every step (and there are a great many steps) must be followed exactly, and if each step is followed exactly then the space mission will be a success. In other words, getting a rocket to the moon is a complicated process, but if followed exactly then success is assured. Raising a child on the other hand is a complicated process. Even if the parent does everything correctly, there is no guarantee of success. Furthermore you cannot break the process of raising a child into a set of discrete steps or processes. Raising the child is an integrated and holistic process. Furthermore it is impossible to a-priori say exactly what the most necessary or important steps for raising a successful child are going to be as each child is unique even though most children exhibit common characteristics. Finally post raising a child it is virtually impossible to state what the most critical factors were in the success or failure.
A moments thought allows one to see the many parallels between raising a child and implementing risk management. We tend to think of risk management as a complicated process, where if we simply (?) get all the pieces in place then success will follow. But the risk management field is littered with risk debacles that occurred at organizations that were the acknowledged leaders in risk management[2]. The point is that risk management is complex, not complicated. Best practices in risk management do not guarantee success. Furthermore, it is nearly impossible to tell exactly and precisely after the fact what were the key factors that led to success or failure of a risk management program. Additionally risk management is a holistic process – for example you cannot manage market risk while ignoring liquidity or credit risk.
That is not to say that risk management is an alchemist’s game. As in raising a child, we know there are factors and actions that lead to a higher probability of success or failure. Also, as anyone who is a parent knows, raising children requires experience, wisdom and flexibility to adapt to changing environments and to changing cycles in a child’s development. In other words, it is actions (technical knowledge), wisdom (experience and listening / watching the best and worst practices of other parents) as well as intuition all taken together that lead to higher probabilities of success or failure.
To put it bluntly, technical knowledge alone is not sufficient for success in risk management. Realizing that risk management is a complex, and not a complicated profession is what is required. In a complex system you need the technical knowledge, wisdom, intuition, and as I argued in a previous blog creativity are all necessary to increase the probability of risk management success.
Risk management is not basic. Risk management is not complicated. Risk management is complex, and accordingly requires a complex package of knowledge and skills to manage.
[1] The amazon.com link is http://www.amazon.com/Getting-Maybe-How-World-Changed/dp/067931444X/ref=sr_1_1?ie=UTF8&s=books&qid=1252101549&sr=8-1
[2] For more on this point, see my forthcoming article “Is Your Risk System Too Good” in the October issue of the RMA Journal.
