The Psychology of Risk Management

May 10, 2019

Traditional risk management is difficult to implement because risk is naturally thought of as a ‘negative’ concept. To overcome these psychological hurdles, it is necessary to re-evaluate how we think about risk and focus on assumptions instead.

There’s an old saying: “If you fail to prepare, then prepare to fail.” While generally true, the problem is it’s extremely negative. 

Alarming statements don’t motivate people as much as we might think; they can even have the opposite effect. It all comes down to negative psychology. 

This poorly understood phenomenon can waste a lot of time and money in business and is too common in the world of risk management. 

At De-RISK, our job is to help businesses find a way past the pitfalls to achieve their objectives. 

In this article, we will show you how negative psychology can manifest in the world of risk management, why we should focus on assumptions, not risks, and why assumption-based risk management is far more valuable for team motivation and risk identification. 

Risk Is a Negative Concept

Saying that risk is a negative concept sounds a bit obvious. But when you look deeper into how this undermines business attitudes to risk, it becomes clear that this may be the fundamental reason why risk management fails to deliver its promised benefits.

Negative psychology plays a destructive role because risk management contrasts so much with the everyday ambitions of management. 

For example, businesses tend to set positive goals in the setting and achieving of objectives, milestones, and budgets.

Ask a project manager, “What are your risks?” and there will likely be two consequences:

  • The project manager will have to shift from positive-thinking. Such a shift can effectively ‘confuse’ the brain. The result is the project manager may start worrying about other risks (for example, "What if the building collapses?"). These may be “risks” but they are very low probability and should not be the concern of the project manager.
  • The project manager may be reluctant to share any risks. The project manager may think ‘What are you going to do with this information?’ and therefore only reveal the risks she or he is comfortable talking about. This negativity can sometimes create psychological barriers to success and significantly compromise risk identification, which will undermine the whole risk management process.

Reframing risk as a less negative concept will help ensure your business deals with it head-on. 

Psychological Impacts

The biggest threat to successful risk management may be the psychology of risk and negative language, but there are further problems that compromise quality and efficiency. Below are the psychological responses to risk. 

1. The Tendency to Be ‘Reactive’ and Not ‘Proactive’ 

Human beings did not evolve to deal with abstract threats far off in the future; we evolved to deal with obvious and immediate threats. 

This curious quirk of our psychology means there is a general tendency for people to focus on the problems of today (i.e. “issues”), and not the risks of tomorrow. 

It effectively kills any hope of effective risk management. After all, a fire-fighter cannot learn to prevent a fire if they are always fighting fires.

2. Risk Statements That Are Either Too Generic or Too Comprehensive 

Generic risk statements are things like ‘insufficient resources.” They are too obvious and leave no one the wiser of what the risk to resourcing is within the specific context. The danger is that staff may begin asking about the value of risk management and thus begins a downward spiral of negativity. 

At the opposite extreme, some risk statements may be too long and therefore get skipped over by busy managers. Risk must be addressed no matter what effort it entails. 

3. Selective Quantitative Analysis

It is easy to neglect things that are difficult to quantify and to instead focus on the ‘easy’ quantifiable risks. 

This leads to inappropriate prioritization where we naturally put more emphasis on things that we can quantify whereas risks that are very difficult to quantify, for example, reputational impacts or quality impacts, are under-evaluated.

4. High Minus Low Qualitative Analyses

Qualitative analyses are often based on HML (high minus low) type scales that tend to default ratings as ‘medium risk.’ Even if a risk is categorized as high impact but has a low probability of occurring, then the HML type will present it as a medium risk, distorting prioritization, and effectively hiding risks.

With competent teams and team leaders, these obstacles can be circumvented. But managing these problems can require a lot of administrative muscle, which gets expensive. 

In the end, the benefits may not justify the cost and the effort required to support and implement the risk management process. Luckily, it is possible to move away from this negative perspective. 

Approaching Risk Management From a Positive Perspective

The biggest problem with risk management is the challenge presented by negative psychology and language. To avoid this problem, we need to think about risk in a positive way. First, we need to look at where risks come from. 

Risks don’t exist in isolation. Risk is always something that stands in the way of achieving a set of objectives. Every business has objectives that it wants to achieve, and we can define risks in relation to the objectives. 

But because objectives are often defined at a high level, it is likely that any risks defined against them will also be defined at a high level and be too generic to be insightful. To overcome this, it is necessary to look at the plans that are in place to achieve the objectives.

When we plan to achieve something, we ask ourselves what we need to make that plan a reality. The plans, therefore, consist of some facts and a lot of assumptions. 

An assumption analysis process flow
 Figure 1: An assumption analysis process flow

We can see that it is the assumptions that in fact underlie the risks. Some assumptions will be close to being facts and therefore are not at risk. Inevitably, many assumptions will be at risk and these are where we need to focus, i.e. focus on assumptions and switch the risk management process into a positive exercise.

Identified assumptions can then be assessed for risk using a sensitivity/stability matrix. With sensitivity, we can ask: how much does it matter if the assumption turns out to be wrong? 

A sensitivity/stability matrix
 Figure 2: A sensitivity/stability matrix

This is then graded on the scale with ‘A’ meaning ‘least concern,’ working its way up to ‘D’ or ‘very sensitive/critical impact’.

As for stability, it is a confidence question: how stable is the assumption? Again on an ABCD scale. 

Using these charts and processes, it is simpler to find what level of risk you are dealing with and how best to approach a solution to that problem. 

The Link Between Poor Communication and Risk 

The root cause of most risk is poor communication. Poor communication can lead to massive delays and problems in businesses. A famous example is in 1999 when a $125 million NASA satellite crash-landed on Mars

The satellite was partly built in the US and the UK, and both teams failed to cross-communicate properly, using different metric systems for the components which caused the crash. If plans aren’t communicated properly, this can also result in lots of wasted time and money. 

It can be difficult to communicate efficiently in an information-rich world. Too much information and key points are likely to get lost in the noise. Too little information and misunderstandings are inevitable. 

The beauty of looking at assumptions is that they are inherent in the resources, timescales, interdependencies, complexities, and the decisions that are already planned to meet certain objectives. The key to getting the communication balance “just right” is to capture these assumptions and cross-communicate them to the main stakeholders. 

Capturing 20 important and risky assumptions will provide great value to the stakeholders, who will almost certainly take the time to read them. 

Moving to ‘Assumption Based Communication Dynamics’

ABCD was first developed in the 1990s, precisely as a way to combat the shortcomings and the negativity associated with traditional risk management. 

Since then, it has evolved, and managers all over the world have turned to the ABCD method to successfully identify and mitigate risk. In fact, we would argue that the ABCD method is the most effective and efficient risk management process around

With the ABCD method, a project manager no longer has to think negatively and ask, "What are the risks?" Instead, the manager can say, positively, "What are the things that need to happen to be successful?"

The human mind is an incredible tool, but it is not infallible. To circumvent the natural quirks and psychological traits that can impede us, we need to work through to separate the signal from the noise. Focus on assumptions and not risk. Then you will meet your objectives, your milestones, and stay within budget.

About the Author

Headshot of Eliza CochraneEliza Cochrane is a copywriter for De-Risk.com. She is a self-professed geek with an academic background in English and journalism. In her spare time, she writes creative prose, indulges in a bit of nature walking, goes stargazing, and reads.