No Result
View All Result
SUBSCRIBE | NO FEES, NO PAYWALLS
MANAGE MY SUBSCRIPTION
NEWSLETTER
Corporate Compliance Insights
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe
No Result
View All Result
Corporate Compliance Insights
Home Risk

Risk Has a Shape

by James Bone
September 16, 2015
in Risk
Risk Has a Shape

One of the central tenets of risk management is the idea that we understand “risk.”  Most definitions of risk management include terms such as assessment, evaluation, identification, control, transfer, reduction, retention and so on to describe what should be done to risk to protect the firm, patient or enterprise from bad outcomes.  The benefits ascribed to risk management include the achievement of a firm’s business goals, better patient care, improved decision making, risk-adjusted returns on capital and a host of superlatives attributed to the proper risk framework or leading practice.

Very few risk management definitions actually explain how to accomplish these results with any degree of specificity.  Instead, the definition includes vague descriptions of activities that lead to risk management. For example, a hospital definition of risk management: “The constellation of activities—planning, organizing, directing, evaluating and implementing—which are involved in reducing the risk of injury to patients and employees, as well as property damage or financial loss in a health care facility.”  This definition, like many others of similar ambiguity, are no more than “trial and error” disguised as risk management.  What is clear is that we may not truly understand risk as well as we think we do!

With few exceptions, there are two very large and glaring gaps in every definition of risk management.  The first gap consists of a lack of recognition that a large body of well-established research and knowledge exists on how to measure risk.  Risk has a shape and the shape of risk is derived from the data of events composed of the things we call a risk.  For example, hospitals document the number of wrong limbs cut off due to poor communications or an IT department may count the number and type of “denial of service” incidents it has experienced each month.  Each of these events take the form of various distribution patterns when plotted on a chart.  The shape of risk can be defined by its distribution on a chart such as normal, log-normal, and skewed distributions, to name a few.  To truly understand risk, you must understand its shape.

Anyone, without any training, can talk about risk management, but if you can’t explain the shape of your risk, then you have only a cursory understanding of it. This lack of understanding partially explains why risk management programs are perceived to have failed.  The shape of risk helps to explain the behavior of the risks you face.  What is perceived as a failure of risk management programs is really a failure to understand the limits of the tools used in risk management today.  This is not a debate between nerds.  We are misled by risks every day because we do not understand the shape of risk.

The second gap in risk definitions deals with what cognitive scientists call “heuristics and biases.”  Heuristics include intuition, norms, knowledge and shortcuts we use to understand and navigate the world we live in.  Biases are long-held beliefs and preferences we establish over a lifetime.  Whenever we are faced with new threats and uncertainty, we oftentimes fall back on the things that worked in the past, only to learn that we were led astray by cognitive dissonance.  Said simply: we fail to believe the facts that are counter to our beliefs or expectations until the risk is obvious to all.

Risk management — outside of scientific departments, Quant shops on Wall Street and a few select quantitative fields — does not practice its art with precise tools for measuring risk or take into account the human errors inherent in heuristics and bias.  Precision should be measured in degrees.  Data scientists understand that all models are flawed, but some models are more useful than others.

Making decisions under uncertainty requires that risk professions understand the shape of their risks.  The shape of your risks will tell you how much confidence to place in your data.  As risk professionals begin to discuss risk in terms of degrees of confidence and probability of outcomes through the use of more precise tools, the expectations of and value in risk management becomes more evident.  These tools will then lead to better decision making and help to overcome the flaws that simple heuristics and bias bring to sloppy thinking.  I plan to address heuristics and bias in-depth in upcoming articles as it deserves much more explanation than I have dealt with in this piece.

The good news is that these tools exist today and you can begin to use them in your risk practice without becoming a data scientist or quantitative analyst.  In fact, I maintain one of the largest free databases of risk management tools on the internet today. The level of sophistication and functionality of analytical risk tools continues to grow rapidly and will become standard practice in the next five to 10 years.  Now you have no excuse for not knowing or understanding the shape of your risk.


Previous Post

Consulting Magazine Recognizes Protiviti as a “Best Firm to Work For”

Next Post

TÜV Rheinland Launches New On-Site Service Ahead of ISO 9001:2015 and ISO 14001:2015

James Bone

James Bone

James Bone’s career has spanned 29 years of management, financial services and regulatory compliance risk experience with Frito-Lay, Inc., Abbot Labs, Merrill Lynch, and Fidelity Investments. James founded Global Compliance Associates, LLC and TheGRCBlueBook in 2009 to consult with global professional services firms, private equity investors, and risk and compliance professionals seeking insights in governance, risk and compliance (“GRC”) leading practices and best in class vendors.
James is a frequent speaker at industry conferences and contributing writer for Compliance Week and Corporate Compliance Insights and serves as faculty presenter and independent consultant for several global consulting firms specializing in governance, risk and compliance, IT compliance and the GRC vendor market. James created TheGRCBlueBook.com to provide risk and compliance professionals with transparency into the GRC vendor marketplace by creating a forum for writing reviews on GRC products and sharing success stories on the risk practices that are most effective. James is currently attending Harvard Extension School for a Master of Arts in Management with an emphasis in accounting and finance. James received an honorary PhD in Letters from Drury University in Springfield, Missouri and is a member of the Breech Business School Hall of Fame as well as the Missouri Sports Hall of Fame. Having graduated from the Boston University Graduate School of Education, James received his M.Ed. in Management and Organizational Design in 1997 and a Bachelor of Arts in Business Administration from Drury University in 1980.  

Related Posts

Fox_DOJ Speeches_f

Analysis of Recent DOJ Statements

by Corporate Compliance Insights
March 23, 2023

DOJ leaders provide insight into agency's plans. Analysis of Recent Statements DOJ Shaping the Future of Corporate Criminal Enforcement What’s...

Fox_2023 ECCP Update_f

2023 Evaluation of Corporate Compliance Programs

by Corporate Compliance Insights
March 23, 2023

Keeping up with 2023 changes to DOJ guidelines. Additions, Deletions & Changes From 2020 2023 Evaluation of Corporate Compliance Programs...

encompass update

Encompass Launches pKYC Maturity Model

by Corporate Compliance Insights
March 22, 2023

KYC automation platform Encompass has unveiled a new perpetual Know Your Customer (pKYC) maturity model designed to help banks improve...

consilio onna partnership

Consilio, Onna Seek to Streamline eDiscovery for Cloud Apps

by Corporate Compliance Insights
March 22, 2023

Legal technology provider Consilio has launched a new platform, Sightline Collect, powered by data management supplier Onna. The platform is...

Next Post
TÜV Rheinland Launches New On-Site Service Ahead of ISO 9001:2015 and ISO 14001:2015

TÜV Rheinland Launches New On-Site Service Ahead of ISO 9001:2015 and ISO 14001:2015

Compliance Job Interview Q&A

Jump to a Topic

AML Anti-Bribery Anti-Corruption Artificial Intelligence (AI) Automation Banking Board of Directors Board Risk Oversight Business Continuity Planning California Consumer Privacy Act (CCPA) Code of Conduct Communications Management Corporate Culture COVID-19 Cryptocurrency Culture of Ethics Cybercrime Cyber Risk Data Analytics Data Breach Data Governance DOJ Download Due Diligence Enterprise Risk Management (ERM) ESG FCPA Enforcement Actions Financial Crime Financial Crimes Enforcement Network (FinCEN) GDPR HIPAA Know Your Customer (KYC) Machine Learning Monitoring RegTech Reputation Risk Risk Assessment SEC Social Media Risk Supply Chain Technology Third Party Risk Management Tone at the Top Training Whistleblowing
No Result
View All Result

Privacy Policy

Founded in 2010, CCI is the web’s premier global independent news source for compliance, ethics, risk and information security. 

Got a news tip? Get in touch. Want a weekly round-up in your inbox? Sign up for free. No subscription fees, no paywalls. 

Follow Us

Browse Topics:

  • CCI Press
  • Compliance
  • Compliance Podcasts
  • Cybersecurity
  • Data Privacy
  • eBooks Published by CCI
  • Ethics
  • FCPA
  • Featured
  • Financial Services
  • Fraud
  • Governance
  • GRC Vendor News
  • HR Compliance
  • Internal Audit
  • Leadership and Career
  • On Demand Webinars
  • Opinion
  • Resource Library
  • Risk
  • Uncategorized
  • Videos
  • Webinars
  • Well-Being
  • Whitepapers

© 2022 Corporate Compliance Insights

No Result
View All Result
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe

© 2022 Corporate Compliance Insights

Welcome to CCI. This site uses cookies. Please click OK to accept. Privacy Policy
Cookie settingsACCEPT
Manage consent

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
CookieDurationDescription
cookielawinfo-checbox-analytics11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checbox-functional11 monthsThe cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checbox-others11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-necessary11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-performance11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy11 monthsThe cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytics
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Others
Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet.
SAVE & ACCEPT