LAST CHRISTMAS a legal firm sent me a mug. On the front was the legend: ‘Do you have a risk assessment for THIS?’, and on the back: ‘Have you: Tested the kettle’s connection? Checked for vermin faeces in the tea bag? Ensured the milk is within its sell-by date? Checked the handle is secure? Waited for the tea to cool to a safe temperature?’
This is a joke, but it’s not much more extreme than the notice seen recently at a cricket ground warning that cricket is a game played with a hard ball that could hurt if it hit you. Or the council that advised residents to take out liability insurance costing hundreds of pounds a year for an allotment rented for £5. Or, at a completely different level, the US Sarbanes-Oxley legislation that obliges companies to have internal controls to prevent future Enrons or WorldComs.
What all these examples have in common is a growing obsession with risk management. At first blush, the managing (and implied minimising) of risk sounds uncontroversial, even beneficial. But is it really true that the world is suddenly so risk-ridden that it justifies what LSE’s Professor Michael Power described in the title of an eloquent Demos pamphlet as ‘The Risk Management of Everything’? OK, we used not to have terrorists, but neither did we have statins to control cholesterol or smoke-free pubs – and when was a spectator last killed by a cricket ball? Or is risk management just another artificial bogeyman set up for consultants to charge huge amounts to charm away?
It’s more subtle, and pernicious, than that. The term ‘risk society’ was coined by sociologist Ulrich Beck in the early 1990s to describe a modern society organised in response to the idea of risk. But Power dates the rise of the risk-management industry to 1995, when the oil storage platform Brent Spar and the collapse of Barings Bank suddenly brought into focus the twin objects of risk fetish: internal controls and reputation.
The downing of Barings by rogue trader Nick Leeson triggered a quest for internal control that culminated in Sarbanes-Oxley. And with Brent Spar came the realisation that perception of events and motivations could be life- threatening – a revelation underlined when Arthur Andersen, the largest auditor in the world, vaporised after the disclosure that it had shredded Enron documents.
‘Reputation has become a new source of anxiety where organisational identity and economic survival are at stake,’ Power writes. ‘And if everything may impact on organisational reputation, then reputational risk management demands the risk management of everything [RMOE].’
Unfortunately, the consequences of RMOE are potentially more damaging than the first-order risk it was supposedly designed to control. Internal controls are about process – paper trails and arse-covering, in the technical term witness the Sarbox ‘reign of terror’ which absorbs so much corporate energy (and cost) that there’s no one left to look out for ‘unknown unknowns’, by definition beyond the scope of risk management until they occur.
Internal control blueprints, concludes Power, are largely fantasy, an incantatory naming and taming designed to ‘project comforting images of controlling the uncontrollable’. Meanwhile, reputational risk takes us into still more troubling territory. Reputation is secondary risk, the risk to a company’s image of making a primary mistake, but, as Andersen demonstrates, it is a potent one. The response is defensive: either direct, so that schools cancel trips and auditors stop auditing high-risk clients (ie, those who most need it) or indirect, by acting as before but attaching warnings everywhere (like the mug and the cricket notice).
Power believes we are entering a phase where organisations are more concerned with second-order, reputational, risk, than the primary one of getting things wrong in the first place. This is manifested in the public sector by universities and hospitals managing league tables and stars rather than students and patients, and in the private sector by the subsuming of corporate responsibility into the risk management agenda. Instead of being about doing the right thing, CSR is just another risk-management ploy. The spin and the small print are more important than the substance.
The pathology of risk management presents in many other absurd and tragic ways. Organisations may be safer, but at the price of offloading risk on to individuals who can’t pass it on – which is why public confidence in organisations does not increase. And pity the professionals, teachers, doctors and accountants, who hide their expensively gained expertise rather than express it for fear of the retribution that an honest mistake will bring down on their organisations and ultimately on themselves.
Thus does risk management multiply risk for the collective. In other words, my mug isn’t a joke. It’s deadly serious.
The Observer, 15 July 2007