Improving Organizational Risk Management

Abstract

Chapters 1 and 2 emphasized technical methods−causal analysis and robust decision-making, respectively – that are especially useful for individual decision-makers. Chapter 3 explored challenges and opportunities for improving decision-making by treating communities, rather than individuals, as the natural units for decision-making. This chapter, by contrast, considers an intermediate level of decision-making entity: the organization, including business enterprises. Although it is a fascinating challenge to understand how businesses (and other organizations) interact with each other and the public within societies, communities, and institutional frameworks, adapting to each other and to their uncertain environments over time (Harford 2011), this chapter has a narrower, applied focus: understanding and improving how organizations describe and respond to the risks and threats that they perceive. It has become common practice for many organizations to explicitly identify, list, and make management priority decisions about different risks that they are aware of facing. These can be as diverse as risks of supply chain disruption, loss of reputation, failure of business continuity, legal liabilities, strikes, plant closures, and market and financial risks. This chapter critically examines how well such explicitly identified risks can be managed by the scoring, rating, and ranking systems now widely used in practice; and whether it is possible to make simple changes to improve the performance of these risk management systems.