Business Risk, Prediction Markets, Sustainability, Resilience, and the Wisdom of Crowds

If you want to get people to care about something you have to frame it in personal terms, show them how it affects them personally. So when I talk to business people about Global Warming, I frame it in terms of business risk, business sustainability, and business resilience. These are things they care about.

Some definitions:

• Business Risk: The possibility of the business suffering loss, harm or danger. It is the product of the probability (likelihood) of adverse events occurring, times the consequence (severity) of these events should they occur.
• Business Sustainability: The capacity of the business to remain in existence.
• Environmental Sustainability: The capacity to be continued indefinitely with minimal long term effect on the environment. Often shortened to just ‘sustainability’. Business executives don’t really care about this, but they do care about their business’ sustainability. You have to show them that the two are connected, and how they are connected.
• Social (and Environmental) Responsibility: A duty of care to safeguard the well-being of people (employees, customers, community) and the environment. Business executives don’t really care about this either, unless their indifference exposes them to business risk.
• Business Resilience: The capacity of the business to adapt to or recover quickly from adverse events.

There is a well-established framework that positions risks in terms of likelihood (the probability of them occurring) and severity (the consequences if they occur). It’s an imperfect model for several reasons:

• both the probability and consequences of most risks increase over time, so a chart that depicts short term and one that depicts long term risks will look very different
• the consequences often depend on who you are
• the consequences can be depicted different ways (dollar cost, loss of life, loss of quality of life) and these depictions can vary widely
• both likelihood and consequences are very subjective — they’re a matter of prediction, and humans are notoriously bad at predicting, and tend to underestimate the likelihood and consequences of adverse events

Despite these imperfections, charts that depict risks in these terms do tend to attract the attention of business. Most recently the Davos group produced this chart of its ’26 greatest global economic risks’ (NPT= nuclear non-proliferation treaty; CII= critical information infrastructure):

From Davos World Economic Forum Global Risks 2008 Report

As interesting as this chart is, the problem is that its developers don’t know much about what the risks really are. The likelihood of a pandemic, for example, as anyone knowledgeable about the topic will tell you, is more than 6% in the next decade. Likewise, to suggest the risk of significant global freshwater loss in the next decade is only 6% indicates a serious ignorance of ecology.

There are of course other ways to parse risks and the adverse events or crises that produce them:

• by how suddenly they occur or their likelihood of recurrence
• by the nature of the crisis (social/economic, natural, technological)
• by whether it’s caused by internal (to the business) or external occurrences

The potential suddenness of a crisis affects preparedness and mitigation strategy. Risks that are due to internal causes (failure to adhere to regulations or social norms; internal sabotage) are generally more controllable than those due to external causes, and hence require different strategies that focus on prevention and not just adaptation. But generally, the variables that are most important to business are the two in the chart above — likelihood and severity, in the short term (two years or less). Multiply the two together and the higher the result, the more attention business will pay to it.

Risk strategies generally focus on five things:

• prevention (for those risks that are controllable), provided the cost is not uneconomic
• early detection (gathering, sensing and listening to credible information and early-warning signals)
• mitigation — taking early steps to reduce severity
• response — adaptation and recovery once the event has occurred
• learning — revising the strategy after the event in order to be better prepared for recurrence

While planning can help (especially when a key component of the plan is training and rehearsal), perhaps a more important aspect of risk preparedness strategy is improvisational capacity. Aid workers during the Katrina disaster, for example, relied on networks of skilled collaborators connected continuously by satellite phones, who would ‘huddle’ impromptu as unanticipated issues arose and assess the wisest course of action.

The key elements of crisis mitigation and response are information-gathering, coordination and decision-making, and in a crisis none of these tends to go ‘according to plan’. Businesses that are agile and improvisational are often better able to cope with crises than those with extensive, complex, rigid plans. Plans are based on assumptions, and when the assumptions prove false (e.g. the assumption by FEMA that, in the advent of a hurricane, backup systems would ensure electronic communications were functional) organizations that can’t improvise add to the crisis instead of alleviating it.

With these assessments so subjective, there is a danger that such charts simply lose all credibility, and business people cease giving them any attention. What could be done to increase the credibility of these assessments?

If you’ve read The Wisdom of Crowds, or frequented any Prediction Markets, you probably know my answer: Instead of asking so-called experts, get the ‘crowd’ to make the call. Average out their predictions, and you’re likely to have a much more accurate assessment of both the likelihood and severity of different types of risk than the ‘experts’ at Davos could hope to muster.

To help them do that, you need first to decompose the risks. The simplistic scatter chart of the Davos gang overlooks the fact that many, perhaps most, of these risks are interrelated: The occurrence of one increases (or occasionally decreases) the likelihood of many of the others. When it comes to assessing the business risk from global warming, for example, businesses need to assess two short-term risks and at least five longer-term risks:

• regulation risk (risk of new carbon taxes and caps, and restrictions to supply and operations)
• reputation risk (risk of boycott for notorious emitters of global warming pollutants)

• risk of water shortages (related to glacial melt, evaporation and droughts) — every business needs water and some use staggering amounts of it
• risk of energy shortages (as oil supplies are depleted and become vastly more expensive and restricted)
• risk of pandemics (as infections spread beyond their normal tropical habitat to areas with no natural resistance, affecting humans and they animals they eat)
• risk of pestilence (as insects likewise spread beyond tropical areas and attack trees and agricultural plants with no natural resistance, wiping out crops and making food, paper and wood unaffordable)
• risk of sea-level and sea-temperature rises (engulfing low-lying cities and growing areas, and affecting aquatic life)

The global warming business risk can also be broken into:

• risks that arise because of actions the company takes, or neglects to take, that contribute to global warming or reduce impact on global warming (e.g. cost of reducing pollutants, and taxes paid on emissions)
• risks that arise because of the consequences of global warming on the company’s operations (e.g. water shortages)

So a chart of the major real risks to a business, at least in the longer term (20-50 years rather than ten) might look like this:

The risks that are not considered to be significant short-term (less than two years) risks are in the upper right corner, and as long as business is only concerned with the short term, these risks are perceived to be lower-left corner risks, not worth being concerned about. Besides, most businesses perceive these as largely unpreventable and unmitigatable anyway, so their approach is to worry about them if and when they occur.

Here’s a brief summary of these 15 types of risk:

* Low in the current perception of business; high according to economists and scientists. (I) = Internal cause risks. (E) = External cause risks.

The above perceptions of risk probability and consequence will vary from business to business and are, of course, subjective. How might we use the Wisdom of Crowds, and Prediction Markets, to make them less so?

To assess these business risks would require two different ‘crowds’: one familiar with national and global economic, social, technological, environmental and political conditions (for the risks that have causes external to the business), and a second familiar with the company itself (made up, say, of employees and customers, for the risks with causes internal to the company. We could set up global and regional Prediction Markets for each of the external-source risks, and then tie them into Wisdom of Crowds assessments of the business’ employees and customers for the internal-source risks. By looking at the median and standard deviation assessments for both probability and consequence of each risk, we could place each risk on the chart above for each business, with a tight dark circle representing risks where there is great consensus and a large light circle or oval representing risks where there is considerable divergence of opinion. Both short-term and longer-term risk assessments could be plotted for each type of risk.

Each of the stakeholders in the business — management, employees, customers, investors, suppliers, community members etc. could then use this risk chart to make decisions in its own areas of interest. Customers might be more interested in reputation (#4), supply chain (#6) and innovation (#9) risk for example. Management could focus risk management decisions on upper right quadrant, short-term risks, while institutional investors could focus investment decisions on longer-term risks.

The risk chart could then be the basis for a comprehensive risk management strategy for businesses, using a methodology something like this:

1. Develop a process to continuously reassess the likelihood and potential severity of the risks facing the business.
2. For each risk that is controllable by the business, identify cost-beneficial prevention actions. The costs of these programs should include the costs of over-regulating the business, bureaucracy, and stifling creativity and connectivity by restricting access to new technology.
3. Develop a process to detect early-warning signals of these risks, and a mitigation program to put into effect when they are detected.
4. For all risks, develop an adaptation and recovery plan. For major risks that could arise suddenly, use scenario planning to understand how the risk would likely unfold, train people to know what they should do, and do a ‘table-top’ and other exercises to simulate and practice coping with these risks and increase business resilience.
5. After recovering from an adverse event, assess learnings and review and change the strategy as appropriate.

This is the approach I’m taking when I talk with businesses about environmental sustainability and social and environmental responsibility. Tie environmental sustainability to risks to business sustainability, and social and environmental responsibility to risks to business reputation, business continuity and business resilience.

I’m convinced that business cares about these risks, and is prepared to take steps to manage them, and that, by doing so, they will become more sustainable and responsible. The businesspeople I speak to want to do more, personally, to make the world a better place and to be better corporate citizens, but to justify doing so they need these actions to be couched in business risk, business sustainability and business resilience terms.

I’m not saying that this is all that it will take. Our markets are distorted and far from perfect, and regulation is also needed that equitably forces businesses to reduce their adverse impact on the planet and on the social fabric of the communities in which they operate. What business managers tell me is that, provided the regulation is equitable, enforced evenly, and provides a level playing field for all players in their industry, they don’t have any problem with regulation that will reduce their adverse social and environmental impact. In fact, quietly and off the record, they tell me they’d welcome it.

This means that race-to-the-bottom ‘free’ trade agreements need to be replaced with fair, regulated trade agreements that put people and the environment ahead of profits. We can never achieve a level regulatory and competitive playing field as long as these laws (which irresponsible global corporatists strong-armed weak and gullible governments into signing) encourage offshoring, exploitation, pollution, waste, cost ‘externalization’ and the dumping of toxins in struggling nations.

When the laws are equal, and the risks are equal, we just might find that business becomes more responsible and sustainable than we, its customers, are. Worth dreaming about, anyway.