Managing Risk in the Tail
There are many definitions of risk, with most coming pretty close to each other. Interestingly, most all of these definitions put “risk” well beyond the point of “expected losses” on the actuarial loss curve (see graph below).
Focusing only on the downside of risk for the moment, are expected losses and those that fall to the right of the “expected” loss point really “risks?” If risk is the effect of uncertainty on objectives, then by that definition, “expected losses” would not be materially “uncertain;” they would be “expected” (though not certain).
This dichotomy has perplexed many risk professionals — especially those who lean into the traditional insurable risk realm, as these sources of loss are the primary focus of most of their responsibilities.
All good then, as that is what they were hired to do; a very necessary function for the successful operation of organizations. And yet this may be the one thing that limits the influence and in some cases the upward mobility of many traditional risk managers. After all, senior managers are typically most concerned about the unexpected and uncertain potential for disruption to the organization, its strategy and its plans that defined success.
As one CEO I worked for would say: “tell me what I don’t know.” An understandable interest since the CEO is the ultimate accountable person for the successful achievement of the plan of the organization he or she leads.
It is unlikely that expected losses will prevent the successful execution of operational or strategic plans, assuming these losses have been accounted for in budgets or transferred to others through insurance or contract. Now, budget shortfalls do occur and some claims may not be paid under certain insurance or contract conditions, but these are typically one-off variances that should be well within risk appetite and thus usually wouldn’t prevent accomplishment of most objectives.
So the obvious questions are: 1] how does your organization define risk and is it the definition that all stakeholders understand, agree upon and can manage to; and 2] where on the loss curve do you want to manage risk to?
Other questions might be, for example, do you assign more importance to likelihood or impact? I would suggest they are not of equivalent import and get their relative importance from a well-defined risk strategy, appetite and the risk culture that undergirds it.
Another question that quickly becomes critical is: how far out on the likelihood axis may be relevant to your risk strategy? This is the ultimate question that will define where you focus along the x-axis (likelihood or frequency), where resource needs are, the level of sophistication of tools and techniques necessary to manage risk effectively etc.
I urge you to get your key risk stakeholders together and vet these issues to ensure you have the right priorities and focus for managing risk within your organization. Absent this, you’ll be flying blind along a curve that presents an infinite set of outcomes. Can you afford to fly blind in the face of the potential of catastrophic uncertainty?