When I flew in the RAF as a fighter pilot, I was very familiar with ‘flight safety’, but if you’d asked more generally about concepts like risk management and safety culture, I’m not sure I would have been particularly articulate. And after setting up my consulting business, Mission Excellence, our focus was on more general aspects of team and organisational effectiveness. It wasn’t until some clients started asking us to do work more focused on high-risk environments that I started to deconstruct my previous experience from that perspective.
Part of the reason for my own lack of awareness as to exactly how much I knew would have been because the RAF’s thinking on the subject would have been somewhat less advanced in my time than it is now. However, another major factor was that risk and safety were not really separated out from high-performance or the pursuit of operational excellence. Managing risk and safety were simply what you did; they were not an exercise in compliance or something which was outsourced to another department. They were the day job; if a task couldn’t be done safely, it couldn’t be done.
The Nature of the Risk
In order to be able to be effective in a high-risk environment, it is important to understand the nature of the problem. If you are working within an entirely closed system, then it is largely possible to systemise the risk out. If your team’s task is making coffee in a coffee shop, then give them a process and a checklist, plus a troubleshooting guide for any problems and they pretty much have everything they need.
You can apply this closed system / process / control approach to some surprisingly complicated scenarios. If one considers how statistically safe flying is, it could be argued that the airlines have largely systemised the risk out of it. Pilots operate aircraft in an environment where there is a process for almost every scenario they might face.
However, as you become ever more exposed to factors outside your control, the number of possible scenarios you might encounter multiplies exponentially. If you are operating military fighter aircraft, conducting open heart surgery, drilling for oil or investing in stock markets, it would be deeply irrational to think that we can systemise the risk out of those operations. There are too many variables at play, sometimes correlated in ways which might not be immediately obvious.
Despite organisations’ preference for the illusion of ‘systematic control’ and the pursuit of zero adverse events, these goals can never be achieved. The best you can do is to accept the limits of process and control, and equip and empower individuals and teams with the guiding principles and decision-making skills for the unique never-seen-before situations, or combinations of circumstances, which they will come up against. No major risk event is ever a carbon copy of the last one; the solution can only be cultural.
The Science of Managing Risk
I am not for a second minimising the importance of regulation, compliance and process. Even in an environment which is highly reactive to competitors, the economy, nature or other complex variables, your core operating procedures still form the bedrock of any successful approach.
Regulation is what it is; it defines the hard boundaries beyond which we can never operate, other than in the most exceptional circumstances. Processes are the softer boundaries – the default approach distilled over many years of hard-won experience which defines current best practice. It should be noticed that defining process is not something which makes us inflexible; it frees up our brainpower for the clever stuff. We are not constantly reinventing the wheel for standard or repeated tasks.
The Art of Managing Risk
The leap of faith is equipping and empowering people to deal with issues not covered by the rules or processes. This comes down to a number of things:
- Human factors: Understanding the frailties of the body and mind and the impact of biases, communication and decision-making styles on the quality of our decisions.
- Operational excellence: It is important to note in this context that managing risk is a means, not an end. It is a very important constraint but is not in itself the end goal. If that is the case, then stay in bed – take no risk. Managing risk will not necessarily define what we do, but how we do it and should be a natural by-product of the pursuit of operational excellence. Factors like contingency planning, dynamic risk assessment and a culture of learning are highly relevant.
- Leadership: As with most cultural issues, there is no bigger lever you can pull than leadership, in particular role modelling and consequence management. What senior people do, matters.
The science of managing risk will save you 95% of the time. But that once-in-a-lifetime event for which there is no science, will destroy more lives and shareholder value than 20 years of incremental improvement. Only culture will prevent that happening.
