This series the second post in our series on evaluating and managing risk. In this post we will discuss a methodology for assessing and managing risk. We are going to look at strategic planning and risk management today. For strategic planning we will specifically examine SWOT analysis. For risk management we will use the US Army Risk Management model. I was going to do these the other way speaking more about risk management specifically first. The reason I am not is that logically one could use some kind of strategic planning method to get the big picture then use risk management to drill down into that piece. I think these two methods could complement each other well.
First we will look at SWOT (Strengths, Weaknesses, Opportunities and Threats) analysis. This is a strategic planning technique, predominantly used in business, to see how different factors will aid and hinder in reaching organizational objectives.
This handy chart is used for SWOT analysis. The first column (vertical) is factors that are helpful and the second column is harmful. The top row (horizontal) is internal and the lower one is external.
The goals of SWOT are easily captured in another handy chart.
Using SWOT we want to match our strengths against opportunities while minimizing our weaknesses and avoiding threats. It is also a good way to look at whether our unique situation is well suited for the goal/ mission. An opportunity I am well suited to take advantage of might not work for our buddy Zero and conversely an opportunity that would be perfect for him might not work for me. I am not going to write a lot more about this because while I have worked with it in school I haven’t really used it professionally so my experience is a bit thin. I would rather toss out the ideas and yet you, if you want, do your own research than unintentionally send you down the wrong path.
Next we will look at the US Army Risk Management model. I will use this model because it is the one I am the most familiar with. Some folks in the blogosphere have written about it but honestly I don’t think they had any actual experience with it and thus their articles were a rewording of some overview they found on google. Not saying they were wrong but simply that their discussions lacked the experience that comes from practical implementation of the topic.
Risk Management has 5 steps:
Develop Controls and Make Risk Decisions
Supervise and Evaluate
Core Principles of RM are:
Risk management should be integrated into all activities. This is important because the actually risky stuff is typically related to boring day to day things in part because we do them so frequently. Complacency is a serious problem.
Accept no unnecessary risk. We should try to mitigate as much risk as is practical.
Apply the RM process cyclically and continuously
To expand on the core steps. We will also do a walk through Risk Management for an event. We will do riding a motorcycle.
Identify Hazards: Taking a step back one might say “The hazards of what?” I would reply with “Your life.”
We need to apply the RM model generally to our lives to see what all could go wrong resulting in injury, death, loss/ damage of equipment or any other negative consequences such as financial loss (including the opportunity cost of an action). I would submit to you that a general assessment for your life is important. Additionally you could apply the RM process to specific events such as a trip or activity.
So we have to identify hazards for our life. Experience would show that a normal person has risks of injury while operating/ traveling in motor vehicles, risk of injury doing certain jobs/ tasks, risk of criminal actions, risk of natural disasters, etc plus of course pandemics, foreign invasions, grid down TEOTWAWKI collapses, Zombies, etc.
I would say that a big mistake people make is by arbitrarily narrowing the hazards they choose to assess. They tend to do this by drawing some magical line between normal life shit and ‘preparedness’. I recall a very famous survivalist who mentioned keeping a spare computer for the family hauler in a tin foil package in the trunk in case of am EMP but didn’t carry a concealed handgun! Not naming names but he entirely missed the point. I believe this was in part because he looked at preparedness or its less politically correct, maybe more racist, cousin survivalism as some discrete thing for extreme unlikely situations.
We need to look holistically at identifying the hazards that might impact our lives.
To our scenario. The hazards of riding a motorcycle would be accidents or getting run over by a car.
Next we will Assess Hazards.
We want to rank hazards in terms of its probability and severity.
Getting really precise we could define what all of these terms mean. That is a fine idea but inherently subjective. In any case making an honest effort to be as objective as possible is a good start.
It is important to be really brutally honest about probability. Especially for prepper/ survivalists we tend to grossly inflate the probability of certain events because it justifies doing things we want to do. Looking at actual data on how often a certain event happens helps here. For instance this spring there is a high likelihood of a bad tornado somewhere in the greater Texas to Alabama up through the Midwest tornado section of the country. It’s almost a certainty that inside of a 50 mile radius of my residence there will be a legit full on home invasion within 7 days of writing this. On the other hand we haven’t had a lot of foreign invasions of the US or EMP attacks lately.
To say this again PROBABILITY NEEDS TO BE ASSESSED BASED ON ACTUAL EVENTS.
We assess all of the hazards identified in step one on the matrix in step 2.
After our risks are assessed by considering their probability and severity we can rank order them. A quick look at the table above shows that even catastrophic events with an unlikely probability get balanced out to medium risk.
I will then look to execute the next steps working on the highest risks and down from there.
To our scenario the probability of us getting in an accident as a brand new motorcycle rider is frequent. The severity is catastrophic. The end result is that it is extremely high risk. The probability of us getting run over by a car who isn’t paying attention is occasional and the risk is catastrophic so the end result is high.
This is with saying again FOCUS ON THE EVENTS WITH THE HIGHEST OVERALL (residual) RISK NOT JUST THE HIGHEST SEVERITY. Yes a multigenerational TEOTWAWKI rapist cannibal grid down pandemic collapse would be really bad but since that has never happened before the odds are almost zero that it will happen in our lifetimes. Events like financial problems, medical problems, crime and natural disasters are far more likely to actually impact your life.
Next we will develop controls and make risk decisions. The fundamental purpose of this 2 part step is to see if we can lower the risks of the activity to an acceptable level where the benefits of the activity outweigh the risks.
Developing controls focuses on limiting risks. We seek to eliminate or minimize the risks identified previously.
For our scenario. Riding a motorcycle is risky so taking the appropriate classes then practicing for awhile on a smaller motorcycle and wearing proper PPE will help mitigate that risk to a lower residual risk. We also get a bright orange vest and always have our light on so people see us as much as possible. Next comes making risk decisions. You (or your wife) might decide that maybe getting a smaller motorcycle that is slower and easier to control and drive it for some time. Or maybe the wife recommends you pursue a different midlife crisis hobby like 3 gun, offshore fishing or whatever.
Implementing Controls: If you decided to buy and ride the motorcycle anyway the controls would be taking the motorcycle safety course and actually wearing the PPE identified previously for your motorcycle riding. EVERY TIME, EVEN WHEN IT IS HOT. Your wife, who is pissed you want a stupid dangerous motorcycle, might help manage this by reminding you that no, you can’t wear shorts and flip flops because the sun is out.
Supervise and Evaluate: Does anything else need to be done? Maybe it is time to take the advanced rider class. Are the controls working? Maybe you learn more (or new technology appears) and you should upgrade your PPE to that good new helmet or buy better gloves.
This methodology works for managing risk. It is however, contrary to what we say, more about mitigating the risk of the thing we are going to do anyway. The focus on the mission is key for the Army but applies less as civilians. What is an acceptable casualty ratio for your 4 person family? The answer should be zero. So applying this methodology to civilian life the mission is usually to keep on living. So very often the answer is simply, don’t do that risky thing!
I think in closing it is worth rehashing that realistic non ‘sexy’ risks is probably more important. Looking at my life and those of people I actually know it is far, far more likely that you will have an emergency which requires the application of a thousand dollars from your savings account than one that requires an M4 carbine.
Preppers and survivalists screw this up because they tend to focus overly on very unlikely events and have gaping weaknesses in much more likely areas.
Fitness is a huge one. I know a couple of folks who have serious and awesome preparations but are grossly overweight. One couple does amazing things and legitimately grows a huge amount of their food. They harvests and stores their own seeds and do all kinds of amazing stuff. However their family is morbidly obese and half are diabetic! Another couple I saw on one of those TV shows has done some amazing things including learning (well in reality they probably have a group language like kids do as I doubt their self-taught Tagalog would actually worth with natives speakers) another language to communicate around people but are fat as shit.
People put in all this effort and expense to prepare but couldn’t run a mile or lift their body over an obstacle like a fence or wall to save their lives! I’m not saying you need to be superman but you shouldn’t be the Pillsbury doughboy either!
So this is part 2 of this series. This is really the main course of it. The rest will be more about applying these methods. Also we are going to look at how to implement an intentional conditions based approach to preparing for a certain type of event. Then we will wrap it all up.