Challenges in Applying Risk Management Concepts in Practice: A Perspective

• Author: Nicos A. Scordis,Annette Hofmann
• Date: 01 September 2018
• DOI: http://doi.org/10.1111/rmir.12106
• Published date: 01 September 2018

Risk Management and Insurance Review

C

Risk Management and Insurance Review, 2018, Vol.21, No. 2, 309-333

DOI: 10.1111/rmir.12106

PERSPECTIVE

CHALLENGES IN APPLYING RISK MANAGEMENT

CONCEPTS IN PRACTICE:APERSPECTIVE

Annette Hofmann

Nicos A. Scordis

ABSTRACT

The existing concepts of risk management face challenges when applied in

practice. The perception of risk depends on the observer’s cognitive biases and

worldview, which nuance risk-relateddecisions. How an observer decides also

depends on the metric used to quantify risk. While there is extensive literature

on how people perceive risk, and on how to price risk in relation to the market,

there is little on how to price risk according to how risks interact within the

firm. The article concludes with a suggestion (and includes relevant citations)

for a way forward.

INTRODUCTION

A unique symposium took place in 2004 at the Naval Postgraduate School in Monterey.

The symposium brought together world-renowned explorers who were involved, in a

personal way,with risky endeavors. They examined the meaning of risk.1What is strik-

ing, from reading the transcript of the symposium, is that each of the participants in the

symposium perceived risk in an intensely personal way.2Howwe perceive risk and how

we make risk-related decisions seems to involve answers to a series of related questions

similar to those Kaplan and Garrick (1981) ask to describe risk: What can happen? How

likely is it to happen and when? If it happens, what are the consequences and how long

will they last? How do I feel about the consequences? Slovic et al. (2005) explain that

Annette Hofmann and Nicos A. Scordis are at St. John’s University, The Peter J. Tobin Col-

lege of Business, School of Risk Management, 101 Astor Place, New York, NY 10003; email:

scordisn@stjohns.edu. We would like to thank the editors and two anonymous reviewers for

their helpful comments that have indeed led to an improved version of this article.

1In this article, risk describes an objective distribution of probabilities and consequences. Note that

here risk cannot be interpreted as the product of a probability multiplied by its corresponding

consequence since this implies that in a single scenario, a low-probability-severe-consequence

outcome equates a high-probability-mild-consequence outcome, even though each outcome

creates very different management decisions. Withmultiple possible scenarios, interpreting risk

as the product of probability multiplied by consequence implies that risk is an expected value

without consideration of the other moments of the risk distribution. See also Footnote 19.

2The transcript of the symposium is available at https://history.nasa.gov/SP-4701/

riskandexploration.pdf.

309

310 RISK MANAGEMENT AND INSURANCE REVIEW

indeed we use what we feel about a risk’s consequences as information in making our

decisions about that risk. They refer to the positive or negative feelings the consequences

of risk evoke in us as affect. Affect influences the way we judge probabilities. According

to Slovic et al., when consequences evoke sharp and strong feelings, especially as they

tend to do with unlikely but very consequential events (such as the exceedingly small

possibility of winning a huge lottery jackpot), differences in the probability of events

tend to carry little weight in the way we decide. How we make risky decisions is further

influenced by how much of the upside and/or downside of our decision’s consequences

we are likely to experience. One insight this article offers is that thinking of risk as a

distinct concept from uncertainty3leads to better practical decisions, especially at a time

of crisis.

Making a distinction between risk and uncertainty leads to better practical decisions

because such distinction highlights two points. First, the analysis tools for risk are

different from those for uncertainty. Second, our cognitive biases influence us to behave

differently toward risk than towarduncertainty. The literature supports both a treatment

of risk and uncertainty as distinct concepts and as a single concept.4What is clear from

the literature, however, is that we ought to approach the analysis and management of

risk differently from that of uncertainty. By drawing a distinction we force a judgment

on whether in a peril we confront risk or uncertainty. Such judgment then informs our

choice of management tools.

Take, for example, the emerging peril associated with damage to an organization from

failure of its information technology systems. If this peril is risk, an insurer offering

coverage for this peril has to decide how much of its resources to commit in under-

writing cyber peril so as to maximize net present value. Alternatively, if this peril is

uncertainty, the insurer’s decision is how to maintain operational and strategic flexibility

as it regards this peril in light of competition. Flexibility allows the insurer to learn from

its environment as time unfolds, which allows it to alter a course of action decided on

current knowledge. Indeed, a robust argument can be made that the established dis-

counted cash-flow techniques for valuing risky cash flows do not sufficiently account

for the ramifications of uncertainty in resource-allocation and planning decisions. Thus,

3In this article, uncertainty describes an event embedded in a state of the world where the

scarcity of knowledge permits only the formation of subjective probabilities.Uncertainty is often

classified as aleatory and epistemic. In statistical inference, random variability embeds aleatory

uncertainty in all data. It is commonly argued that aleatory uncertainty cannot be reduced, and

for this reason it is sometimes called irreducible uncertainty. Epistemic uncertainty is associated

with the lack of knowledge about the world. Epistemic uncertainty manifests itself as both

model uncertainty in the hypotheses we assume, and as parameter uncertainty in the poorly

known accuracy of the measurements we take. It is commonly argued that both model and

parameter uncertainties (and less commonly argued, aleatory uncertainty) can be represented

by subjective probability distributions.

4For example, Aven and Renn (2009) classify all perils as risk according to how complex and

ambiguous they are. Thus, they present uncertainty as an attribute of risk. Alternatively, for

Bredmar (2015) it is the process of governance that transforms uncertainty into risk, which

suggests that risk is an attribute of uncertainty.For Brown and Hao (2012), who argue that credit

default swaps are a defective concept because they price future uncertainty as if it were risk,

uncertainty and risk are distinct concepts.