Why is it difficult to create a risk management system that works? Professor Philip Linsley The University of York

A discussion of specific difficulties in risk management Particularly focusing on risk culture And the ideas of Mary Douglas Cultural theory of risk Neo-Durkheimian institutional theory

Risk management is easy RISK MANAGEMENT SYSTEM Identify any risks that can affect the company Decide which risks are important Manage the important risks Keep checking for new risks

RISK CULTURE Our individual attitudes to risk and risk management Following global financial crisis numerous organisations talk about risk culture

BASIC IDEA OF MARY DOUGLAS Cultural theory of risk proposes: “selective attention to risk …” (Wildavsky & Dake, 1990, p.43)

Foundation of Douglas’ risk ideas Maintenance of stability Each society wishes to ensure that it defends its structure We are social beings Each society wants to defends its particular pattern of social relations

Two dimensions GROUP Degree of commitment to other people in the community Low (weak) group = little commitment to others and your own aims are more important than the aims of the group GRID Amount of social regulation Low (weak) social regulation = free to select your role in society

RESULT IS FOUR OUTCOMES Two dimensions Weak or strong group Weak or strong grid RESULT IS FOUR OUTCOMES 4 Solidarities 4 Worldviews 4 Ways of life 4 Cultures

Grid-group model Fatalist Hierarchy Individualist Egalitarian Increasing grid High or strong Weak or low Weak or low High or strong Adapted from Douglas (1978) Increasing group

Four perspectives on risk management PRAGMATISTS Look to keep options open and adapt strategy as uncertainties arise All risk management systems will eventually be found to be inadequate MANAGERS Careful balancing of risk and reward Preference for comprehensive risk management system MAXIMIZERS Comprehensive risk management systems impede innovation and risk-taking Accept losses may arise but over time profits will more than match losses CONSERVATORS Look to avoid losses Based on judging the world as a very uncertain place Underwood and Ingram 2010

Risk management in the City of London Effects of the 2007-8 financial crisis affecting all lives Project interviews middle ranking bank employees to understand their lived experience Investment banks in City of London

“ Everyone thinks it’s lots … guys getting drunk in the City and just buying ten thousand bottles of champagne. Whenever you see a movie or a TV show or something about The City all the girls are wearing designer clothes … and they’re all going off to parties, which isn’t really the case for ninety percent of the people”.

Examples of problems “The other day we had lost 51 billion out of our portfolio and it had been missing for seven months... we found it was it in our full year results...” “Is it good quality lending, or is it rubbish? Well actually we don’t know because our data isn’t good enough… Part of the reason for the crisis is we don’t actually know what our book looks like”

Risk managers tried to tell their banks but no one listened They were ignored in different ways: Disregard system failures Smooth out risk results Suppress risk concerns Ignored why? Difficult to get risk “taken seriously outside of the risk management department”

Hierarchists versus individualists Fatalist Hierarchy Individualist Egalitarian

Eventually risk managers want to give up trying “cog in the machine” (3.111) a “nameless person in a suit” (5.059) a “commodity of the bank. I’m essentially like a computer or a window or a door” (7.229). “felt like a small unnoticed team … and almost ignored” (4.209) “sidelined a lot of the time” (6.387).

Hierarchists becoming fatalists Hierarchy Individualist Egalitarian

What can we do? Wicked problems and clumsy solutions? The most challenging problems Multi-dimensional and never fully solved Clumsy solutions Recognise the problem is demanding Take into account the four alternative views Not seeking perfect solution

Four perspectives on cyber risk PRAGMATISTS It is a new risk but not in all ways. Throughout time it has been the case that threats can arise and will need reacting to. MANAGERS Technical problem needing expertise, and requiring systems and policies. MAXIMIZERS Digital opportunities may be accompanied by cyber risk but the opportunities are worth pursuing . CONSERVATORS Zero tolerance and constant anxiety whether breaches are about to occur. Underwood and Ingram 2010