The Science of Risk

What Is Really Happening When We Say Something Is “Risky”?

Risk Management gives us practical ways to deal with uncertainty. The Science of Risk takes us underneath those tools to understand how risk is measured, perceived, connected and judged.

How do we decide that something is likely or unlikely? Why can two people look at exactly the same situation and see completely different levels of risk? What does a risk score really tell us? Why do we sometimes worry about unlikely dangers while becoming comfortable with risks we face every day? And what happens when several small risks interact and create something much bigger?

These questions take us beyond simply completing a risk assessment. They help us understand the thinking behind risk itself.

This is where we explore probability and risk, risk perception, risk matrices, risk appetite, inherent and residual risk, systems thinking, Black Swans and Grey Rhinos, complexity and uncertainty.

How Does The Science of Risk Relate to the Pillars of Risk Management?

The relationship is very close.

Many of the subjects in The Science of Risk are already used within the established Pillars of Risk Management. They are not competing theories or alternatives to traditional risk management. In many cases, they are concepts and tools that help the pillars work.

For example, when we conduct a Risk Assessment, we may consider how likely something is to happen and how serious the consequences could be. We may use a risk matrix to organise that judgement. When we examine controls, we may distinguish between inherent risk and the residual risk remaining after those controls are considered. We then ask whether the remaining exposure is acceptable, which brings us to risk appetite.

The results may be documented in a Risk Register, monitored through Enterprise Risk Management, or applied to specific areas such as Technology Risk, Cyber Risk, Business Continuity, Third-Party Risk and Operational Resilience.

So these ideas are interconnected:

Uncertainty to Risk to Likelihood & Consequence to Risk Assessment to Controls to Residual Risk to Risk Appetite to Decision

They are different parts of the same Risk Management conversation.

If These Concepts Already Belong to Risk Management, Why Give Them Their Own Section?

Because here we go one level deeper.

Under the Pillars of Risk Management, the focus is primarily practical:

How do we identify, assess, manage, monitor and communicate risk?

Under The Science of Risk, we ask what is happening underneath that process:

How reliable is our judgement? What do we really mean by “likely”? Is likelihood the same as probability? Why do people perceive the same risk differently? What does a risk score actually mean? How do we know how much risk is acceptable? What happens when risks are interconnected? And where do our familiar tools have limitations?

The subject has not changed.

The depth of the question has.

For someone completely new to risk management, this section helps make the terminology understandable. A risk matrix, for example, is essentially a structured way of considering “How likely is this?” together with “How serious could it be?” Risk appetite asks “How much risk are we prepared to accept?” Inherent and residual risk help us understand the exposure before and after controls are considered.

For someone already familiar with risk management, those same concepts lead to deeper questions. How reliable is a 5×5 risk matrix? Can two very different risks receive the same score? Where did our likelihood estimate come from? How do we determine risk appetite in practice? What happens when historical data tells us very little about what might happen next?

So the concepts remain the same. We simply explore them at different depths.

Probability Is Useful, but What Does the Number Really Mean?

Probability gives us a way of thinking about uncertain events.

Sometimes we have large amounts of reliable historical data. At other times, we have very little information, circumstances are changing, or the event we are considering has rarely happened before.

Yet a number can still look impressively precise.

This is why we need to understand the difference between probability, possibility and likelihood.

If someone tells us there is a 10% chance of something happening, a useful risk question is:

“Where did that 10% come from?”

Was it calculated from reliable data? Estimated from experience? Based on a model? Or was it simply someone's judgement expressed as a number?

The purpose is not to turn everybody into a statistician or actuarial. It is to understand how much confidence we should place in the information we are using to make a decision.

The Risk Matrix: Useful, but Not a Crystal Ball

The risk matrix is one of the most familiar tools in Risk Management.

It commonly combines likelihood and consequence to help us compare and prioritise risks. It is visual, practical and relatively easy to communicate.

But a risk matrix does not calculate the future.

The categories we choose matter. The quality of our information matters. Human judgement matters. Two people may assess the same risk differently, and two very different risks can sometimes end up with similar scores.

This is why the risk matrix belongs both within traditional Risk Assessment and within The Science of Risk.

In Risk Assessment, we learn how to use it.

Here, we also ask what it tells us, what it does not tell us and when we may need to look beyond it.

Risk Appetite: How Much Risk Are We Prepared to Take?

Risk appetite is also firmly established within risk management, particularly Enterprise Risk Management and Governance.

Organisations do not exist simply to avoid risk.

Starting a business involves risk. Expanding involves risk. Hiring involves risk. Investing involves risk. Adopting new technology involves risk. Even deciding to do nothing can create risk.

Risk appetite therefore asks an important question:

How much risk are we prepared to accept in pursuit of what we are trying to achieve?

This is where risk and opportunity meet.

The deeper questions are equally important. Does everybody interpret “low risk appetite” in the same way? Does the organisation actually behave according to the appetite it declares? How does a broad statement translate into a real decision?

Again, The Science of Risk does not replace the traditional concept of risk appetite.

It helps us understand what the concept means when we actually have to use it.

Risk Is Not Only Mathematics—People Perceive It

Two people can be given the same information and reach very different conclusions about whether something is risky.

Why?

Because human beings do not experience risk purely as numbers.

We can be influenced by familiarity, experience, control, fear, recent events and how information is presented. A dramatic but unlikely event may frighten us more than a familiar risk that is statistically more significant.

This is risk perception.

It connects with our separate Human Behaviour section, but its purpose here is different. Under Human Behaviour, we explore how people behave around risk. Here, we examine how human judgement affects the way risk itself is understood and assessed.

This matters because many risk assessments ultimately contain an element of human judgement.

What Happens When Risks Are Connected?

Risk registers often encourage us to organise risks into individual rows.

Risk A. Risk B. Risk C.

The real world is rarely so tidy.

A supplier failure can create an operational problem. That can affect customers. Customer problems can damage reputation. The disruption can create financial pressure. Management attention may then be diverted from something else.

One event has travelled through a system.

This is where systems thinking becomes important.

Instead of asking only:

“What is the risk?”

we also ask:

“What is this connected to?”

This opens the discussion to dependencies, feedback loops, network effects, tipping points, resilience engineering, adaptive systems and complexity science.

These ideas complement traditional risk management by helping us see relationships that may be difficult to capture when risks are examined individually.

Complexity: When Cause and Effect Are Not So Simple

Sometimes we can reasonably understand what caused an event and what its consequences are likely to be.

Sometimes we cannot.

Organisations, economies, technologies, supply chains and societies are complex systems. Many different participants interact, adapt and respond to one another.

A small change can sometimes have almost no effect. Another seemingly small change can trigger a much larger consequence.

This is where complexity and uncertainty challenge some of the neatness we naturally want from risk-management tools.

They do not make those tools useless.

They remind us that the map is not the territory. A risk register, matrix or model is a representation of the situation—not the situation itself.

Black Swans, Grey Rhinos and the Risks We Struggle to See

The Science of Risk also gives us different ways of thinking about what might happen.

A Black Swan draws attention to rare, highly consequential events that are extremely difficult to predict and are often explained much more neatly after they happen.

A Grey Rhino describes something very different: a large and visible threat that we can see approaching but may still fail to address.

There are also known unknowns, fat-tail risks and low-probability/high-consequence events.

These concepts encourage us to ask whether our normal methods of identifying and prioritising risks are sufficient for every situation.

Sometimes they will be.

Sometimes we need to widen the lens.

Does The Science of Risk Support or Challenge Traditional Risk Management?

It does both which is why why this section matters.

Probability, risk matrices, risk appetite, inherent and residual risk are already deeply connected to traditional risk-management practice.

Systems thinking and resilience thinking can strengthen that practice by helping us understand dependencies and how systems behave under stress.

Complexity science, risk perception and research into the limitations of risk matrices can sometimes challenge assumptions behind conventional methods.

That challenge should not be seen as a conflict.

A tool can be useful without being perfect.

A risk matrix can help us structure a conversation without being able to predict the future. A probability can inform a decision without providing certainty. A risk appetite can guide an organisation without eliminating judgement.

The Science of Risk helps us know when to use our tools and when to question them.

What We Will Explore in The Science of Risk

We have divided The Science of Risk into eight areas.

Probability & Risk explores probability, likelihood, possibility and how we reason about uncertain events.

Risk Perception examines why people can see and experience the same risk differently.

Risk Matrix explores how one of risk management's most familiar tools works, what it can tell us and where its limitations lie.

Risk Appetite looks at how much risk we are prepared to accept while pursuing an objective.

Inherent vs Residual Risk examines our exposure before and after controls or treatments are considered.

Systems Thinking helps us look beyond individual risks to understand connections, dependencies and consequences across a wider system.

Black Swans & Grey Rhinos examines both difficult-to-predict events and significant threats that may be visible but insufficiently addressed.

Complexity & Uncertainty explores what happens when interconnected and adaptive systems make the future difficult to understand through simple cause-and-effect thinking.

We will also draw, where useful, on ideas from complexity science, game theory, network effects, tipping points, resilience engineering and adaptive systems.

The objective is not to make Risk Management unnecessarily academic.

It is to become better at understanding what our risk tools are actually telling us.

Questions We Will Be Exploring

Throughout The Science of Risk, we will explore questions including:

• What Is Risk?

• What Is Uncertainty?

• Risk vs Uncertainty: What's the Difference?

• How Do We Measure Risk?

• What Is Probability?

• Probability vs Possibility

• Likelihood vs Probability

• What Is Risk Exposure?

• What Is a Risk Matrix?

• Do Risk Matrices Really Work?

• What Is Risk Appetite?

• Risk Appetite vs Risk Tolerance

• Inherent Risk vs Residual Risk

• What Is Expected Value?

• What Is Risk Perception?

• Why Are We Afraid of Some Risks but Ignore Others?

• What Is a Black Swan?

• What Is a Grey Rhino?

• What Is a Known Unknown?

• What Is a Fat-Tail Risk?

• What Is Systems Thinking?

• Why Do Small Problems Sometimes Become Big Problems?

• Correlation vs Causation

• How Do You Think About Very Unlikely but Serious Events?

• Can Risk Ever Be Zero?

The Pillars of Risk Management give us established ways to manage risk. The Science of Risk helps us understand the thinking underneath them, e.g. how risk is measured, perceived, connected and judged, and where our tools can help us most.