Pillars of Risk Management
Risk Management Evolves With the World
I sat down with my team of Risk Management Professionals to brainstorm what this website should look like today and what sections we should include. We talked about AI & Risk, Decision Making, Human Behaviour, Future of Work, Trust, The Science of Risk, The Future Human and Signals.
We all agreed that whilste we want to put a modern take on Risk Management, the fundamental pillars of Risk Management remain crucial. They should never be tossed aside simply because they came before the newest risks.
For those who are new, you can view Risk Management as a way of making uncertainty more understandable. Its tools help individuals, businesses and large organisations see where their risks lie, consider what could affect their objectives, and decide whether they are comfortable taking the next step, in a structured way. Somehow I feel that 'in a structured way' seems like such a passe phrase of Year 2018. So stifling! Let me come up with a more modern and zany way of phrasing it but bear with me in the meantime.
Back to the core of Risk Management: Risk Management is not the “police” telling people or businesses what they cannot do.
This term 'policewoman', I remember the first time when I heard it. We were hired to provide business consulting to a local SME One of the bosses was 'resigned' to doing Risk Management because, as a seasoned industry player, he knew that regulators and investors expected it and sometimes they ask questions and they want to see that as a Business, you know the risks and you have taken steps to address it. Another Director, who had yet to be formally onboarded then, was much more direct with me: “Are you here as a policewoman? Don't talk to me about Risk Management if it doesn't translate into the bottom line. Anything that doesn't translate into the bottom line isn't part of my (his) business strategy.” And subsequently in the group chats, he referred to me as 'The Policewoman'.
Part of me understood him. He was operating in a difficult and competitive industry and was focused on results. I guess I failed to show him where the real value of Risk Management lies. At its best, Risk Management provides structure and clarity. It helps individuals and companies look at a situation from different angles before deciding what to do.
It is a thought process. And in my opinion and my experience, this kind of thought process is better done upfront rather than in hindsight.
As we update this website, this kind of thought remains at its core. The established pillars, which are Technology Risk, Enterprise Risk Management, Cyber Risk, Operational Resilience, Business Continuity, Governance & Compliance, Third-Party Risk, Risk Assessment and the Risk Register remain the fundamentals and foundations from which evolving risks can be examined.
Even when we encounter what appears to be a completely new risk (is there such a thing at an entirely new risk? yes! Covid for example, that took the World by storm), many of the underlying foundations still apply.
These fundamentals give us established ways to identify exposure, examine controls, consider consequences and determine whether a risk is acceptable or whether something more should be done. What has changed also is the speed at which today's world requires Risk Management to respond.
Risk Management Has Always Adapted to Its Time
Risk Management did not begin with a risk register, an ISO standard or a corporate risk department. At its simplest, it grew from the human need to deal with uncertainty: to observe our surroundings, anticipate danger, protect what matters and decide whether the potential benefit of an action justifies taking the risk.
As commerce developed, these instincts became more structured. Maritime trade and insurance introduced ways of sharing and transferring risk. Following World War II, Risk Management increasingly developed as a professional discipline associated with corporate insurance and loss control. Financial and regulatory developments broadened its application, while Enterprise Risk Management encouraged organisations to consider risks across the organisation rather than individually.
International standards and frameworks subsequently provided more structured approaches to managing risk. Yet the underlying purpose remained familiar: understand what you are trying to achieve, identify what could affect it, consider your exposure and controls, and make an informed decision about what to do next.
Never losing 'the basic human instinct to protect' is how Risk Management has evolved historically and naturally alongside society because uncertainty evolves alongside society.
My Journey From Feng Shui to Risk Management
I am Katherinne Kuan, and my own journey into Risk Management has given me a somewhat different perspective on the subject.
I have a strong background in Feng Shui, having won first prize in an international Feng Shui competition. I was the only Singaporean in that competition to win first prize. Feng Shui and Professional Risk Management are different disciplines to many people, but my experience with both has led me to recognise an intriguing connection.
Feng Shui traditionally involves observing our environment, considering how different conditions may affect us, and making adjustments intended to create more favourable circumstances. Risk Management uses its own methods, evidence and professional frameworks, but there is a familiar human instinct underneath both: we examine our circumstances, consider what may affect us, make changes where appropriate and decide what level of uncertainty we are prepared to accept.
The longer that I stayed and moved deeper into the Professional World of Risk Management, the more I think about how my Feng Shui Master phrased it: "When practicing Feng Shui, press down on the bad Stars. Then after that, magnify the good Stars!"
Similarly, risk cannot always be eliminated, nor should eliminating every risk necessarily be the objective. We identify, assess and manage risk so that our remaining exposure is understood and, where appropriate, brought to a level that is acceptable to us.
And “acceptable” matters. Two people or two organisations can look at exactly the same uncertainty and make different decisions because their objectives, circumstances and appetite for risk are different.
Why This Website Now Goes Beyond the Traditional Pillars
This brings us back to the thinking behind the extensive update of this website.
I have shown above that the traditional pillars remain important. Then why did we decide to create separate sections for AI & Risk, Decision Making, Human Behaviour, Future of Work, Trust, The Science of Risk, The Future Human and Signals?
The answer is because these are increasingly the ways people encounter uncertainty today.
A business owner may not begin by googling "Tell me about Enterprise Risk Management". Instead, she would ask, “Should I allow my employees to use AI with company information?”
A Manager may not search for "Operational Risk Management". Instead, he may ask, “Why do my employees keep ignoring this procedure?”
An Entrepreneur may not think to search for "Risk Assessment". Instead, he may simply ask, “Should I expand my business now?”
All of these are Risk Management questions, even when the person asking them does not realise that they are.
Thus, the new sections do not replace Traditional Risk Management. They provide new entry points into it. This is what my team and I hope to give new perspective on. Risk Management is in our everyday lives!
New Questions, Established Foundations
AI & Risk can lead us into Technology Risk, Cyber Risk, Governance, Third-Party Risk and Enterprise Risk. Decision Making takes us into uncertainty, assumptions, risk assessment, opportunity and consequence. Human Behaviour connects with controls, culture, compliance, cyber security and operational risk.
Future of Work brings together people, technology, resilience and continuity. Trust introduces questions about reputation, information integrity, misinformation, governance and digital identity. The Science of Risk helps us understand probability, uncertainty, perception and how people judge risk. The Future Human considers how people may live, work and make decisions alongside increasingly capable technology. Signals encourages us to notice emerging risks and changing conditions before they become immediate problems.
Eventually, many of these questions bring us back to the established pillars.
The Pillars Are Foundations, Not Boundaries
I no longer want this Applied Risk Management website to organise everything around Enterprise Risk, Cyber Risk, Business Continuity, Governance and Risk Registers. For an experienced risk professional, that structure makes perfect sense.
But with the emergence of solopreneurs and nanopreneurs, and also now that Risk Management, Compliance and Governance has been identified as a future skill to have, I want Risk Management to be a way to get answers for anyone encountering a completely new problem.
The individual worried about AI may not know that part of the answer involves third-party risk. The small-business owner worried about losing a key employee may not recognise the problem as operational resilience or business continuity. Someone deciding whether to invest in a new system may not realise that they are already considering risk, opportunity, assumptions and uncertainty.
Through this website, we would like to shed light on Risk Management for both those already familiar with it and those discovering it for the first time.
The traditional pillars provide the foundations and depth. The new areas connect those foundations to the questions people are facing today and may face next.