June 15th, 2007 by Chandler Howell

This is not only an interesting risk assessment, but also an excellent approach to explaining risk to people such as business decision makers. The ability to present a compelling argument in the face of lack of data or disagreement with the data is a critical skill for those of us who must explain risks to our businesses.

I have successfully used similar approaches in the past with generally good results. Sometimes, people aren’t going to Do The Right Thing, regardless of the logic, and all you can do is make it clear that they were well-informed before making their wrong decision. That is, of course, what we refer to as “becoming a statistic.”

Watch the video (it’s 9 1/2 minutes). Even if you completely disagree with him, watch him for technique, then I’ve got my post-game after the jump.



I don’t know if our esteemed presenter is trained as an economist, a scientist, or a mathematician (though probably not an economist since he’s suggesting a decision which disses the Invisible Hand ;-) ), but he’s almost certainly taken either a Game Theory or other statistical analysis class somewhere along the way.

Key points here (and which you can use when using this approach with your own risk problems):

1) He has identified the correct axis of his graph to evaluate the risk along. Most people get so focused on the outcomes of each decision that they fail to properly compare the inputs to the decision.

2) He gives equal credence to both extreme outcomes. If anything, he overstates the upside potential of doing nothing. Since it’s not going to affect the logic, there’s no real cost to the argument of doing this and it makes the presenter look more open-minded.

3) He has identified that a key factor to consider is Volatility. He looks at the possible range of outcomes, both good and bad, then recognizes which one has the least potential downside (as well as upside). This is, of course, consistent with Black-Scholes.

4) He identifies the best negative outcome, explains why it is better than the other negative outcome.

5) He (relatively) clearly identifies the costs, opportunity costs, and challenges associated with mitigating the risk, including the new set of risks which must be accepted by choosing to mitigate. He also compares this new set of risks to the original risk which is being mitigated, and still finds it to be the better choice.

6) He does it all with a friendly tone, which is good because I think we’re all FUD’ed out. Even though he’s talking about the potential death of hundreds of millions of people and a global collapse into a Hobbesian nightmare, he never tries to scare the audience. He lets the logic do any scaring that needs to be done and instead sets a tone of empowerment.

All good techniques to not only explain risks to people but also to get them to make the correct decision–and not getting slaughtered in a presentation to management is always good risk management.

(h/t Blah3.com for the video)

- Posted in Security and Risk Management, Risk Management

You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.




- Leave a Reply