Individuals perceive risks in markedly different ways. One person may consider a risk to be critical, while another could consider it inconsequential. Often rooted in psychology, these differences in risk perception can create challenges for risk professionals, especially when designing and implementing an effective risk management program. After all, if the program is focused on the wrong risks from the outset, the consequences to the organization could be dire. It is therefore critical for risk professionals to understand the psychological aspects of risk perception and develop techniques to address the resulting challenges.
The Effect of Heuristics and Biases
Our reaction to risks can be traced to early humans, who were either the hunter or the hunted and responded to danger by fighting or fleeing. Our ancestors’ survival depended on responding quickly and correctly. A part of the brain—the amygdala—helped humans’ survival by bypassing cognitive processes and initiating immediate responses. Today, we generally have the time to obtain information, analyze risks and develop a reasoned response. Yet we still seem to let our innate reactive-mode override our cognitive thinking.
Many factors impair our ability to develop an accurate assessment of risks. Chief among these are heuristics and biases, which can overtake reasoned analyses and decisions. Heuristics are practical problem-solving methods that serve as shortcuts in our cognitive thinking, influenced by our life experiences. Heuristics are important to consider because they may cause us to arrive at erroneous conclusions. Instead of stepping from A to B to C to D, heuristics allow us to jump directly from A to D. If the current situation is aligned to the foundation of our heuristic, this is good because the heuristic saves us time. However, if information in steps B or C indicate a different path, jumping from A to D can result in a completely different and wrong conclusion.
Biases impact heuristic thought processes and have a major impact on how we identify, analyze and evaluate risks. Important biases in risk perception include:
Anchoring bias. Our thinking is influenced by the first relevant data point we encounter when considering any situation. For example, if we are purchasing a used vehicle, the first person to offer a price establishes a range of reasonable prices in everyone’s minds, anchored around the first stated value.
Availability bias. People tend to make judgements and decisions based on new, recent or dramatic information. Our memories fade quickly and the significance of what happened two years ago pales in contrast with what we read in daily—or hourly—news feeds. In our always-on social media lives, the dual effect of availability and anchoring poses a dangerous combination. Early reports of events can be fraught with inaccuracies, which are generally corrected later. The anchoring effect of the early news, however, can overpower the later, accurate—and perhaps less dramatic—information.
Confirmation bias. People also tend to believe information that supports our position or preconceptions and discount other data, regardless of how accurate or relevant it is. In his book The Black Swan, Nassim Nicholas Taleb noted, “We will tend to more easily remember those facts from our past that fit a narrative, while we tend to neglect others that do not appear to play a causal role.”
Conservatism bias. Unlike the availability bias, we may also tend to discount new data or evidence in favor of knowledge we have obtained over time. Consumer companies, for example, are often slow to recognize and adapt to changing consumer preferences.
Information bias. Many individuals and organizations seek more and more information about a situation even though the additional information will not affect decisions on how to act or react.
Other Factors Influencing Risk Perception
In addition to biases, a number of other factors also affect the way we perceive and deal with risks. One of the most important is experience and familiarity. If we do not have first-hand knowledge of a risk, we tend to discount both the likelihood that it will materialize and its possible consequences. This factor is two-sided: On one hand, having direct experience with a risk makes it seem more likely; on the other hand, constant exposure to a risk makes it so familiar that we often discount the consequences, perhaps because we have adapted to living with it.
Another factor is time relevancy. We tend to magnify the importance of risks that have occurred recently, compared to risks that have not occurred for some time. For example, after the September 11 terrorist attacks, aviation safety and security was paramount, and significant measures were implemented to secure air travel that remain in place to this day. Terrorists are just as likely, if not more so, to attack other modes of transportation or public gathering locations such as shopping malls and sports venues, however.
Control also impacts risk perception. People tend to discount risks if they feel in control of the situations exposing them to those risks. As David Ropeik points out in his book How Risky Is It, Really?, we believe that it is safer to drive than fly to a distant location, yet statistics show it is much more likely for a traveler to die in a traffic accident. A similar situation exists for the risk of being distracted using a mobile phone while driving: Hands-free technology is considered a viable risk reduction technique because the driver does not hold a physical handset while driving, yet research indicates that the real risk is the mental distraction of talking with someone and processing information not relevant to operating a vehicle.
Putting a face to a risk and its consequence also has an outsized effect on perception of a risk. Notice how the American Society for the Prevention of Cruelty to Animals (ASPCA) and humanitarian aid organizations use this to influence our contributions. Heart-wrenching images of neglected animals and malnourished children stir our emotions and drive us to donate.
Weighing downside risks versus benefits is another important consideration. When looking at the pros and cons of a decision and considering the risks, people often discount downside risk consequences in inverse proportion to the perceived upsides or benefits. The greater the upside, the more they discount the likelihood that the downside risk will occur. This phenomenon is evidenced in many failed acquisitions where the expected benefits never materialize.
Risks like automobile accidents and workplace safety incidents have rich historical data sets that lend themselves to mathematical modeling and projections of future occurrences. Advanced software can perform sophisticated calculations to estimate the “level of risk” based on likelihood and consequence curves. However, for many business-level risks, scant data exists to determine curves that realistically model likelihood and consequence. Yet many executives rely on calculated “value-at-risk” figures to make strategic and tactical business decisions. Running thousands of calculations using Monte Carlo techniques implies accuracy and validity, yet the inputs used for likelihood and consequence can be unrealistic.
Techniques to Compensate
Despite the seemingly insurmountable challenges to determine an accurate accounting of risks and risk levels, there are some relatively simple techniques that can be used to provide a counterbalance. Remember that risk management is a journey, and programs should improve over time. Incorporating one or more of the following techniques will help move toward more accurate risk identification, analysis and evaluation.
Use calibration exercises. In his book The Failure of Risk Management, Douglas Hubbard discusses using calibration exercises prior to a risk identification session to guide individuals’ estimates of risk likelihood and consequence. People are generally overconfident in their abilities, and calibration exercises provide a dose of reality. Subsequent risk identification and analyses are usually more realistic and accurate following calibration sessions.
Adjust likelihood and consequence scales. Many risk management programs determine risk levels by combining estimates of likelihood of occurrence and magnitude of consequence. Simple techniques like adding or multiplying the ratings together are often used, and then a scheme is derived to decide thresholds for risk significance. An observed shortcoming of this approach is that low-likelihood but high-consequence risks are overlooked. Yet it is precisely these risks that significantly harm organizations. A useful counterbalance is to place more weight on the consequence scale compared to the likelihood scale to maintain the visibility of lower-likelihood but higher-consequence risks.
Ask the same question multiple ways. As discussed earlier, heuristics and biases impact the way we perceive risks and risk levels. Our thought processes are affected by the wording and presentation of a question or scenario. Employing a technique that solicits information about potential risks using differing language or contexts can help detect variances in risk perception and guide follow-up work to determine more accurate information. Well-constructed risk surveys often employ this technique to great advantage.
Ask the same question of multiple people. Similar to asking the same question multiple ways, presenting questions to multiple people highlights disparities in risk perception. Risk surveys can be sent to people from different parts of an organization and the results analyzed to detect wide variances in risk perception. For example, higher up the leadership chain, views of risks tend to focus on longer-term strategic risks, while those in the lower- to mid-levels focus on more operational and tactical risks. Similarly, individuals in different functional areas will frequently view risks and risk levels differently based on their individual heuristics and biases. This does not mean one is right and the other wrong. Rather, it highlights the necessity and usefulness of considering multiple factors in identifying significant risks.
Ask the same question at different times. Current events and work issues affect thought processes. If a risk survey or other risk identification process is conducted at roughly the same time every year, results will skew risks to those that are most front-of-mind at that time. For example, if risk assessments are conducted around strategic planning time, longer-term strategic risks will appear more important. If assessments are conducted during heavy manufacturing periods, such as an inventory build-up for holiday sales, manufacturing capacity and supply chain risks will seem more important. To counter these tendencies, conduct risk assessments at varying times during the year.
Ensure the risk management process is continuous. Risks are dynamic and a risk management program should be as well. Building on the technique above, multiple risk identification processes and frequencies should be used and should be time-independent. Emerging risks do not wait for regularly scheduled risk assessment workshops. Use multiple risk sensing platforms to identify new risks and detect the onset of a known risk. Well-defined risk indicators accompanied by robust data acquisition and analytics are useful for this purpose. Every organization has a unique operating structure and rhythm, and risk management processes benefit by aligning to these. Maintaining a real-time or near-time focus on risks and risk treatment helps limit the potential that a critical risk will be missed or not addressed.
Use technology to help. Technological solutions are valuable in managing risk information, acquiring and analyzing risk data, and automating information flows and decisions. A key benefit is the ability to remove psychological and emotional influences in processing risk data. Advances in artificial intelligence and data analytics can provide cost effective and valuable insight into risk environments and emerging risks. And risk management software platforms can aggregate risks, automate risk assessments, and track risk treatment actions.
Developing, implementing and evolving a risk management program is challenging at best. Psychological influences on risk perception can negatively impact the validity and focus of risk mitigation measures included in a program. Understanding these influences and integrating methods to compensate for them can substantially improve the effectiveness and value of any risk management initiative.