3 ms·

Whether we're talking about WMD, Global Warming, overpopulation, terrorism, hackers, or any other issue, people have this bad habit of falling into "Pascal's Wa

Whether we're talking about WMD, Global Warming, overpopulation, terrorism, hackers, or any other issue, people have this bad habit of falling into "Pascal's Wager" type thinking: identify the worst case, and then avoid it at all costs. This leads to expensive and often unnecessary solutions, and it often results in more cost-effective solutions being tabled because they don't particularly touch on the worst case. A better approach to risk management: create a table with likelihood on the vertical axis, and severity of outcome on the horizontal. Then look at the costs to move any given risk either down or to the left. Do some cost-benefit analysis on reducing your overall risk profile, and focus your spending accordingly.

idoh 17y ago
That's not a good approach to risk management because we don't know all of the specific risks. Even if we knew that, we don't know the likelihood of it occurring. Even if we knew that, we don't know the harm that it would cause. Even if we knew that, we don't know how much it would cost to make that risk go away. I think a better approach to risk management is to flip it and think of the key parts of the system, and figure out ways to make the system more robust, have redundancy, and some strategic slack built in.
- Gormo 16y ago
  The fact that we will never know all of the specific risks is an argument against worst-case thinking. No matter how many contingencies you try to account for in your baseline system, there will always be risks that you cannot account for, which will become the new worst case. So, by definition, you can never actually avoid the worst case. (Even if you may end up with a worst-case situation that isn't as damaging as the ones you've accounted for.) But the real solution is to distinguish risk avoidance against risk response. Prescriptive solutions tend to focus on avoiding risks, and building those avoidance methods into the baseline system that applies generally. But if we isolate the unlikely risks in the way that lotharbot suggests, we can draw a line across the likelihood axis and say "we'll avoid the risks on this side of line and deal with the outliers on a case-by-case basis." The best strategic slack is to have a robust way of handling unexpected occurrences after the fact, so you optimize the prescriptive system to the expected general case. BTW, I'd bet there's a pretty strong correlation between "risks that we can't account for" and "risks that are unlikely to occur".

idoh 17y ago

That's not a good approach to risk management because we don't know all of the specific risks. Even if we knew that, we don't know the likelihood of it occurring. Even if we knew that, we don't know the harm that it would cause. Even if we knew that, we don't know how much it would cost to make that risk go away. I think a better approach to risk management is to flip it and think of the key parts of the system, and figure out ways to make the system more robust, have redundancy, and some strategic slack built in.

Gormo 16y ago
The fact that we will never know all of the specific risks is an argument against worst-case thinking. No matter how many contingencies you try to account for in your baseline system, there will always be risks that you cannot account for, which will become the new worst case. So, by definition, you can never actually avoid the worst case. (Even if you may end up with a worst-case situation that isn't as damaging as the ones you've accounted for.) But the real solution is to distinguish risk avoidance against risk response. Prescriptive solutions tend to focus on avoiding risks, and building those avoidance methods into the baseline system that applies generally. But if we isolate the unlikely risks in the way that lotharbot suggests, we can draw a line across the likelihood axis and say "we'll avoid the risks on this side of line and deal with the outliers on a case-by-case basis." The best strategic slack is to have a robust way of handling unexpected occurrences after the fact, so you optimize the prescriptive system to the expected general case. BTW, I'd bet there's a pretty strong correlation between "risks that we can't account for" and "risks that are unlikely to occur".