In this From the Archives piece first published in November 2015, operational risk professional, Ravi Gupta, looks at how to use both deductive and inductive reasoning to create a list of plausible risks to the enterprise, with a step-by-step guide on how to approach each method.
In my previous article, ‘Making sense of uncertainty’ (The Risk Universe Issue 40), I explored the structure and critical pieces of the jigsaw that is risk. For a leader, the follow-up question is “what kind of uncertainty should I reasonably expect and prepare for during strategic planning and execution?” This column proposes a structured and logical approach that could be used to consciously explore the various risks to the enterprise.
A list of plausible risk events can be derived through a combination of ‘deductive’ and ‘inductive’ reasoning. Deductive reasoning begins with simple assumptions, narrowing them down into a more specific hypothesis based on observations and finally confirming the hypothesis through testing. Inductive reasoning begins with specific observations and events, followed by detecting patterns, formulating a tentative hypothesis for exploration and finally, developing general conclusions or theories.
DEDUCTIVE REASONING – ASSESSING STRATEGIC AND TACTICAL ENVIRONMENT
The design and delivery of the tactical environment is rarely, if ever, perfectly aligned to the demands of the strategic environment – and mismatches can lead to risk events. Deductive reasoning can be used to identify potential mismatches and thus plausible risk events, potentially including those ‘black swans’.
There are two areas of uncertainty that matter for any enterprise:
Failure to achieve the objective(s)
- Primary objectives and plans, designed without sufficient due diligence on resources, processes and platforms, are more than likely to fail.
- Unfulfilled objectives happen when previously adequate tactical drivers become inadequate in the changing strategic environment or when one or more tactical drivers change too rapidly compared to the needs of the strategic environment.
Harm’ to any of the constituents which might jeopardise the objective(s)
- Undue ‘harm’ to the customer or market-place or breach of some regulation. This will be an effect of the objective itself or steps taken to achieve it, identifiable only through genuine effort to explore.
- Undue ‘harm’ to internal resources or the platform.
Each enterprise, depending on its specific structure, market and regulations, has its own flavour of these two types of uncertainties. Periodically test, prioritise and narrow-down these uncertainties to a list of plausible primary risk events for your enterprise:
Evaluate strategic and tactical drivers for your primary objectives for current and future alignment. This helps predict (or rule out) the potential for failing to achieve the objectives.
- Identify the list of potential ‘undue harm’ that could befall any of the constituents engaged with and related to your enterprise. Both internal and external information is required to explore all potential risk events.
- Evaluate the adequacy of management and controls to detect and/or mitigate the risk events being hypothesised.
- Evaluate financial and reputational (for example, goodwill) capacity to absorb the consequences if the risk events were to materialise.
Since the deductive reasoning begins with making wide-ranging assumptions, control in the process is important to avoid a costly navel-gazing exercise. As the list of plausible risk events is evaluated and built, it will be beneficial to:
- Prioritise the drivers – strategic and tactical – that are most relevant to the enterprise and its immediate objectives.
- Prioritise the risk events by their expected impact – financial and reputational.
- When testing adequacy of the management, controls and financial and reputational capacity, evaluate these for their current state as well as direction of their travel.
Deductive reasoning suffers from one potential drawback – it relies heavily on the initial premise. Hence, there is a good case for leveraging subject matter expertise. SMEs can also shorten much of the evaluation process. However a note of caution – any unconscious (or conscious) bias must be identified and managed early by challenging it through inductive reasoning.
INDUCTIVE REASONING – EVALUATING PAST EVENTS (AND CONSEQUENCES)
Often a number of smaller and/or related sub-events can lead to significant risk events (Swiss cheese model). There is a lot to learn from reflecting on previous experiences. Inductive reasoning helps identify likely causes of plausible risks and their potential consequences.
Inductive reasoning, done properly, must follow a structured data-driven analytical approach:
- Diligently capture internal and external events data, including the environment in which the event materialised and the related consequences, captured across a reasonably long period and/or from different but similar sources (especially for external events).
- Evaluate the above to detect patterns of causal drivers and consequential effects. Use the patterns of past causes to formulate a hypothesis about risk drivers. Similarly, review past events with large consequences to assess the potential scale of financial and reputational impact if such events were to reoccur.
- Review the hypothesis with the SMEs – who bring relevant information about the current and expected strategic and tactical environment – to agree on plausible future risks (for example, risk events and their potential impacts).
Heightened discipline and rigor in data collection and analysis increases the effectiveness of inductive reasoning, but it does have its own share of challenges. Since the hypothesis is drawn from limited experiences, there is always the possibility the next data point can disprove the hypothesis. Additionally, biases can distort the analysis of the data and resulting conclusions. These biases and limitations can be mitigated, to some extent, through deductive reasoning and challenge from SMEs with no conflict of interest.
BRING IT ALL TOGETHER
Identification of a plausible list of relevant risk scenarios requires discipline and investment. Hence for low investment or ‘greenfield’ situations, we might rely on gut instincts – unconsciously going through deductive and inductive reasoning with any limited available data. However, if one’s tolerance for the consequences of risk is low, then identification of the plausible risk events will require both deductive and inductive reasoning to ensure all plausible causes and impacts of uncertainty have been assessed and factored in the strategic planning and execution.
Comparatively, even the best prediction of risk events is only a job half-done. Prevention of risk events and/or survival through one will also require becoming proactive, strengthening one’s management and controls and maintaining a good buffer of financial and reputational capacity. As Peter F. Drucker (strategist and author) once said, “The best way to predict the future is to create it.”
