.

A Consultant's View

Prairie Trail Software, Inc. ............................................................. January 2013

Simple and Complex Risks

We humans are used to simple risks. However, sometimes, a simple risk changes into a complex risk. Two of the common complex risks are "Compound Risk" and "Connected Risks". Humans have a hard time identifying when a perceived simple risk has modified into a complex risk. The rules we learned about simple risks do not apply with complex risks.

We learned about risks first in school and sports. With these simple risks, we learn two rules about risks: the more we do something, the less the risk to us; and as the number of people doing it increases, the less the risk to us.

Compound risks are not like that at all. For example, few people have harm from their first puff of marijuana or tobacco or their first drunk. But there are effects that build up and the risks increase the more we do these activities. Environmental effects are another arena with compound risks.

In business, compound risks are often found in connection with ethics issues. When we take an ethical risk and have no consequences, we are likely to take more and more ethical risks. Yet, as we take more ethical risks, society works harder to give us consequences. Suddenly, the business person is being arrested and wondering how they got to that point.

Connected risks are the risks that depend on each other. The traditional way to evaluate risks has been to consider each one independently. However, a number of risks actually depend on each other.

Again, ethics are one area where risks often are connected. For example, if one professional athlete is using performance enhancing drugs, that generally can be detected and that person punished. But when a whole sport is filled with people using, nearly everyone will get smeared when the technology for detecting such gets better.

Connected risks get worse as the number of people doing them increase.

In business, there have been a number of cases where a number of simple risks became a connected risk. Businesses would expand and assume that they are taking on simple risks only to find out later that by expanding, the risks had connected together. This is not easy to spot as there isn't a clear "tipping point" where simple risks connect up.

The most recent example of this occurred in the 2008 financial meltdown. The risks of each mortgage going bad were all evaluated independently as simple risks not realizing that by so many people taking the same risk at the same time, the risks were being connected.

Other examples have happened when a previously small company expanded so much that it was now a dominant force in the market. Practices that were tolerated by a small company are not acceptable by a dominant company. IBM, Microsoft, and Google have all found themselves in this position.

Connected and Compound Risks can cause real problems.