BNET Insight

The View from Harvard Business

The latest ideas and insights from the minds of Harvard Business.

Controlling Corporate Risk Through Sabotage

June 23rd, 2008 @ 6:17 am

1 Comment

Categories: Management, Research, Strategy

Tags: Risk, Knot, Malcolm Sparrow, Strategy, Security, Management, Sean Silverthorne

Controlling Corporate Risk Through SabotageEvery executive is in the business of controlling risk, or harms, but doing so is both a skill and an art that few of us practice.

Corporate risk comes in many forms: pricing moves by a competitor, a product liability lawsuit, departure of a talented manager, a sudden increase in fuel prices, a disruptive innovation that obsoletes your product, financial pressure suffered by a big customer.

These often catch us by surprise, but the fact is many risks are imaginable and avoidable, or at least can be planned for. Clearly banks and other financial institutions could have risk managed the subprime mortgage fiasco more artfully.

Harvard Kennedy School professor Malcolm Sparrow’s research focuses on how regulators can mitigate risk, but his survey of current thinking in this area has broad ramifications for corporate and nonprofit execs as well.

His research advises risk managers to take small but determined interventions at early stages of a developing harm. The process begins by narrowing broad generalities of risk into well-defined, addressable problems.

Some highlights:

Undoing the Knot. Risk can be assessed by picking it apart, like an adult undoes a knot, Sparrow says.  A child tries to untangle a knot by diving right in, randomly pulling strands and often making the problem worse. An adult begins by looking at the knot, trying  to understand its structure.

“First they hold it carefully, turn it this way and that, looking at the knot from each side, until they understand the structure of the thing itself. Then a plan begins to form: ‘if I loosen this strand, it will release that one, and then I’ll be able to pass this through that loop,’ and so on. If they’ve understood the structure correctly, and formed the plan based on that understanding, then the knot falls apart, and is no more.”

Think Like a Saboteur. Focusing on specific bad things such as concentrations of risk or downward trends offers the opportunity to think and act like a saboteur, says Sparrow. Find a vulnerability in the harm itself and remove it, or produce a scarcity which the opposing forces cannot cure.

“If it’s true that there is in fact an art to the destruction of bad things, which is different from the construction of good things, then it is surely an art that we really all ought to understand.”

Thinking About Catastrophic Risk.  How do you mitigate against the extremely rare  catastrophic event? Sparrow says pay close attention to near misses and other “precursor events”, much like the FAA studies planes that almost crash, but don’t.

“Dealing with catastrophic risks demands this type of systematic debriefing of near misses, precursor events, as well as disasters that might have happened elsewhere. It also demands the deliberate use of imagination, to figure out all the ways in which events, or near-events, could have been much worse., which has very few plane crashes from which to draw data.”

Companies and agencies that effectively deal with long-term risk spot tell-tale patterns of behavior early on and quickly deal with emerging problems, he says.

Read the interview for more details, then return to tell us how you assess and plan for risk.

(BASE jumpers image by AndyLawson, CC 2.0)

 
Reply to Story

BNET TalkbackShare your ideas and expertise on this topic

Subscribe to this discussion via Email or RSS

  •  
    1

    onlyjazz@...

    06/24/08 | Report as spam

    Controlling corporate risk

    Malcolm Sparrow says that "What?s odd, when you look at this new pattern of behavior, is that there does not seem to be a well-established language for it. Different professions have quite different vocabularies. In the police profession it?s called ?problem-oriented policing.?

    In response to this rather surprising statement - let's consider the reason for this situation and if there is really no common language of risk assessment.

    1. To a large degree - US government regulators are responsible for this. Regulations provide at best a checklist of things companies must do and at worst (in the case of Sarbox) a general statement which turns into a 100BN franchise for accounting firms and technology companies. When you use a big regulatory stick with an organization you are essentially telling them that any research into understanding is a non-value-added activity. In other words - comply but don't try and understand the root cause of risk - if you don't need to understand something then you don't need a common language of risk assessment.

    2. There already exists an excellent methodology for understanding the root cause of risk. The methodology is called threat modeling. Threat modeling is a mature methodology with implementations from Microsoft and groups like PTA (Practical Threat Analysis) Technologies.

    In threat modeling exercises - analysts and business decision makers use a model of assets, vulnerabilities of assets, threats (that attack by exploiting vulnerabilities) and countermeasures (that mitigate threats). The beauty of threat modeling is that it is a common language that any person working in an organization can understand.

    Danny Lieberman

Please add your comment:

  1. You are currently: a Guest |
  2.  

Basic HTML tags that work in comments are: bold (<b></b>), italic (<i></i>), underline (<u></u>), and hyperlink (<a href></a)

advertisement

Blogger Profiles

  • Blogger Thumbnail Sean Silverthorne Sean Silverthorne is the editor of HBS Working Knowledge, which provides a first look at the research and ideas of Harvard Business School faculty. Working Knowledge, which won a Webby award in 2007, currently records 4 million unique visitors a year. He has been with HBS since 2001. Silverthorne has 28 years experience in print and online journalism. Before arriving at HBS, he was a senior editor at CNet and Executive Editor of ZDNet News.... more »

advertisement
  • Click Here
  • Click Here
  • Click Here
advertisement
Click Here