Risk Management to Mitigating Vulnerabilities

I was invited to speak at the Summit on Strategic Risk Policy and advanced maritime technologies in Parliament House in Canberra, Australia in April. Joining me at the podium were the Head of the Australian Navy and the Ukrainian Ambassador to Australia. After the speeches and the debates something quite significant emerged: a paradoxical rejection and profound acceptance of the risk management process. Let me explain.

The conventional, taught premise of the risk management body of knowledge is that a risk is a confluence of the probability of an event and the impact of its occurrence. This is the underpinning, basic risk management equation trotted out by business schools everywhere. But this was rejected by both the Navy Chief and the Ambassador. Instead, both independently urged a focus on impact only. A 2 percent probability of national oblivion, if it occurs, is still national oblivion – the same as an 80 percent probability. Instead, both men urged the focus to be on the “vulnerability” of the impact itself and for management efforts to be made to mitigate this vulnerability. The probability could be ignored.

For some at the Canberra Summit, this was an absolute rejection of the risk management process. After all, as the Ambassador urged, the national and regional risk registers in Ukraine failed to stop a Russian invasion. For sure, an A4 Risk Register could hardly interdict a Russian battle tank, but the process of identifying issues and risks did capture and codify impacts and vulnerabilities: it has been these that the Ukrainian forces, and wider society, have been addressing daily throughout the war. We could say that the very act of undertaking risk reviews and gathering risk management information in peace time has allowed leaders to think strategically about wartime fragility and vulnerabilities.

For some, if the classic risk equation is broken, then the practice of risk management itself must have failed. But this is a mistake intellectually. When people started to think about risk management as a practice many years ago, it was not the artefacts, such as risk registers, that were prized. It was the process and manner of thinking that brought results. This is still highly valid today, as the Ambassador demonstrates, and sits at the heart of thinking around how the new Navy Chief in Australia intends to build a fleet fit for tomorrow.

John Louth

Professor John Louth is senior strategic adviser to Redstone Risk. He serves on a number of UK defence boards as either a non-executive director or strategic adviser and sits on the panel of advisers to the House of Commons Defence Select Committee. His latest book on UK exports was published this year by Routledge. He is a collaborating professor with the University of South Australia in Adelaide.