White paper
Risk, consequence, and the chain of causation
By Rich Michel, National Risk Management Practice
November 2014
How important is it to measure risk?
Top business risks
Risk and
opportunity
not
in nature.
How
important
ismeasure
itobservable
to measure
risk?
How
important
isare
it to
risk?
Randomness, volatility, and uncertainty are all objectively
of the
top
priority
risks named by most study
Top
business
risks
TopHalf
business
risks
participants come from the external economic,
Risk
and
opportunity
are
not observable
nature.
of the
topcompetitive
priority
risksenvironments.
named
mostThe
study
Risk
and
opportunity
are not
observable
in nature.
Halfregulatory,
ofHalf
the top
priority
risks named
by mostbystudy
observable
phenomena.
Opportunity
and
riskininvolve
and
Randomness,
volatility,
and uncertainty
are to
all objectivelyparticipants
participants
come
from
the external
Randomness,
volatility,
and uncertainty
are
all objectively
come
the
external
economic,
positive
and negative
value
judgments
applied
other
half
canfrom
be
characterized
more economic,
as execution
observable
phenomena.
Opportunity
and
risk involve regulatory,
regulatory,
and competitive
environments.
The
observable
phenomena.
Opportunity
and
risk
involve
and
competitive
environments.
The
observed or anticipated randomness, volatility, or
risks as opposed to risk in the external
environment,
and negative
value judgments
to
other
be characterized
as execution
positivepositive
and negative
value judgments
appliedapplied
to
other half
canhalf
be can
characterized
more asmore
execution
uncertainty. Such value judgments can only be made in
although both elements can be present.
observed
or anticipated
randomness,
volatility,
or
as opposed
to the
riskexternal
in the external
environment,
observed
or anticipated
randomness,
volatility,
or
risks asrisks
opposed
to risk in
environment,
the context of goals or objectives, i.e., a desired outcome
uncertainty.
Suchjudgments
value judgments
can
bein
made in although
although
bothexecution-related
elements
be present.
uncertainty.
Such value
can only
beonly
made
both elements
can be can
present.
Predominantly,
risks identified as top
that is the
in question.
In thisor
framework,
risk
and opportunity
context
objectives,
i.e., a desired
outcome
the context
of goalsoforgoals
objectives,
i.e., a desired
outcome
company
priorities
include failure risks
to innovate,
retention or
Predominantly,
execution-related
identified
are always
linked
in
respect
to specific
goalsopportunity
orand
objectives.
execution-related
risks identified
as top as top
that
is
in question.
this
framework,
opportunityPredominantly,
that is in
question.
In this In
framework,
risk andrisk
attraction
of
top
talent,
and
damage
to
reputation.
company
priorities
to innovate,
retention
priorities
includeinclude
failure failure
to innovate,
retention
orThereor
are always
linked
in respect
to specific
goals
or objectives.company
are
always
linked
in
respect
to
specific
goals
or
objectives.
In early 2014, we conducted research with a select group attraction
canattraction
beofsignificant
correlation
between
of top and
talent,
and damage
to execution
reputation.
There
top talent,
damage
to reputation.
There risks.
of
key
executives
and
risk
managers
at
companies
Failure
to
innovate
can
be
the
result
of
poor
execution,
earlywe
2014,
we conducted
research
with agroup
select group can be can
be significant
correlation
between
execution
risks.
In earlyIn2014,
conducted
research
with a select
significant
correlation
between
execution
risks.
within
the
Russell
2500™
Index
to at
learn
more
about
which
may
bebe
caused
impacted
by failure
to
of
key
executives
risk managers
at companies
Failure
toalso
innovate
can
beor
the
result
poor
execution,
of
key executives
and
riskand
managers
companies
Failure
to innovate
can
the result
of
poorofexecution,
their
risk
management
practices
and
perspectives.
attract
or
retain
top
talent
—
another
execution
risk.
the Russell
Index
learnabout
more about
which
may
be caused
or impacted
by failure
to Both
within within
the Russell
2500™2500™
Index to
learntomore
which may
also
bealso
caused
or impacted
by failure
to
their
riskconfirmed
management
and perspectives.
attract
ortop
retain
top
talent
— another
execution
risk.
Both
Our research
thatpractices
most
agree
of these
can
result
in—reputation
damage.
Risks
in the
their
risk
management
practices
andcompanies
perspectives.
attract
or retain
talent
another
execution
risk.
Both
Ourframework.
research
confirmed
that
most
ofcan
these
canin
result
in reputation
damage.
Our
confirmed
that
most
companies
agreeofagree
of these
result
reputation
Risks inRisks
the in the
withresearch
this
We
found
that
thecompanies
majority
external
environment,
suchdamage.
as increasing
competition,
with
this framework.
Wethat
found
the majority
of
external
environment,
asimpact
increasing
competition,
with
framework.
We found
thethat
of that
external
environment,
assuch
increasing
competition,
studythis
participants
(56%)
define
risk
asmajority
“anything
may
increase
the such
likelihood
or
of execution
risks.
study
participants
(56%)
define
as “anything
may increase
the likelihood
or impact
of execution
study
participants
(56%) define
risk
as risk
“anything
that
may increase
the likelihood
or impact
of execution
risks. risks.
prevents
us from
reaching
objectives,”
although
no that
prevents
usreaching
from reaching
although
no
prevents
us from
objectives,”
although
no
Top priority business risks
one selected
“volatility,”
only
4%objectives,”
selected
“uncertainty,”
Top priority
business
one
selected
“volatility,”
only
4%
selected
“uncertainty,”
Top priority
business
risks risks
one
“volatility,”
only 4%
selected
“uncertainty,”
andselected
14% chose
“opportunity
and
uncertainty.”
and
14%“opportunity
chose “opportunity
and uncertainty.”
and 14%
chose
and uncertainty.”
How does your company define risk?
56%
We don't
define it formally
We don't define
it formally
50%
Opportunity
and uncertainty
Opportunity
and uncertainty
14%
Uncertainty
Uncertainty
4%
4%
Increasing Increasing
competition
competition
8%
8%
Failure to innovate
Failure to innovate
8%
8%
Retention/attraction
Retention/attraction
of top talent
of top talent
6%
14%
Performance
falling
Performance
falling
short of expectations
short of expectations
Pricing pressure
Pricing pressure
4%
0%
What isconcerning
most concerning
is the
fact
that
one in four
What
the
fact
that
one
in four
Whatisismost
most concerningisis
the
fact
that
one
in four
respondents
(26%) indicated
thatcompanies
their companies
respondents
(26%) indicated
that their
don’t don’t
respondents (26%) indicated that their companies don’t
define
risk formally.
This
may account
the confusion
define risk
formally.
This may
account
for the for
confusion
define risk formally. This may account for the confusion
we observed
between
risks
risk consequences
we observed
between
risks and
riskand
consequences
when when
we observed
between
risks
and
risk
consequences
respondents
indicated
their companies’
riskwhen
concerns.
respondents
indicated
their companies’
top risktop
concerns.
Damage toDamage to
reputationreputation
6%
50%
12%
56%
26%
26%
56%
22%
22%
RegulatoryRegulatory
change/scrutiny 12%
change/scrutiny
Anything
thatus
prevents
Anything that
prevents
from us from
reaching objectives
reaching objectives
Volatility Volatility
0%
56%
Economic conditions
Economic conditions
Howyour
doescompany
your company
How does
define define
risk? risk?
26%
34%
34%
34%
34%
26%
6%
24%
14%
24%
26%
Ranked
Ranked in top
5 in top 5
Ranked #1 Ranked #1
14%
26%
4%
24%
24%
6%
respondents indicated their companies’ top risk concerns.
Wells
Fargo Insurance
whiteRisk,
paper:
Risk, consequence,
and the
of causation
| November
Wells Fargo
Insurance
white paper:
consequence,
and the chain
of chain
causation
| November
2014 2014
2
Wells Fargo Insurance white paper: Risk, consequence, and the chain of causation | November 2014
2
2
RiskRisk
and and
consequence
consequence
“Performance
falling
shortshort
of expectations”
waswas
“Performance
falling
of expectations”
ranked
the #1the
priority
moremore
often
thanthan
anyany
other
riskrisk
ranked
#1 priority
often
other
apart apart
from from
“economic
conditions.”
But
performance
“economic conditions.” But performance
fallingfalling
shortshort
of expectations
can can
be the
result
of of
of expectations
be the
result
virtually
everyevery
otherother
risk identified
in our
research.
virtually
risk identified
in our
research.
It is more
appropriately
defined
as aas
risk
consequence
It is more
appropriately
defined
a risk
consequence
risk.same
The same
is true
of other
business
risks
than athan
risk.aThe
is true
of other
business
risks
frequently
identified,
such
as
“business
interruption”
frequently identified, such as “business interruption”
and “litigation.”
But what
is perceived
a risk
versus
and “litigation.”
But what
is perceived
as aasrisk
versus
a
risk
consequence
often
depends
on
how
granular
a risk consequence often depends on how granular a a
company
wishes
get with
the chain
of causation.
company
wishes
to gettowith
the chain
of causation.
The chain of causation can have many links. Performance
The chain
of causation can have many links. Performance
falling short of expectations may have been caused
falling short of expectations may have been caused
by inadequately insured business interruption, which
by inadequately insured business interruption, which
resulted from a fire at a plant started by electrical arcing
resulted
from a fire at a plant started by electrical arcing
resulting from a faulty repair by an inadequately trained
resulting
from a The
faulty
repair bywas
an chosen
inadequately
electrician.
electrician
becausetrained
he quoted
electrician.
The
electrician
was
chosen
because
he quoted
the lowest price to the maintenance department,
which
the lowest
price
to
the
maintenance
department,
which
was given strong incentives to reduce costs. So whom
was given
strong
reduce
costs.
So whom
do you
call toincentives
make sureto
this
doesn’t
happen
again?
do youDocall
make sure
this doesn’t
again?
youtochange
the incentives
forhappen
the maintenance
Do you
change the
incentives
forinspect
the maintenance
department,
require
them to
all vendor repairs,
install better
firethem
protection,
or improve
yourrepairs,
business
department,
require
to inspect
all vendor
coverage? Perhaps
all four,
but
the task
installinterruption
better fire protection,
or improve
your
business
of understanding
impacts
them
interruption
coverage?risk
Perhaps
alland
four,mitigating
but the task
requires a clear
the chainthem
of causation.
of understanding
riskunderstanding
impacts and of
mitigating
requires a clear understanding of the chain of causation.
Analyzing the chain of causation
Analyzing
the
chain
of causation
The easiest
way
to analyze
the chain of causation is to
use the “5 Whys” method,1 first developed by Toyota
The easiest way to analyze the chain of causation is to
Production System architect
Taiichi Ohno, to get at the
use the
“5 Whys” method,1 first developed by Toyota
root cause. By clearly defining the problem or risk —
Production
Systemfalling
architect
Ohno, to—get
thethen
performance
shortTaiichi
of expectations
weat
can
root cause.
By clearly
defining
problem
or risk
—
ask “why”
repeatedly
until the
we get
to the root
cause(s).
performance
falling
short
of
expectations
—
we
can
Asking “why” five times is usually about right, butthen
it
ask “why”
repeatedly
we get to the
cause(s).
can take
more oruntil
less, depending
on root
the problem.
Asking “why” five times is usually about right, but it
These
results
candepending
easily be captured
an Ishikawa, or
can take
more
or less,
on the in
problem.
mitigation. The “5 whys” make it easy to look back
mitigation. The “5 whys” make it easy to look back
down
upto
toaabusiness
business
downthe
thechain
chainof
ofcausation
causation leading
leading up
consequence
meanstotomitigate
mitigate
consequenceand
andidentify
identify the
the best
best means
the
likelihood
and
severity
of
the
events
identified.
the likelihood and severity of the events identified.
Sample
Sample55Why
Whyanalysis
analysis
CAUSE
Why?
Why?
Maintenance
Dept. incented
to reduce cost
EFFECT
Why?
Faulty electrical
repair – poor
training
Inadequate
insurance
Performance
falls short of
expectations
Lowest cost
electric
contractor
Why?
Failure to inspect
repair – electrical
arcing fire
Why?
Business continuity planning (BCP) usually begins with
Business
continuity
planning
usually
with
a business
consequence,
such (BCP)
as the loss
of a begins
data center
a business
consequence,
as the loss
data center
or manufacturing
facility.such
The reason
why of
thea facility
is
orunavailable
manufacturing
facility.
The
reason
why
the
is less important as BCP is focusedfacility
on the is
unavailable
is less
important
as BCP
is focused
on the
most effective
means
to maintain
business
continuity
most
effective
means
to
maintain
business
continuity
while the facility in question remains unavailable. It is a
while
the facility
in Risk
question
remains
unavailable.
It is a
post-loss
strategy.
finance
decisions
often address
post-loss
strategy.
Risk
finance
decisions
often
address
the net loss
after the
impact
of both
pre- and
post-loss
mitigation
efforts,
to as
residual
the
net loss after
thesometimes
impact ofreferred
both preand
post-loss
risk. However,
thought
shouldreferred
be givento
toas
theresidual
potential
mitigation
efforts,
sometimes
increase
in
residual
risk
should
some
or
all
of
the
prerisk. However, thought should be given to the potential
and post-loss
mitigation
efforts some
fail. Otherwise,
there
increase
in residual
risk should
or all of the
precan
be
a
shortfall
in
coverage,
as
in
the
example
above.
and post-loss mitigation efforts fail. Otherwise, there
can
be a shortfall
in coverage, as
in theon
example
above.
Traditional
risk quantification
focuses
potential
impact
and likelihood, but the chain of causation helps companies
Traditional risk quantification focuses on potential impact
understand risk velocity — the speed with which a risk
and likelihood, but the chain of causation helps companies
impact materializes and manifests itself in operating
understand
risk velocity — the speed with which a risk
performance. The causal chain also helps identify the
impact
materializes
in operating
underlying
issues ofand
howmanifests
vulnerableitself
the company
is to
performance.
The
causal
chain
also
helps
the
the risk and its possible correlation to otheridentify
risks, both
underlying
issues ofimpact
how vulnerable
the company
of which influence
and likelihood
as well. is to
the risk and its possible correlation to other risks, both
of which influence impact and likelihood as well.
fishbone, diagram. The final “why” should identify a
behavior that
must
be changed.
Theseprocess
resultsthat
canfailed
easilyorbea captured
in an
Ishikawa,
or
The
root
cause(s)
will
then
point
to
the
means
of
fishbone, diagram. The final “why” should identify a
process that failed or a behavior that must be changed.
The root cause(s) will then point to the means of
1
Toyota Motor Corporation. (2006, March). Ask ‘why’ five times about every matter.
Retrieved from http://www.toyota-global.com
Toyota Motor Corporation. (2006, March). Ask ‘why’ five times about every matter.
Wells Fargo Insurance white paper:
Retrieved from http://www.toyota-global.com
1
Risk, consequence, and the chain of causation | November 2014
Wells Fargo Insurance white paper: Risk, consequence, and the chain of causation | November 2014
3
3
However, all of these elements of risk assessment balance
on the underlying complexity of the risk environment.
Complexity can be defined as the ability of a system
to exhibit unplanned and unexpected behavior not
predictable by the qualities of the various parts, elements,
or agencies interacting in it. Complexity is not the same
as complicated. A Swiss watch is complicated but it is not
complex, as it is highly predictable. The global economy
is complex, which is probably why our research found
it to be the #1 risk on people’s minds. When something
is complex, our statements about it will tend to become
less precise, more uncertain. Complexity is an aspect of
risk that deserves much more study, as it is increasingly
present in every dimension of modern society.
Inverted risk assessment pyramid
Impact
Velocity
Likelihood
Summary
Risks may be named by their consequences or root causes
as long as everyone understands that there is a chain of
causation in between that must be understood. Sometimes
it is best to name a risk by its most defining issue. Terms
such as pandemic or employee strike may more clearly
define the main issue, even though neither may be the
root cause or the ultimate consequence. What is most
important is for the organization to have a well-defined
risk language and protocol that is understood by everyone.
Clearly defining what is meant by the term “risk”
and the hierarchy of causation and consequence
enable a company to navigate the risk landscape
more efficiently, avoid confusion, and measure,
mitigate, and finance risks more effectively.
How can we help?
For more information regarding this topic, please contact
your local Wells Fargo Insurance sales executive, or:
Vulnerability
Correlation
Rich Michel
404-923-3602 | [email protected]
Complexity
This advisory is for informational purposes and is not intended to be exhaustive nor should any discussions or opinions be construed as legal advice. Readers should contact a broker for
insurance advice or legal counsel for legal advice.
Products and services are offered through Wells Fargo Insurance Services USA, Inc., a non-bank insurance agency affiliate of Wells Fargo & Company, and are underwritten by unaffiliated
insurance companies. Some services require additional fees and may be offered directly through third-party providers. Banking and insurance decisions are made independently and do
not influence each other.
© 2014 Wells Fargo Insurance Services USA, Inc. All rights reserved. WCS-1221335
Wells Fargo Insurance white paper: Risk, consequence, and the chain of causation | November 2014
4