It's been a fascination of mine for some years to understand more about why we can all make decent judgements in the face of uncertainty and incomplete knowledge (risk) in our lives; then our organisations find it really difficult to do the same.
Risk management in organisations tends to be seen to be about compliance, about 'ticking the box', about protection. Risk is explained as if it's some sort of objective and rational thing which is true if we're talking about the odds of winning the lottery, or if we have a large homogenous data set to analyse. When we're managing change though we are taking risks that only exist because we have incomplete knowledge - because things are ambiguous - and where we don't have the data. In these situations all attempts to evaluate risk objectively are futile. But all is not lost.
Thinking about risk is not only natural, it's also essential if we are to make half-decent plans and forecasts in the face of uncertainty. So we need to accept that risk is a subjective thing - like love - in the eye of the beholder, but we need to find ways to explore perceptions of risk to make sure that we don't invest in change with our eyes closed.
Identifying, assessing and deciding how to manage those uncertainties that we perceive, and that would really matter to our objectives if they occurred, is key work is creating and protecting business value. To do this work well we need to engage 'predictably irrational' (Ariely, 2009) people and not rely on processes, tools and techniques to do the job for us.
We don't love in line with a process, supported by a software tool. It's daft to try to understand risk in this way.
You can find my books, written to help people to understand and manage risk attitude, and to engage others to identify, own and manage risk by clicking here.