Inherited Risk Controls

What activity do you engage in on a regular basis that incurs the most risk?

If you are like me, that activity would be driving an automobile.

Do you have a risk registry that governs your driving? Before getting into your car, do you review a risk matrix (heat map) to determine the probability of arriving at your destination without having an accident?

I quite doubt it.

On the other hand, I know you do not climb into your automobile and then drive with wild abandonment, with no care about the risks of getting into an accident.

How do I know this? Because, if you did, you would not be alive to read this blog!

So, if motorists do not practice active risk management when driving from point A to point B, how do most of us survive the ordeal, day in and day out?

Because we inherit risk controls from many sources. They can be summarized loosely in these four categories:

• Driver Training
• Traffic Laws
• Automobile Safety
• Insurance

The reason you do not need to perform active risk management for automobile driving is that the biggest stakeholder — your local government — has done the risk management for you and for all their constituents.

In most countries, driver training is required before issuing a driver’s license. The training differs from one local government to the next, and you (or more likely your parents/guardians) may decide to take additional training, but it is the government that sets the baseline that is validated through an exam. For example, in the United States, the state government determines this training and validation criteria. They have done their own risk management to arrive at the minimum amount of validated training. In other words, they have calculated the amount of risk they are willing to take by letting you loose on the road.

In most countries, there are traffic laws telling you what you can and can do, and how fast you can do it. These restrictions are taught as part of the driver training, are displayed to drivers in real-time by way of signs and signals, and are enforced by police or traffic cameras. Again, in the locality where the road runs through, the government has calculated the amount of risk they are willing to accept. What the speed limit should be on each road? Whether or not you can turn right at a red light. Whether to install a stop sign, a traffic light, or a roundabout at each intersection.

Governments — often at a different level than referenced above — determine the minimum safety features required for an automobile to be allowed on the road. Automakers build safety into their products of varying quality based on manufacturing laws, how much they think they can charge for additional features, the chance of being held liable for medical injuries and property damage in case of an accident, and how much they care about their customers surviving to purchase more of their products in the future.

All of the above security controls you inherit as long as you follow the training you received, obey traffic laws and purchase only automobiles that meet minimum safety standards (and you maintain the vehicle to those standards for as long as you own it). You do not need to practice active risk management, but you must practice prudence (see my previous blog on this topic).

The above security controls reduce the probability of having an accident and reduce the negative impact when an accident occurs. However, there is still a lot of residual risk that most governments are unwilling to accept. The local government must clean up automobile accidents and deal with the injuries and damage afterward. For these reasons, the government requires you to have a minimum amount of liability insurance. If your vehicle is financed, the bank may require you to purchase collision insurance as well (since your car is collateral for the loan).

The insurance companies themselves are experts at risk management. They use actuarial science to determine the probability that you will get into an accident over the period of the premium based on multiple criteria:  your age, your gender, your marital status, the make of your vehicle, the age and condition of your vehicle, how much you drive on average, and where you house the vehicle. They use sophisticated procedures and powerful computers to determine how much you will likely cost them so they can calculate the premium they will charge you. Their primary goal is to make a profit from the service they provide.

There are two instances where you deal in a sort of active risk management. How sophisticated your methods are is up to you.

• Even after insurance, you are left with residual risk over which you are responsible. You can weigh the probability of paying out your own money after the insurance company has paid their part of the medical coverage for injuries and repairs for property damage. You may decide you do not want to accept that much risk and purchase additional insurance with an additional cost each month that you can control.
  
• You may decide to spend extra money to purchase an automobile that has a better safety record or purchase additional safety features.

I doubt that many of you actually research traffic accident statistics within the community where you most often drive to determine the probability of getting in an accident. You probably do not perform exhaustive research on which automobiles are the safest. It is more likely you make choices based on your biased intuition, limited personal knowledge, word of mouth from acquaintances, product commercials themselves, or reports from independent reviewers.

None of this is sophisticated risk management, but it is active risk management.

Why did I bother writing this long blog about driving and risk management?

Can you not see the similarities between the driving process and project/program management?

Know when to realize and consider the impact of inherited risk controls on your projects and program and know when active risk management is actually required or beneficial.

Above all, accept and do nothing to impede the effects of those inherited risk controls. That is prudence.