​Mind of Jacka: Balancing Risk and Uncertainty

In no time at all, our kids began informing us that they were concerned about us having someone over. Note that I am 64 and my wife is within the same range. (Shoot, she won’t care if I tell. She’s 63.) We are in one of the identified risk groups.

The kids were definitely concerned and a text message exchange ensured. At one point, I prodded my son, an internal auditor, with this text. “I want a write up using the 5 C's.” In short order, his reply was received. (Reproduced here with minor edits.)

Condition: You are actively meeting with people during a pandemic
Criteria: The shelter in place order is in place
Cause: C’mon now
Consequence: Literal death
Corrective Action: Cancel plans

(At this point, let me interject that, when I received his response, I advised my son that it might wind up as part of a post. He replied that he was fine with it, but I should be ready for comments about why I was insane to not cancel the plans. Please feel free to weigh in.)

Not too bad for a quick turnaround. And, other than not articulating a real cause (I’m assuming he felt the true root cause was his parents were, once again, being idiots — at one time or another the belief of any offspring regarding their parents), it hits the mark.

Now, from an audit client perspective, I looked at this and began my arguments. (Isn’t that the way it always goes?) We believed we were taking into account not only the risks, but how those risks were being managed to an acceptable level. In addition, the consequence seemed to be a bit much.

But my digging wasn’t over, and I found myself putting on my internal audit hat. For example, while at first I thought the consequence was overstated, closer examination showed it was probably accurate. Alternatively, it might have been stated that someone would get sick or a disease would be transmitted. But the most important impact on the “organization” that is my life — an organization whose objective is continuance of that life — was, indeed, death.

And then I began to see the real problem in this conversation. And it ties into what I was talking about in my last blog post — risk, probability, and uncertainty.

My wife and I were looking at the risk through the lens of the probabilities and potentialities we perceived. Our kids were looking at it through different, albeit just as justifiable, lenses. And, because of the amount of uncertainty involved, we came up with wildly opposite but equally justifiable conclusions. With those uncertainties, there was no “correct” answer.

Isn’t it fascinating when we take the tools of internal audit and start to actually apply them to the real world? As an example, let’s take a look at what is going on around us right now.

As I type this, the various states in the U.S. are taking decidedly different approaches in opening their economies. The decision is a nigh-on-impossible balancing act. A friend and I were discussing a situation in his neighborhood where people literally could not afford food, and he articulated the situation perfectly: “We are balancing the potential of deaths caused by a virus with the potential of deaths caused by a plummeting economy.”

Different situations and different interpretations result in different decisions. And each leader views decisions through his or her own risk lens. Someone living in Manhattan is facing different situations and different risks than someone living in Truth or Consequences, N.M. And, even in the same state, differences abound. The governor of Florida feels one approach is correct for his state; the mayor of Miami feels a different approach is necessary for his city.

Leaders are making life-or-death decisions based on the best information they have. But the best information does not provide absolute certainty. In fact, risk is being evaluated and decisions being made in a culture of almost total uncertainty. Some leaders are willing to accept what they consider to be low probabilities and begin to move forward; some act more conservatively in the belief that the uncertainty means the unknown probabilities have to be respected. Without the necessary information, it is hard to say which, if any, approach is best.

Tom Peters recently articulated it best:

“What an imbroglio we are in the midst of. This is not a once-in-a-lifetime event; this is a once-in-three-lifetimes event. And the data are still so incomplete and conflicting that we don’t really know ‘what we’re in the middle of.’ All bets are literally off.”

I’m not trying to say who is wrong or right. I don’t have the information, I ain’t smart enough, and I wouldn’t want to be in the position to be making these decisions. What I’m trying to show is, in the real world, risk, probability, and uncertainty play an active role in the decisions that need to be made, whether or not that is articulated.

(Wow. Internal auditors don’t often get to see our concepts so dramatically exhibited.)

Which leads to the real challenge for the internal auditors in our midst. As your organization weighs in on decisions about whether or not to open, you need to be there helping your leadership understand what needs to be considered. It is not whether or not the government will allow your organization to be open. Instead, it is understanding, given the information available, what the risk is and whether the action that will be taken is worth that risk. And preaching to them the impact of uncertainty on the evaluation of the risks.

Finally, you’ve heard this a lot these days, but let me say it, too. Be safe out there. This is an important time for everyone. And it should be an important time for internal audit. A time to step up and help lead organizations toward the right decisions. But don’t do anything stupid. And try not to let anyone else do anything stupid, either.