two

Preconditions

Watching the formation of a natural hurricane is a truly awesome experience. Meteorologists can put together animations of photos from space to show how these monster storms arise apparently from nowhere, and the sight inevitably inspires strong emotions. The most powerful weather system our planet can produce seems to come literally out of thin air.

Of course, the reality of how hurricanes form is quite different. They don’t come from nowhere; instead, there are clear preconditions that must be present in order to set in motion the sequence of events that eventually produces a full-strength hurricane. By understanding and monitoring these preconditions, people who might be affected by a hurricane can maximize the time available for preparation and protection.

In the same way, as we look for insights to help us understand extreme risk exposure in business, it would be helpful to identify the necessary preconditions for a Risk Hurricane. This chapter offers three influences that work together to allow a Risk Hurricane to form. We characterize 21 factors in the external environment that create uncertainty for businesses, describe the elements of risk culture and risk mindset that make an organization vulnerable to risk, and highlight the important role of change as a trigger of extreme risk exposure.

NATURAL HURRICANE PRECONDITIONS

All hurricanes follow the same life cycle, described below and illustrated in Figure 2.1:

• Hurricanes form in the tropics (between latitudes 8° and 20°), over a warm ocean where the water temperature is above 26.5°C. The heat and moisture from this warm water provide the energy source for what follows. The initial stage is known as a tropical wave, which is a westward-moving area of low air pressure.

• The warm ocean water evaporates and rises in the low air pressure area, and it is replaced by colder air, which in turn is heated and rises, generating strong gusty winds. Moist air condenses to form thunderclouds with heavy rain, releasing latent heat energy. This combination of conditions is called a tropical disturbance.

• If ocean temperatures remain high enough, the cycle will continue, leading to faster flows of rising and falling air, with sustained wind speeds of up to 38 mph (Beaufort force 7), known as a tropical depression.

• The ongoing cycle of air flows produces large storm clouds, which begin to spin due to the Earth’s rotation and the Coriolis effect, causing the storm to become organized. The spiraling wind increases in speed as it moves inward toward the center of the vortex, moving up through the Beaufort scale from force 8 to 11, with sustained wind speeds of 39 to 72 mph. During this stage it becomes a tropical storm and is eligible to be named.

• Sustained wind speeds rising above 72 mph indicate that a full hurricane has developed. The hurricane can continue to grow in size and strength while it remains over warm water, but it will begin to dissipate when it moves over land or colder ocean waters. When sustained wind speeds fall below 73 mph, the hurricane is downgraded to a tropical storm, and its life is effectively over.

As we follow these stages in the development of a hurricane, we can identify three necessary preconditions:

1. Warm ocean water

2. Low air pressure

3. Circulating wind vortices

Each of these three factors alone is insufficient to produce a hurricane, but in combination the outcome is guaranteed. Turning to our analogy, let’s consider whether there are similar necessary preconditions that must be in place for a Risk Hurricane to develop.

RISK HURRICANE PRECONDITIONS

Where does extreme risk exposure come from? Does it arise out of the blue, without warning, appearing fully formed in a business or organization? Although it might feel that way to people affected by a Risk Hurricane, in fact extreme risk exposure is the result of the conjunction of several factors in a synergistic manner, each strengthening the other and resulting in ever-increasing self-sustaining uncertainty and severely disruptive impact.

We’ve described three preconditions that are required in order for a natural hurricane to form. In the same way, it’s possible to identify three preconditions for the Risk Hurricane that cause extreme risk exposure in business:

1. External environment

2. Internal environment

3. Rate of change

EXTERNAL ENVIRONMENT

There are many sources of uncertainty in today’s business environment that can contribute to the risk exposure encountered by an organization. A range of mnemonics have been developed to help business leaders remember these factors, many of which are confusingly similar, including:

• PESTLE—Political, Economic, Social, Technological, Legal, Environmental

• STEEPLE—as PESTLE, with the addition of Ethics

• PESTLIED—as PESTLE, with the addition of International (or Informational) and Demographic

• InSPECT—Innovation, Social, Political, Economic, Communications, Technology

• SPECTRUM—Socio-cultural, Political, Economic, Competitive, Technology, Regulatory/Legal, Uncertainty/Risk, Market

• TECOP—Technical, Environmental, Commercial, Operational, Political

• VUCA—Volatility, Uncertainty, Complexity, Ambiguity

These factors are consolidated in Figure 2.2. Most of them are external to the organization, but some relate to the type of business being undertaken (Operational, for example).

We’ve seen that warm ocean water provides the environment within which the early stages of a hurricane can develop. In a similar way, sources of uncertainty in the external business environment promote the formation of a Risk Hurricane. Warm water acts as the energy source for a tropical storm, which is driven by heat and moisture. The warmer the water, the more energy is available to fuel the storm. Similarly, when external sources of uncertainty in the business environment are strong, conditions favor the development of extreme risk exposure. This is explored briefly for each of the factors in Figure 2.2 (presented in alphabetical order for ease of reference):

• Ambiguity. Ambiguity arises from incomplete understanding of crucial aspects of a situation. High levels of ambiguity mean that business leaders are unable to plan with confidence. As a result, increased risk is built into strategic and tactical plans, which will have to be modified as ambiguity reduces and things become clearer.

• Commercial. Increasingly complex forms of contract result in the possibility of an organization taking on commitments and obligations that are onerous or difficult/impossible to deliver. This is exacerbated by extended supply chains with multiple contractual boundaries and interfaces, which are becoming more common in a globalized business environment. When contractual commitments involve multiple regulatory regimes, the situation becomes even more risky.

• Communications. The importance of clear communication is well understood, but it is not always well practiced. If communication is compromised, incomplete, or misleading, then subsequent decisions and actions will be built on insecure foundations, and risk exposure will be higher.

• Competition. The actions of competitors in shared market space can never be fully known or predicted in advance, which represents a significant source of uncertainty for most businesses. Existing competitors may launch new or improved products or services, change their pricing strategy, undergo mergers or acquisitions or demergers, launch an aggressive recruitment campaign targeting our workforce demographic, or even exit our market altogether. In addition, new players may enter our market space, perhaps with disruptive customer offerings or business models or technological solutions.

• Complexity. At first sight, this factor relates more to the nature of the business of the organization rather than to the external environment. However, in addition, there are often external complexities that can give rise to significant uncertainty for a business, including market structures, technological or scientific theories and discoveries, supply chain interconnectivity, and so on. One key characteristic of complexity is unpredictability: simple cause-and-effect relationships rarely exist in complex settings.

• Demographic. Populations are becoming increasingly volatile, including at national and ethnic levels, with large-scale migrations, alterations in age profiles, and changes in social mobility and related expectations. The demographic factor also includes generational issues, as the people who make up our workforce, management, client base, and competitors transition from Baby Boomers, through Gen X and Millennials, to Gen Z and the Alpha Generation. The impact of these generational changes is hard to predict and may invalidate some aspects of existing business models.

• Economic. The economic environment is clearly a significant factor in the health of any business, including availability of loans, interest rates, exchange rates, insurance, market performance, share values, tariffs, and so on. Both the macro-and microeconomic circumstances can change with little or no warning and can generate substantial risk exposure for a business.

• Environmental. The natural environment can influence businesses both directly and indirectly, especially following the rise of populist activism. Environmental factors have a direct effect on businesses that depend on natural resources, or where operations interact with the natural environment. This is often thought to be limited to the extractive and energy industries, but other sectors can also be indirectly affected by environmental issues, especially if activists perceive a link between the environment and the products or conduct of a business. Organizations that directly impact the environment are generally aware of potentially disruptive issues and build mitigating responses into their actions. But indirect impacts arising from environmental issues can strike other businesses without warning, leading to significant reputational and operational impacts.

• Ethics. Business ethics has received increased attention in recent years, in response to a number of scandals in various industries. While ethics forms part of the internal culture of an organization, external ethical issues can be raised unexpectedly, increasing risk exposure for the business.

• Informational. Information is an important direct resource for many organizations, but enhanced attention to data privacy and cybersecurity has led to increased risk exposure in this area for a wide range of businesses and industry sectors. Wherever customer data are collected for valid business reasons, the organization has a duty to keep them secure and use them only for specified purposes.

• Innovation. All innovation involves uncertainty, as the organization seeks to do existing things better or to do new things that are useful and profitable. There is no guarantee that innovation will produce results, even when it is undertaken incrementally or in an agile manner. Any business that relies significantly on innovation for growth or success is naturally exposed to risk in this area. In addition to internal innovation as a source of risk, aspects of innovation in the external environment can increase our risk exposure. For example, competitors may innovate in our area of business, and technological developments might affect our operations, processes, or products.

• International. The business environment is increasingly global in the structure of transnational corporations, the reach of supply chains, and the client base. This naturally introduces multiple sources of uncertainty, including language, culture, business practices, regulations, forms of contract, and so on. The international dimension can change rapidly, leading to high levels of risk exposure for businesses operating in this context.

• Legal. In most countries, the laws governing businesses are fairly complex, and they often require interpretation by legal advisers. This source of uncertainty can be significant if key strategic decisions depend on legal opinion that might be challenged.

• Market. Market forces are often hard to understand and predict, with unknown factors driving demand, market share, or growth potential. Even the best analysts are often behind the curve, reacting to the latest market shift instead of anticipating it. For many businesses, the state of the market presents a major source of uncertainty that can contribute significantly to high levels of risk exposure.

• [Operational. This heading is included in just one of the risk source mnemonics (TECOP) and properly belongs to the internal workings of the organization, rather than being an element of its external environment.]

• Political. In many countries, the political landscape plays an important part in setting the context for business. Changes in government following elections might result in wholesale transitions in the political arena, but a simple change of minister can produce policy moves that affect our business significantly. This is likely to have a particularly strong impact on those organizations working in the public sector or engaged in public-private partnership (PPP) contracts.

• Regulatory. Some industries are highly regulated, and any change in the regulatory regime can have a major effect on business performance for these organizations. Such changes may arise in response to high-profile incidents or new international agreements and are often hard to predict in advance.

• Social/Socio-cultural. Societies are constantly changing, albeit usually at an imperceptibly slow pace. Social norms develop, what was previously unacceptable or even unthinkable becomes commonplace, and old values seem to be left behind. However, values are notoriously hard to change, especially deep-seated cultural characteristics that have existed for generations. And yet revolutions do occur and have done so relatively recently. Businesses that have a strong social component may be vulnerable to such rapid changes in the socio-cultural environment, leading to unexpected increases in risk exposure.

• Technological. Most organizations are exposed to technological risk these days, not just tech companies. The rise of new technologies such as big data, AI, or genomics is likely to present both threats and opportunities that could be significant to many outside the tech sector.

• Uncertainty. This factor is a catch-all that covers all the others, but it also addresses nonspecific sources of uncertainty, including emergent risk. Businesses need to be alert to the known-unknowns, of course, and these are tackled by traditional risk management. But unknown-unknowns require a different approach, especially unknown-but-unknowable-unknowns.

• Volatility. Many of the sources of uncertainty listed previously are exacerbated by volatility, which is the tendency of a variable to exhibit large fluctuations in value. This is usually recognized in areas such as Economics or Market, but it can equally affect others. Volatility is often seen as a short-term issue, since things tend to even out over the longer term. However, even this is no longer true in some areas, as typified by the warning to investors “Past performance is no guarantee of future performance.” Volatility may occur with a longer cycle time, and it does not just affect the short term.

Not all of these sources of uncertainty are relevant to every business, but each organization will be affected by at least some of them. The specific subset depends on the nature of the business, the industry sector, regulatory environment, size, degree of innovation, transnational reach, organizational maturity, competitive pressures, and so on.

We’ll introduce the “risk radar” in Chapter 5 and explain how it can be tuned to the specific areas of interest for a particular business. But for now, it’s enough to say that business leaders should identify those aspects of the external environment that are relevant to their organization, using Figure 2.2 as a prompt list. When the relevant subset of factors is known, the business needs to work out how to monitor each one, looking for signs of a developing Risk Hurricane. In the same way that meteorologists can track the precursors of a natural hurricane, business leaders must be aware of the external environment in which they operate, understanding the sources of risk exposure for their business, and looking out for concentrations of increasing uncertainty that could lead to major disruption.

INTERNAL ENVIRONMENT

The uncertain external business environment bears some resemblance to the warm ocean water, providing the context within which the Risk Hurricane can form. It is, however, not enough on its own—there’s another important contributing factor. The first steps toward the development of a natural hurricane occur when the low pressure of a tropical depression meets warm ocean water. This low pressure corresponds to another factor in the development of the Risk Hurricane, which becomes potent when it interacts with an uncertain external business environment. That necessary other factor is the internal environment of an organization.

Internal environment is best reflected in organizational culture, which is defined as “the values, beliefs, knowledge and understanding shared by a group of people with a common purpose” (Institute of Risk Management, 2012).

The simplest model of culture is the A-B-C Model (Hillson, 2013), which recognizes that Culture is formed by repeated Behavior, and Behavior is shaped by Attitudes. A feedback loop is provided in the A-B-C Model, since Culture influences both Attitude and Behavior. This allows development of either a vicious cycle or a virtuous cycle, as the A-B-C loop becomes self-reinforcing. These relationships are shown in Figure 2.3.

For a Risk Hurricane to develop, one particular element of organizational culture is a key contributor, namely the prevailing risk culture. Drawing on the generic definition of culture, we can define organizational risk culture as “the values, beliefs, knowledge and understanding about risk shared within an organization” (Institute of Risk Management, 2012). The A-B-C Model can then be applied directly in the context of risk. Risk Culture is formed by the way we habitually and repeatedly behave toward risk, in our actions, decisions, processes, and reporting. Risk-related Behavior in turn is driven by our Risk Attitude and the way we think about risk more generally. There are also feedback loops in the risk version of the A-B-C Model. If we think inappropriately about risk, it will lead to ineffective risk-related behavior, and a negative risk culture will develop within the organization. Conversely, if we hold and maintain positive attitudes toward risk, it will produce effective risk management, building a risk culture that is strong, positive, and mature.

The basic links in the A-B-C Model are, of course, only a simplification, and more detailed models of risk culture have been developed. Notable among these is the Risk Culture Aspects Model developed by the Institute for Risk Management (Institute of Risk Management, 2012). This identifies eight aspects of risk culture, grouped into four themes, which are key indicators of the existing risk culture in an organization (see Table 2.1).

It’s possible to use the Risk Culture Aspects Model as a diagnostic framework against which to assess the strength of the overall risk culture of an organization. This can be done either using a simple self-assessment questionnaire or through structured interview and audit techniques. These will expose specific areas of strength and weakness in the existing risk culture, allowing a targeted cultural improvement program to be designed and implemented.

The following questions will help you as a business leader to determine the maturity of your risk culture:

1. What tone do we set from the top? Are we providing consistent, coherent, sustained, and visible leadership in terms of how we expect our people to behave and respond when dealing with risk?

Table 2.1: Risk Culture Aspects Model
(adapted from Institute of Risk Management, 2012)

2. How do we establish and maintain sufficiently clear accountabilities for those managing risks and hold them to their accountabilities?

3. What risks do our current corporate and project culture create for the organization, and what risk culture is needed to ensure achievement of our corporate and project goals?

4. Do we acknowledge and live our stated values when addressing and resolving risk dilemmas? Do we regularly discuss risk dilemmas in value terms and does it influence our decisions?

5. How do our structure, processes, and reward systems support or detract from development of our desired risk culture?

6. How do we actively seek out information on risk events and near misses and ensure key lessons are learned? Do we have sufficient organizational humility to look at ourselves from the perspective of stakeholders and not just assume we’re getting it right?

7. How do we respond to whistle-blowers and others raising genuine concerns?

8. How do we reward and encourage appropriate risk-taking behaviors and challenge unbalanced risk behaviors (either overly risk-averse or risk-seeking)?

9. How do we satisfy ourselves that new joiners will quickly absorb our desired cultural values and that established staff continue to demonstrate attitudes and behaviors consistent with our expectations?

10. How do we support learning and development associated with raising awareness and competence in managing risk at all levels?

By asking and answering these questions honestly, you can determine the maturity of your organization’s risk culture and identify areas of weakness where the current risk culture must be challenged and changed. These can then be pursued by actively managing risk attitudes to change risk behavior and build a new risk culture.

Another way to test risk culture is to examine the risk mindset within a business. This outlines in more detail the “values, beliefs, knowledge, and understanding about risk” of an organization with a mature risk culture. A positive risk mindset includes the following values (Hillson, 2019b; Hillson, n.d.):

• Risk is natural. Life itself is uncertain, and this translates into every type of human endeavor. The risk mindset accepts this reality and doesn’t struggle to remove all risk from every situation.

• Risk is manageable. There is always something we can do in response to each risk. Avoid a victim mentality—we are not powerless as long as we can see risk in advance. The risk mind-set always seeks to influence risk, either by tackling its occurrence or addressing its effect.

• Not all risk is bad. Some uncertainties can be unwelcome if they occur, causing delay, damage, or disruption. But other uncertainties would be helpful if they happened, resulting in reduced costs or time scales, or enhanced performance and reputation. The risk mindset remains alert to both threats and opportunities.

• Risk matters. Risk is always linked to objectives. If a risk happens, it will affect our ability to achieve one or more objectives, for better or for worse. Every risk is important, although some are more important than others. The risk mindset is relentlessly focused on objectives.

• My risk is my responsibility. It’s easy to think that someone else will address risks, and it’s “not my job,” especially at work. But where risk affects my objectives, I need to deal with it. The risk mindset takes responsibility for relevant risks.

• Proactivity is essential. We often adopt a “wait-and-see” attitude to risk, hoping that we might “get lucky,” with bad things not happening and good things just turning up. The risk mindset rejects wishful thinking and unrealistic optimism, understanding that prompt action is often required.

You can use these risk mindset characteristics to test the maturity of your organization’s risk culture. A weak risk culture corresponds to “low pressure,” which makes your organization vulnerable to the effect of an uncertain external business environment in generating significant risk exposure for the business. Where the values listed previously don’t describe the way your organization currently thinks about risk, or where risk-related behavior doesn’t reflect them, you might implement some or all of the following steps:

• Build new thinking habits. Leaders at all levels of the business can be trained to think differently. Take one aspect of the risk mindset and work on it until it becomes natural. This might involve formal training, as well as the engagement of facilitators, coaches, or mentors to support staff in changing how you think and act.

• Develop emotional intelligence. All staff need to be aware of how they think, learn how to check their thinking regularly against the values in the risk mindset, and make reflexive adjustments whenever necessary.

• Communicate clearly. Develop and implement a wide-ranging communication strategy that tells everyone why risk mindset is important and explains its elements in simple terms.

• Be intentional. Take the organization on a journey from conscious incompetence through conscious competence to unconscious competence. Be deliberate and choose change.

Another small parallel with the development of the natural hurricane may be relevant here. The initial low-pressure area that forms a tropical wave is not static: it moves in a westward direction to a place where it encounters warm ocean water, generating the conditions that can eventually lead to a natural hurricane. Similarly, risk culture is usually changing—sometimes imperceptibly slowly and sometimes more rapidly. Just as the tropical wave must move westward if it is to develop further, when risk culture is moving in a specific unhelpful direction, the likelihood of developing a Risk Hurricane is higher. That direction represents an incremental weakening in the risk culture, where poor attitudes toward risk become entrenched, risk-related behavior becomes a tick-box exercise where risk is identified but not proactively managed, and the risk culture continues to spiral downward.

This is why you and your fellow business leaders should pay careful attention to your current risk culture, assessing its maturity in the way discussed previously. If this shows worrying signs of weakness, then the organization needs to embark on a risk culture improvement program. This is likely to take some time, as culture is notoriously difficult to change. However, the A-B-C Model provides a hint about where we might start on the journey of culture change.

Some organizations start with B, thinking that if they impose changes in risk-based behavior, then that will lead to changes in risk culture. So they change risk processes, implement new risk tools, impose new risk reporting requirements, have more risk meetings. . . . All these changes in risk-related behavior are mandated in an attempt to change the way we behave toward risk and therefore change the risk culture. But the A-B-C Model shows that risk-related behavior is driven by risk attitude. If the way we think toward risk remains unchanged, externally imposed changes to behavior are usually temporary at best. When the pressure to change is removed, behavior quickly reverts to how it was previously.

The most effective way to change risk-related behavior in a way that leads to a more positive risk culture is to start at A, changing risk attitudes to modify the way we think about risk and seeking to develop a positive risk mindset.

RATE OF CHANGE

As we’ve seen in Figure 2.1, when the low air pressure of a tropical wave meets warm ocean water, together they form a tropical disturbance. This in itself is quite unremarkable and does not draw attention to itself. Something else is needed if a mere tropical disturbance is to develop further into a tropical depression and then into a tropical storm and ultimately a fully fledged hurricane. In the case of the natural hurricane, this factor is high circulating winds with low levels of vertical wind shear. Wind shear is defined as the amount of change in wind direction or speed with increasing altitude. When wind shear is weak, the storms grow vertically, releasing the latent heat from condensation directly into the air above the storm and allowing it to develop in intensity.

We’ve seen that the interaction between the “low pressure” of a weak organizational risk culture and the “warm water” of an uncertain business environment gives rise to the conditions for development of a Risk Hurricane. Simply existing in an uncertain environment doesn’t necessarily lead to development of extreme risk exposure that has an existential disruptive effect on the business. It’s when a weak risk culture meets the context of significant and sustained uncertainty in the external environment that the business will start to get into trouble. Initially, this may just cause a disturbance in the smooth operation of the organization, and it may go no further than this. But just as the tropical disturbance needs the additional factor of high winds to develop further into a serious storm, there’s a third precondition for a Risk Hurricane—high sustained levels of change.

We’ve all heard the saying “Constant change is here to stay,” or something like it. This well-worn adage exists in a number of forms and it has been attributed to a wide range of speakers and thinkers, but it is nonetheless true. The only certainty in our world is change (and death and taxes, and risk!). What is less certain is the direction and speed of that change. It is commonly accepted that both the rate of change and the scope of change have increased in recent years, affecting such diverse areas as technology, society, communications, and possibly climate.

Change doesn’t present a problem while the organization is able to cope with it, but as the rate of change increases, businesses can find it challenging to keep up. In previous times, when change occurred at a steady and predictable pace, most organizations were able to sustain a rate of learning that was higher than the rate of change. This enabled them to absorb change and continue functioning as before.

However, we’re currently experiencing increasing rates of change that are approaching exponential. If your business maintains its previous way of working, responding passively, and hoping to absorb change within its current practices, it will soon fall behind, become irrelevant and outmoded, cease to be competitive, and ultimately fail. This is likely to create conditions that favor formation of a Risk Hurricane.

To avoid this outcome, your organization needs to respond pro-actively to change, increasing your ability to learn and adapt fast so that you can stay ahead of the curve.

Figure 2.4 illustrates this situation. While the rate of change (the solid line) remains steady and low, most organizations will cope. As the rate of change increases, businesses that fail to respond proactively will be overtaken by changes (the dotted line in Figure 2.4), leading them into Risk Hurricane territory. By contrast, organizations that can learn faster than the world is changing will remain ahead of the curve and avoid corporate crisis (the dashed line in Figure 2.4). The difference occurs at the crossover point, where the rate of change exceeds the rate of organizational learning.

Of course, Figure 2.4 is merely conceptual, and the precise shape of this plot will be different for every organization. This is because the rate of change in their specific business environment will differ, and also their current capacity to cope with change will be different. This means that the crossover point will occur at a different place and time for every organization. Still, each organization needs to be aware of its capacity to cope with change, and business leaders also must be aware of the rate of change which they face. Failing to do so makes an organization vulnerable to an impending Risk Hurricane, where the effect of ever-increasing change can become catastrophic.

The other important point about Figure 2.4 is that the precise position of the crossover point is not fixed. You can take action to increase the capacity of your organization to cope with change. This can be done incrementally, or it can be done in more significant step changes, through such means as innovation, reviewing business processes, or, more radically, undertaking mergers and acquisitions, or entering or exiting a particular market. The dotted line in Figure 2.4 represents a passive organization that has a fixed capacity for coping with change which may increase slowly or not at all. The dashed line in Figure 2.4 indicates a proactive organization that is taking steps to improve its capacity in preparation for likely future change that hasn’t arrived yet, allowing it to stay ahead of the change curve and delaying or avoiding the crossover into Risk Hurricane territory. This proactive capacity development might involve structural changes in the business to improve resilience. This is addressed in more detail in Chapter 6, where we discuss how to prepare for the possible arrival of a Risk Hurricane.

CASE STUDY:
GLOBAL FINANCIAL CRISIS (2007–2008)

In this chapter, we’ve described the three preconditions that lead to development of a Risk Hurricane: a highly uncertain external environment, weak risk culture, and high rates of change. A representative case study will help us to see how these combine together in practice.

The global financial crisis of 2007–2008 (GFC) has been widely studied as an example of unforeseen extreme risk exposure that led to major business disruption. We could use it throughout this book to illustrate many of the elements of a Risk Hurricane, but that would mean ignoring other instructive examples that offer valuable insights. Instead, we’ll focus here on what led to the GFC, demonstrating how the three Risk Hurricane preconditions were at work.

The GFC was preceded by widespread lending at low interest rates by banks and other financial institutions in the United States to low-income customers wishing to purchase homes, in what became known as subprime mortgages. This had been encouraged by earlier legislation that encouraged lending to support affordable housing. New lenders entered the market with predatory low rates, targeting low-income ethnic minority customers, and the availability of cheap mortgages created a housing bubble in the United States, with around 20 percent of all mortgages in 2004 to 2006 being classified as subprime.

Financial institutions then packaged together these risky mortgages with other less risky assets, creating mortgage-backed securities and complex derivative products that were hard to monitor or regulate. Credit rating agencies assigned safe ratings to these assets, and they were sold to investors who were probably unaware of the level of risk they were taking.

The housing bubble burst in 2007, house prices began to fall, and mortgage rates went up. As a result, subprime customers started to default on their loans, and by August 2008 approximately 9 percent of all U.S. mortgages outstanding were either delinquent or in fore-closure. The value of mortgage-backed securities and related derivatives collapsed, leading to severe losses for financial institutions worldwide and a subsequent international banking crisis. The impact was much broader than the finance sector, of course, sparking a global recession that was the most severe since the Great Depression of the 1930s, with massive government bailouts to prevent collapse of the global banking system.

Much more could be (and has been) said about the causes and consequences of the GFC. There is no doubt that it qualifies as a Risk Hurricane! In the context of this chapter, however, we can see with hindsight the existence of the preconditions that led to the formation of the GFC.

Uncertain External Environment

Several of the factors in Figure 2.2 contributed to a highly uncertain external environment within which the GFC took shape. These include the following:

• Ambiguity. The use of mortgage-backed securities (MBS), collateralized debt obligations (CDO), and credit default swaps (CDS) masked the true level of risk involved in subprime mortgages, making these assets appear to be safe for investors.

• Complexity. The bundling of securitized assets introduced a degree of complexity that made it virtually impossible to track their actual level of risk exposure.

• Ethics. The presence of predatory lenders in the subprime market was driven by unethical practices, exploiting the desire of low-income customers to benefit from the housing bubble.

• Regulatory. Earlier deregulation of financial markets in the United States was a contributory factor to the GFC, allowing self-regulation of the derivatives market, and relaxing the net capital rule, enabling investment banks to substantially increase the level of debt they were taking on.

Weak Risk Culture

At the heart of the GFC was a misunderstanding of the true level of risk exposure. This was made possible by the prevailing risk culture of the time, which viewed risk pricing merely as a technical function. The possibility of falling house prices and the consequential risk of default associated with subprime mortgages were underestimated at all points in the investment chain, and there was no awareness of the aggregate risk associated with securitization of mortgage-backed assets.

None of the characteristics of a strong risk culture shown in Table 2.1 were evident in the leadership of banks and other financial institutions, with risk appearing to be absent from strategic discussions and decisions. A stronger risk culture would have set clear risk thresholds for the organization, with corresponding accountabilities and timely risk reporting.

High Rates of Change

Once the housing bubble burst and borrowers started to default on their loans, the situation unraveled very quickly. Government, regulators, and financial institutions were all taken by surprise and were making crisis decisions in panic mode in an attempt to impose some control and order. It’s clear with hindsight that all the key players were operating in the gray zone of Figure 2.4, with the speed of their responses being some way behind the rate at which the situation was changing. Decision-making was overtaken by events, leading to suboptimal decisions and outcomes.

CLOSING CONSIDERATIONS

Now we know the preconditions for forming a Risk Hurricane. Armed with this knowledge, business leaders should consider the following actions:

1. Take the temperature of your external business environment, looking out for “hotspots of uncertainty” in the surrounding waters. Review the sources of uncertainty in Figure 2.2, determine which ones are hottest for your organization, then find the ones to which you’re most vulnerable and that you need to monitor most closely.

2. Test the internal environment of your business by assessing organizational risk culture. Be on the lookout for signs of “low pressure,” with a weak risk culture indicated by the absence of a mature risk mindset and ineffective risk-related behavior. Determine which aspects of the risk mindset require urgent attention, and take immediate steps to strengthen them.

3. Monitor the rate of change around you. Change is often not easy to influence, but we can and must be aware of it, so that we are well placed to weather the “winds of change.”

Clearly the one precondition for a Risk Hurricane over which we have most control is our organizational risk culture, and this is where we should pay particular attention. A strong and mature risk culture will mean that even if the external business environment is highly uncertain and the winds of change are gathering pace, our organization will be well placed to avoid the development of a full-scale Risk Hurricane.