RISK MANAGEMENT?
?
?

10 | QUALITY WORLD | SPRING 2021

RISK MANAGEMENT

Critical thinking andrisk-intelligent
decision-making in theCovid-19 age
Jayet Moon, CQP MCQ, Quality Lead at Terumo Medical Corporation,
Maryland, US, and author of Foundations of Quality Risk Management:
A Practical Approach to Effective Risk-based Thinking, unpicks thepsychology behind our responses to threats and risks, and explores how we
can make better decisions in the face of major threats, such as Covid-19

M

anaging risk effectively
requires a high level ofcritical thinking andadvanced decision-making
skills. But complex, multifaceted risk
management is not a natural act forhumans. We are wired for automatic,knee-jerk reactions and riddled with biases
and heuristics, the subconscious mental
connections that allow quick judgements.
To make the right decisions, we need
to be able to assess the available facts
objectively and regulate our instinctive
and emotional responses. In a crisis such as
the one created by Covid-19, the challenge
is to be able to assess risk critically andprovide measured, unbiased responses,

thereby protecting and creating value forour organisation.

The psychology of threat response

Evolution has primed us to respond witha flight or fight reaction when faced witha threat. This first response is fast, andprone to be influenced by our emotions
and our existing biases. It is often called‘System 1’ thinking, a term popularised bypsychologist Daniel Kahneman in his 2011
book, Thinking, Fast and Slow. A System
1 response is often the first subconscious
decision point, and this sort of knee-jerk
thinking is undesirable when critical andcomplex problems need to be ponderedand solved. When seen through the lens

QUALITY.ORG | 11

RISK MANAGEMENT

Defining attitudes to risk

How we respond when faced with a threat is
also determined by our underlying attitude
to risk and our appetite for it. There are
four main descriptors of risk attitude:• Risk averse: an increased sensitivity
and extreme reaction to threats, and ahesitant attitude towards opportunities.
• Risk neutral: a willingness to consider
the long-term implications of risky
decisions and focus on risk-benefit
analysis before acting.
• Risk tolerant: accepting of common
and routine risks, which may lead tounderreaction to more extreme risks
and opportunities.
• Risk seeking: a high tolerance for risktaking and a drive to capitalise on
risky opportunities, while tending tounderreact to threats.

12 | QUALITY WORLD | SPRING 2021

PILLARS OF EMOTIONALINTELLIGENCESELF-AWARENESS

Being mindful of one’s emotions,both impulsive and nonimpulsive. Consciously studying
the negative and positive
thoughts and their drivers.
Understanding the impact ofemotions on one’s behaviourand decision-making, thereby
knowing one’s limitations andstrengths.

SELF-MANAGEMENT

Emotional self-control: Keeping
disruptive emotions andimpulses in check.
Adaptability: Flexibility
in handling change.
Initiative: Readiness to act
on opportunities.
Optimism: Persistence inpursuing goals despite obstacles
and setbacks.

SOCIAL AWARENESS

Empathy: Sensing others’
feelings and perspectives andtaking an active interest in theirconcerns.
Organisational awareness:
Reading a group’s emotional
currents and power relationships.
Service orientation:
Anticipating, recognising andmeeting customers’ needs.

During the Covid-19 pandemic, we haveseen different risk attitudes at work ingovernmental and private sector decisionmaking. In terms of government, many
countries defaulted to risk avoidance by
being risk averse, the outcome being
lockdown. However, some countries, suchas Sweden, took a risk-tolerant or riskneutral approach. Using a country-specificquantitative analysis, policy-makers decided
to forgo a total state-enforced lockdown
in the belief that the public health system
was unlikely to be overwhelmed.
Of course, risk attitudes aren’t justdetermined by a decision-maker’s personality
type, and neither are they static; thesituational and organisational context
in which the threat occurs plays a part inrisk-based decision-making, so risk attitudes
can fluctuate based on these factors. The
UK government changed its approachfrom risk tolerant at the beginning of
the crisis to a risk-averse approach as theburden on health systems was projected
to drive capacity near to its limits.

Risk appetite

Risk appetite is closely related to risk attitude
and is defined as the willingness of a decisionmaker to seek risk in anticipation of future
benefits. It relates to how much an individual
or organisation can ‘stomach’ the risk or
associated uncertainty. Risk appetite istherefore an outcome of risk attitude.
Some companies are inherently risk
averse, while some are more willing to takechances. One example of an organisation
with a strong appetite for risk is the US
company, Moderna Inc. In its efforts todeliver a vaccine for Covid-19 in a timeframethat some considered too short, thecompany was seeking to capitalise on its
strengths by seeking risk in a sector fraught
with uncertainty. Moderna’s messenger
RNA (mRNA) platform injects syntheticmRNA into live cells with the aim of

SYSTEM 1 THINKING AT WORK
“We lost two employees to Covid-19, one of whom I knew personally. It isa deeply saddening loss. We will not be returning to the office any timesoon and will be working from home.”
The negative emotions associated with a colleague’s death have created an“emotional tag” connected with Covid-19. If this person relies on System 1
thinking and does not critically evaluate decisions, then this tag will largely
govern their attitude and actions with respect to the lockdown and less weight
may be given to other objective factors, such as transmissibility of the virus,
case fatality rate, operational risk and so on.

Left [System 1 Thinking at Work]: Adapted from HBR’s 10 Must Reads on Emotional Intelligence (withfeatured article “What Makes a Leader?” by Daniel Goleman) (2014, Harvard Business Review Press).

of System 1 thinking, the biological role ofemotion is to produce a fast and specificreaction to an inducing situation. However,this becomes harmful when decisions
regarding risk involve prediction, ie, thinking
far into the future. For decision-makers inorganisations faced with non-local risks,such as the impact of Covid-19, where amultivariate mental analysis is needed,
this System 1 thinking will often lead toa wrong decision.
So how can we avoid falling into this trap?
Emotions bestow humans with large capacity
for directed and intentional responses. In
System 1 thinking, these responses arefast triggered by uncontrolled emotions.
Elements of emotional intelligence (EI),
such as self-awareness, self-management
and social awareness (see sidebar, right),
can help us gauge and, where needed,
bypass the System 1 reactions throughmonitoring our feelings and managing
them. If we are able to slow down our
thought processes, focus on objective facts
and view our own emotional reactions ina self-aware manner, we have a greater
chance of making a rational decision. Thisis known as System 2 thinking, a deliberateand complex mental process in which thedecision maker makes all possible attempts
to remove bias, weigh pros and cons, andovercome misleading emotional triggers
to challenge their own assumptions andexplore different courses of action andtheir possible outcomes (consequences).
System 2 thinking is risk-aware thinking
and from a personal standpoint, is riskbased thinking.

RISK MANAGEMENT
reprogramming cells to generate antigen,which will stimulate immune responses.
Conventional vaccines rely on direct injectionof pathogen (antigen) to trigger the body’s
immune response. Moderna’s approach
can drastically speed up vaccine delivery
timelines and reduce costs, but it was an
unproven technique; no previous mRNA
vaccines had been licensed.
The upside for Moderna was the potential
for tremendous rewards if its vaccine was
successfully trialled and licensed for use.
It appears that Moderna’s risk-taking has
paid off, as its mRNA vaccine has beenauthorised for use in the EU, UK, US and

UNCERTAINTY

Facts/
evidence

Heuristics

Bias

Objectivity

Awareness of
subconscious
decision point

SELF-MANAGEMENTSELF-REGULATIONSOCIAL AWARENESS

ENTERPRISE RISKOUTLOOK

Canada so far. Many other organisations
are developing Covid-19 vaccines using
conventional and mRNA approaches, someof them large pharmaceutical companies,
but they were reluctant to promise adelivery date as early as Moderna’s. This isa risk-neutral approach, which is informedby the strengths and weaknesses uniqueto those companies. While Moderna’s
vaccine was not the first to be approved,
its attitude to risk- and objective-setting at
the beginning of Operation Warp Speed,
set the benchmark for other firms.
Organisational risk appetite is only
one of the many things that feed into a
decision-maker’s own risk response andthe decision-making process. For example,
different departments and functions within
an organisation can also have their own
risk appetites – project management
or quality departments are often risk
averse while marketing or sales may be
risk-seeking.

The risk-intelligent decision

Figure 1 demonstrates how all thesefactors can come together in the courseof an individual decision. It represents theprocess that should occur in the mind of

PERSONAL RISKPERCEPTIONDEPARTMENTAL RISKAPPETITE

INFORMED RISKATTITUDE

Figure 1: A modelof risk-based
decision-making

RISK-INTELLIGENTAND EMOTIONALLYINTELLIGENT DECISION

the decision-maker when faced with anuncertainty, and highlights the central
role played by emotional intelligence inreaching a risk-intelligent decision.
The ability to overcome biases, challenge
assumptions, understand situational
context in risk terms and understandorganisational and social context are
all major aspects where EI can directly
help the formation of risk attitudes. The
cognitively complex risk-intelligent decision
involves assessment and evaluation ofprobabilities and consequences of multiple
decision pathways, which can reduce
threats, increase opportunities and create
value. The chances of this increases when
EI activates System 2 thought processes.

Organisational risk management

In the face of a serious external crisis suchas Covid-19, the main aim of a government
or an organisation is to reduce the negative
economic, human and reputational impact.
And, where possible, generate a positive
impact by leveraging available strengths,
as in the case of vaccine producers, mask
manufacturers and auto manufacturers who
have been able to retool their factories,
and the investment firms who have offeredpandemic-related products.
ISO 31000:2018, the industry standard
for risk management, asks for many
steps, but the following are integral to
the risk assessment that precedes therisk response:

QUALITY.ORG | 13

RISK MANAGEMENT• Risk identification• Risk analysis• Risk evaluation.
The process described in Figure 1 helps
remove subjectivity during every step of
ISO 31000, and attempts to reconcile thehuman aspect of decision-making with theorganisational risk management strategy.
Risk identification sounds easy, but thisfoundational step is often prone to errorsthat are then propagated through the risk
management steps that follow, leading toincorrect risk responses. The risk can be
identified at the enterprise level, strategiclevel, operational level, or at the level ofproduct or process. Each risk identified
along this hierarchy will have a different
and, often, cascading impact. Identification
is followed by analysis, which involves
assessing the nature and level of risk, andthen risk evaluation, which determines its
acceptability. Figure 2 illustrates thesesteps. Risk assessment and its feeders
drive the organisational risk response.
Risk monitoring and review feeds backinto the risk reassessments for updated
risk responses. Every step in this cascade,requires critical System 2 thinking.
Correctly assessing a major risk such as
Covid-19 is a challenge. Objectivity has
always been difficult, but is more so in
the era of Industry 4.0, where there is adeluge of information that can often be
confusing. The media, especially social
media, often presents us with conflicting
information and is also continuously vying
for our attention and subconsciously
shaping our System 1 thinking. A threatsuch as Covid-19 not only affects our
professional lives, but our personal lives
as well. Therefore, our risk response may
be even more prone to subjective biases
and emotional undercurrents.
Secondly, organisations don’t normallyplan for scenarios like this in terms ofrisk. There are, of course, emergency
management plans but they are reactive.
The introduction of risk management
into emergency management, business
continuity and even quality planning is
the better and more proactive approach.
ISO 22301:2019 Security and resilience –Business continuity management systems– Requirements, emphasises business
impact analyses and risk assessments,
but does not draw out links between
the two in detail. The business continuity
management system should be integrated
into the business processes. The capabilityof an organisation to continue deliveryof products or services despite disruption
largely depends on the assessment andresponse to that disruption in the context
of organisational capacity and the hit tothat capacity. This is where risk intelligenceand risk resilience come face-to-face. The
challenge when faced with a crisis is tobe able to quickly and critically assess
risk and provide unbiased, measured risk
responses, thus protecting and creating
value for the business.

Actionable guidance for thequality practitioner

Risk-intelligent thinking is the sine qua nonof risk management, as every step of therisk management process per ISO 9001

Update mitigation measures
per the risk assessment

CRITICAL THINKING AT EVERY STEP
Risk
identification+

Risk
analysis+Riskevaluation

Figure 2: The risk management process per ISO 31000

14 | QUALITY WORLD | SPRING 2021

or ISO 31000 involves decision-making.
Quality professionals are frequently called
upon to take decisions with organisational
consequences, and nurturing aspectsof risk-intelligent decision-making, asdetailed below, can help them make thecorrect decision, while taking into accountmultidimensional factors:• Understand uncertainty aroundthe decision. Acknowledge known
knowns, known unknowns and unknown
unknowns.
• Inculcate fact-based thinking.
Comprehend the available facts andtheir level of objectivity. Identify missing
facts and make an effort to retrieve them.
Understand the distinction between
raw data, observations, perspectives
and processed information.
• Uncover assumptions behind purported
facts. We are not as rational as we
think. Many observations will havesome assumptions; understand andquestion these assumptions to uncover
their true nature and validity.
• Gain self-awareness of your emotional
response. At times, during high-risk
decisions, emotions can also be high,defaulting us to System 1 response.
Counter that by emotional intelligence.
Create a gap between stimulus andresponse and increase cognitive control
to generate capacity and time toobserve contents of our own mind.
• Understand the context of decisions.
Comprehend external and internalorganisational environment from asystems standpoint (across businessprocesses, functions and hierarchies),
which form the risk context, ie, thecontext within which the organisation(and decision) is seeking to achieve
objectives.
• Understand risk attitudes and appetites.
As a part of understanding the context,=

Risk
assessmentaMitigation
measures

Verify effectiveness perrisk assessmentaMonitor andreview
effectivenessRISK MANAGEMENT
Figure 3: A risk competency framework

RISK GOVERNANCERISK LEADERSHIP

Structural framework for risk
management• Assessment of organisationalrisk capability and capacity(maturity)• Internal and external risk
governance•

Strategic risk thinking• Risk-based systems thinking• Fact-based decision-making• Risk planning for risk resilience•

CONTEXT

Knowledge of organisational core competencies anduncertainties affecting organisational goals. Clarity on
sources of risk data/information and knowledge on its
usage for risk assessments/responses. Knowledge ofstakeholder risk attitudes and appetite

RISK-INTELLIGENT THINKINGRISK ASSURANCE
Creating risk-resilient systems
Ensuring effective risk
communication• Supplier/supply chain risk
management• Change management• Continuous risk measurement
and prioritisation
•
•

•

•

•

•

•

•

identify stakeholder risk outlook. A riskaverse stakeholder is not likely to agreewith a risk-seeking decision. Understandyour own risk outlook and be aware of
how it is affected by stakeholders.
Identify available decision paths andcritical parameters for success. It’s likelythat more than one decision may apply
to the issue at hand. Understand eachdecision path by analysing consequenceof each decision and probability ofvarious consequences of the decision.
Choose amongst alternative options.
Check for biases. Use self-awarenessto test whether your mental inclination
towards the decision is result of a biased
reality. Do an assumptions check.
Evaluate probability and impact offailure and success of the chosendecision. Anticipate failure and identify
critical points. Use this information
to identify preventive approaches tomaximise the success of the decision.
Consult with stakeholders and gain their
buy-in. Success of decision depends on
its acceptability by various stakeholders
affected by it.
Implement the decision with highest
amount of probability of success andpotential for organisational benefit.
Monitor the outcome of the decision
and adapt dynamically as the context
changes to ensure the consequenceof the decision remains as intended.

System 2 thinking
Questioning assumptions and biases• Applying emotional intelligence• Critical and complex thinking••

It encompasses policies, procedures, andprocesses that dictate risk management
approaches, methods, and oversight.
Its maturity must be assessed andgaps closed.
• Risk assurance: In an internal andexternal context, ensure that risks arecontinually monitored and reviewed.
The external data should feed backinto risk reassessments to allow for
proactive risk-planning with the sole
aim of providing business assurance
by ensuring system stability.
• Practice risk-intelligent decisionmaking: Risk management is a complex
process and involves prediction andrapid adjustment. Decisions basedon biases and assumptions eat at
the foundation of organisational risk
management process, which in turncause failures.

Lessons for futurerisk management
Proactive monitoring forms the basisof resilience.
• Control any expected secondary
outcomes of the decision and identify
emergent risks. This involves synthesis ofavailable knowledge and organisationalframework for rapid risk response.
Holistic risk management requires asystems approach, as shown in Figure
3. An understanding of the following
points allow for a integrated end-to-end
risk management approach, which will
help businesses to survive and thrive andprotect investors and jobs.
• Risk leadership: Risks cascade fromthe strategic mission level to the
product/service level. Strategic riskthinking is based on a holistic viewof the organisation as a system anduncovers the current and potential
hazards to various parts of the system.
Risk managed at one organisational
level allows for opportunities for value
creation at other levels. Mismanaged
risks will lead to reduction in value
as risks may magnify as they shift
through the system across cascadinglevels. Plan for risk resilience with asystems-thinking mindset.
• Risk governance: This refers to thestructural framework that governs
the organisational risk management
activities and related decision-making.

External risks of large magnitude stressthe system and always bring to lightdormant issues. Some companies, as wehave seen in the media, have filed forbankruptcy, while some within the same
sectors have been more resilient and havesurvived. Resilience stems from a thoroughunderstanding of organisational context
and its vulnerabilities, and rapid, targeted
action through proactive planning. On
a deeper level, a system under stressor shock will also reveal the flaws indecision-making processes, and previous
decisions will be challenged and may attimes prove incorrect. Even a decisionthat is well thought out is still made withsome anticipation of organisational andmarket behaviour, which may turn out tobe inaccurate. Furthermore, a large crisis
will create multiple hazards for various
arms of the organisation, which will needunique risk assessments and targetedrisk responses.
A major learning from Covid-19 is that,in future crises, a simple emergency
preparedness or response plan may not
be sufficient to ensure business continuity.
Risk management should become central
to the business continuity plan, whichshould be founded upon risk-intelligent
and critical decision-making from strategic
to operational levels. This is vital in the
post-Covid-19 world as we begin to ensure
our organisations are resilient, flexible
and adaptable in face of fast-changing
threats that may arise in the future.

QUALITY.ORG | 15