Risk and Rewards

In a complex world, risk management means weighing odds and placing smart bets.

Among the first things Michael Chertoff did after he was sworn in as secretary of the Homeland Security Department in February was to announce his plans to better manage national security. Central to his approach would be a sharper focus on what he termed "risk management."

In a March speech at The George Washington University in Washington, Chertoff said: "Risk management is fundamental to managing the threat, while retaining our quality of life and living in freedom. Risk management must guide our decision-making as we examine how we can best organize to prevent, respond and recover from an attack."

Chertoff's emphasis on risk management addresses criticism of grants to states and localities for preventing and responding to terrorist threats. Through these grants, the department (following orders from Congress) distributed billions of dollars without first making sure the funds were directed toward likely terrorist targets. Large amounts were used to subsidize local police and fire departments. Other funds went toward equipment that responders didn't need or weren't trained to use.

Any armchair manager can see that preparedness and response funds should go to the places most likely to need them. But figuring out which cities and states deserve federal grants and how to distribute the funds (for example, how much to protect a power plant, water treatment facility or shipping port) is a challenge even to the best minds.

On Aug. 31, Lt. Gen. Carl Strock of the Army Corps of Engineers appeared on the ABC News program Primetime Live. When asked whether the levees surrounding New Orleans should have been built to hold up in a storm as large as Hurricane Katrina, which devastated the entire city, Strock replied: "No, I don't think so. We had done the analysis and we felt that Category 3 was the appropriate level of protection there."

Strock went on to explain that the Corps had done a "benefit-cost ratio" that showed the expense of guarding against a Category 4 or Category 5 hurricane outweighed the protection.

The announcer's response-"Well, that cost-benefit analysis may not look so good today"-reflects the fact that the Corps' mathematics either underestimated the probability of a larger hurricane hitting the area or undervalued the consequences.

If risk management is a science, it's an imperfect one. At its core is the effort to make the unknown known-something we can approximate only by applying current information to historic patterns. The flooding of New Orleans is a vivid reminder of this reality.

To make calculated risks, and to set Homeland Security strategies, experts will draw on principles of risk management developed by structural engineers, insurance companies, natural disaster managers, the financial industry, public health experts and others.

Risk management has gained currency in recent years across the public and private sectors as corporations and government agencies have sought to apply more sophisticated techniques to assess, prepare for and cope with the risks inherent in doing business in a complex world.

Many large companies now have executive-level chief risk officers, and Kimberly Thompson, a professor of risk analysis and decision science at the Harvard School of Public Health in Boston, calls this "the age of risk management." Says Thompson: "We now know there are unintended consequences of decisions, and our ability to compute risk is very high."

But what, exactly, does it mean to "manage" something as seemingly unpredictable and potentially devastating as risk? Besides avoiding hazardous endeavors, how can individuals and organizations protect themselves?

THINKING AND FEELING

The reason we need a formal method for coping with risk has a lot to do with the way our brains are programmed. "The fundamental way that we respond to risk is through our feelings," says Paul Slovic, an expert in risk perception and assessment who is a psychology professor at the University of Oregon and president of Decision Research, a nonprofit corporation in Eugene, Ore. Does a particular danger worry us, or make us feel uneasy? Does it evoke dread? Do we have a personal connection to it, or have we seen images of it on television? Emotional responses have served as a guide to risks throughout human history, and researchers have shown that patients who suffered damage to the part of the brain that controls emotions have been unable to respond to and to protect themselves from danger.

Humans always have faced serious risks, including natural disasters, predators, violence, disease and famine. But today's risks are more complicated and harder to understand, says Slovic.

In addition to terrorism, we face computer viruses, identity theft, toxic waste, prescription drug side effects, hackers and more. "And there always seem to be some new things coming up," he says.

Emotional responses are very fast and can be highly effective, Slovic says, especially in situations in which we have lots of experience, such as driving a car. But feelings can confuse us, creating a distorted view of dangers.

Risks such as terrorism that are linked to strong emotions can seem more probable than they actually are. "When the feelings are strong, we ignore the probability and act as if [the event] is likely," Slovic says. We underestimate other dangers when, for example, we can't connect them to an experience or image and understand them only as abstract statistics.

Fortunately, feelings no longer are our only tool for dealing with risk. "We also, when we can, use analytic thinking, which is a much more recent development in the human mind," Slovic says. "We've only been analyzing risks with probabilities and mathematical concepts and science in the last few hundred years of human existence, but we've gotten pretty good at it." We can detect possible hazards, calculate their probability, assess the consequences and determine the best way to prevent or prepare for them.

Slovic gives the example of deciding whether water is safe to drink. "In the past, we did that through our experiential senses," he says. We would perhaps look at and smell the water source, and judge whether we got sick after drinking from it the last time.

Today, we worry about trace amounts of carcinogens and other harmful chemicals, and will test and clean up the water to ensure it doesn't pose short- or long-term health problems.

Risk management uses analysis to compensate for the shortcomings of instinctive, emotional ways of sizing up and responding to risks. The growing interest in risk management is "both a recognition that risk is part of life and that if we use the tools that are available to us, we can do better than if we let the fates decide," says Thompson, of the Harvard School of Public Health. The first step is to take stock of the possibilities, probabilities and consequences. Quantifying risks often reveals that the high-profile dangers we worry about aren't as likely as others that don't get as much attention. Fear of flying is prevalent, for example, though far more people die in car accidents.

But risk management goes beyond making assessments to weigh the costs and trade-offs of interventions, the likelihood of their success and the other priorities competing for resources.

The best solutions-low cost but highly effective measures-often seem mundane compared with the flashy or complex answers we crave for risks about which we have strong emotions. One of the most effective examples of risk management is the seat belt, which saves more than 10,000 lives each year, according to the National Highway Transportation Safety Administration.

"Most of us in public health risk management spend our time reminding people to do things that their mothers should have told them to do," such as washing your hands, forsaking cigarettes and wearing seat belts, Thompson says. "That tends to make it not such hot news, but these are really important things." She cautions against assigning priority to risks based on the emotions they trigger. A vital question to ask, Thompson says, is: "Are we putting so much focus and resources on the scary 'what ifs' and in the meantime not focusing enough on the stuff that is causing people to be unhealthy?"

TOUGH CALLS

In November 2004, the Agriculture Department confirmed that a plant disease called soybean rust had made its first appearance in the United States, as reported in a Louisiana State University research field. The disease is caused by wind-borne spores of a fungus from Asia that first reached the Western Hemisphere in 2001 when it wiped out large swaths of soybean fields in South America by defoliating the plants before they could produce seeds.

Within three weeks of Louisiana State's findings, soybean rust showed up in Alabama, Arkansas, Florida, Georgia, Mississippi, Missouri, South Carolina and Tennessee.

Farmers had three options: They could live with the risk and face possible financial ruin. They could avoid the risk by switching to a different crop. Or they could mitigate the risk with insurance and by treating the plants with fungicides that kill the disease.

In this case, the third option made the most sense, but farmers needed a way to make the most of limited resources-to treat the plants when necessary without wasting chemicals on false alarms.

Estimates showed that the United States had only enough chemicals to spray about one-sixth of the national crop, and because of environmental regulations, some chemicals could not be used more than three times.

As soon as the disease was identified, Agriculture's Risk Management Agency swung into gear. The agency helps farmers manage their business risks with insurance through the Federal Crop Insurance Corporation, which it oversees, and by providing guidance and information. The Agriculture Department developed a method to track the flow of the disease, and RMA worked with universities to provide guidance to farmers on when to spray their crops.

"Everyone was going out and talking about what they should and shouldn't do," says E. Heyward Baker, director of risk management services at RMA. "What they were emphasizing was not to spray unless they had to."

As long as the farmers treated the soybean plants when they were supposed to-or documented that they had tried, but the chemical or equipment were unavailable-they were covered by the crop insurance.

Fortunately, soybean rust has not yet hit U.S. fields as hard as some feared, and RMA's strategy proved effective.

Sometimes, though, the cost of guarding against a risk is deemed too high-either because of limited resources, financial expense or some other trade-off-when balanced against the probability of a danger and its likely consequences.

Jim Crockett, manager of risk for Denver Water, a public utility, remembers a proposal about 10 years ago to put up a 6-foot chain-link fence around Dillon Reservoir, a beautiful mountain reservoir that's also used for boating and fishing. The fence would have cost around $10 million, he says, and probably wouldn't have been very effective.

"Someone could drive a truck through it if they wanted to get in," he says. Worse, the community would have objected to restricting access to the natural resource. "Politically, it just wouldn't have been possible," Crockett says.

THE GREAT UNKNOWN

Predicting terrorism is even more difficult than forecasting natural disasters. "With our action, we change the probabilities. The terrorists always look for the weakest link," says Detlof Von Winterfeldt, director of the University of Southern California's Center for Risk Economic Analysis of Terrorism Events, which was founded with a grant from DHS. "If we fortify one target, another may become more attractive."

To calculate probabilities of terrorism, researchers are using risk management tools from other areas. "We're trying to fit whatever is useful," Winterfeldt says. Game theory, a model for predicting human interaction often used in economics, helps determine how terrorists might adjust their plans to react to our counterterrorism strategies.

And in looking for trends that could help forecast the future, researchers have found that the logistics of terrorism are useful predictors.

"When you plot out historic terrorist events, you see the smaller the bomb, the more often it gets used," says John Abraham, a spokesman for Risk Management Solutions Inc., a Newark, Calif.-based company that specializes in quantifying and managing catastrophic risks. "Terrorists are using logic to trade off how they're going to accomplish their goal, which is to create chaos."

Winterfeldt says one way to quantify terrorism risk is to assume that terrorists are attempting a certain project, for example, detonating a dirty bomb in Los Angeles.

"Then you can figure out the likelihood that they'll succeed," he says. That analysis gives you an upper limit of the probability of such an event, but determining which projects terrorists are likely to undertake is almost impossible without specific intelligence.
"Ultimately, the question comes to where should we put our money," Winterfeldt says. "Those are very, very tough questions."