A risk management system is only as good as the incentive system it operates in. Today, companies use a wide variety of approaches to assess risk, ranging from expert judgment to quantitative, model-based methods. But regardless of the method, one thing keeps showing up: the quality of a risk analysis is determined above all by the incentive structures under which it is produced. A cat that encounters a dog makes a risk assessment: dangerous or not? It decides based on its own experience and bears the consequences itself. This link between judgment and accountability for the outcome is what makes the assessment work. Entrepreneurs act in a similar way: they decide because they are convinced a venture is worthwhile, even though it can fail. They bear the consequences, and that is exactly what makes their judgment robust. It becomes problematic when the people assessing risks do not bear the consequences. Often the situation is then reversed: for them, the risk is not the risk itself, but the assessment. Instead of thinking about the risk, they consider what consequences their statement could have for them personally: Do I have to justify myself? Will I become visible to top management? Could the assessment come back to bite me later? The actual risk disappears, and in its place a meta-risk of speaking up emerges. When risk analyses are additionally driven by extrinsic motives, for instance because they are “expected” for supervision or audit purposes, risk analyses become political, defensive, or symbolic, but not decision-oriented. The consequence: Anyone who wants to judge whether a risk management system will work should first examine the incentive system. If it is calibrated wrongly, one thing is certain: the system will fail before it has even begun. Checklist: is the incentive system sound? ✅ Good signs: • Skin in the game: the people assessing risks also bear their consequences. • Genuine interest: risk analyses serve a real decision, not a box-ticking exercise. • Feedback loops: earlier assessments are regularly reviewed. • Accountability: it is clear who stands behind which assessment. • Transparency: assumptions and uncertainties are openly stated. • Learning culture: mistakes may be analyzed rather than covered up. 🚫 Disqualifying signs: • No personal stake: those making the assessments are decoupled from the consequences. • Formal compulsion: risk analyses are produced only for documentation purposes. • Political distortion: results get “optimized” upward. • Anonymous accountability: no one stands behind an assessment. • No feedback: risks that occurred are never reviewed. • Culture of sanctions: whoever names risks honestly puts themselves at risk. A risk management process only works if the incentive system is designed for truthfulness, accountability, and the capacity to learn.
This post was originally published on LinkedIn. View and join the discussion there