When treating a risk creates another risk and so on and so on

Sometimes in an effort to treat an issue, we generate a different risk or increase an existing one in the process. Many of us can relate to when the internal auditors come in, look at existing processes and weak controls and “strongly suggest” that management fix the problem. Quickly.

Management’s solution is often a series of manual processes and spreadsheet generated reports plus workarounds that mitigate the initial risk (but more importantly closes the outstanding audit point!) while creating countless more process waste and operational risks.

Here’s a real example from history from the book At Home by Bill Bryson – A Short History of Private Life (Chapter VI – The Fuse Box).

“In 1939…Great Britain introduced stringent blackout regulations to thwart any murderous ambitions by the Luftwaffe. For three months it was illegal to show any light at night, however faint.”

According to the author, one could be arrested for smoking in a doorway or holding up a match to read a sign. Drivers drove stealth: not even lights on the dashboard. They had no idea where they were going or how fast they were driving. Cars drove down the middle of the road and collided with cars doing the same thing coming from the other direction. Similarly, pedestrians walked into “lampposts, trees and furniture”.  People were dying and getting hurt all in an effort to not die or get hurt in a yuckier and different way.

In the book Bryson notes, “During the first four months of the war a total of 4133 people were killed on Britain’s roads” – double the deaths from a year earlier. Three quarter of these deaths were to pedestrians. He explains that the Luftwaffe was killing hundred people a month without dropping a single bomb.

(Eventually some illumination was permitted and this craziness stopped.)

I guess the lesson to be learned is that we should think through our risk treatment strategies carefully while considering all downstream effects rather than implement some half-assed solution merely to check off a box on an audit report.

3 thoughts on “When treating a risk creates another risk and so on and so on

  1. Americans might call it the “Rub Dirt In It” fallacy. Despite what young boys may think, rubbing bacteria on a wound does not reduce the pain or speed healing. Doing nothing is actually preferable.

  2. In the world of crime prevention I suppose that’s related to the concept called “displacement”, where what you do may prevent a crime happening in one particular place or time, or under one particular set of circumstances, but enables (or encourages) a different crime or the same crime in a different place or different time, or sometimes just shifts the circumstances in an often unpredictable way.

    It’s impossible to be sure about such things, but it seems likely that almost all “crime prevention” tactics that target pre-meditated forms of crime “probably” result in displacement rather than actual prevention (if I am a career burgler I will break in somewhere…maybe not the house with the alarm, but I have to do my job…right?).

    The problem is that you can’t tell the difference between a pre-meditated and an opportunistic crime just by looking at how it’s carried out or what the end result is…so that leaves the possibility that a very large proportion of crime prevention measures do not work at all in a general sense, and only work from the perspective of preventing “this crime”, “here” and “now”.

    So crime prevention specialists find ways to make the bad stuff happen to someone else…

Leave a Reply

Your email address will not be published. Required fields are marked *