Not everything is a crisis

In many of your roles, you may manage a crisis (investigation, regulatory action, internal dispute, etc.). In that setting, I’d always refer to the basic crisis management framework below.

We tend to leap to conclusions based on assumptions. If you can (help others) arrest that tendency, the battle is half-won. Often, we’re starting with slim pickings, factually. Someone has alleged something; no facts, yet. In that setting, choose the sensible (wise/prudent) assumptions and rank them according to how easy they would be to test. For example, I responded to an extortion case where the extortionist threatened to release sensitive data that would threaten a nation’s national security. The big assumption was they had that data. The first test then became: has all that data been accessed? If so, when, by whom, and how?

As we start to calibrate the assumptions better, we move to scenarios.

If you’re doing this with a leadership team (the ExCo/board, usually), there will be no shortage of dominant personalities. You don’t need these people hijacking the process. We need ideas. A simple hack is to present the current situation and ask each person to take five minutes (in silence) to write down the most likely, best, and outlier scenarios. The quieter folks often see options and issues that bombastic types don’t.

Why this topic and why now? Well, I hope you’re not managing a crisis. But I imagine many of you are being asked to calibrate risk.

We’d need the crisis management level of rigour to arrive at a comprehensive analysis of potential impact. Considering all assumptions, facts, perspectives, and scenarios. That soon becomes unwieldy. It’s why, in my work with impact investors, I no longer assess the impact of various risks in their PortCos (irony intended). This example explains why:

👉 A minister threatens to cancel your concession unless you pay a bribe.

So, what’s the impact? Well, a non-exhaustive list of scenarios:

👉 You refuse to pay, and he cancels your concession.

👉 You escalate to your embassy, and he backs off. Later, you start losing business locally.

👉 You meet and try to find a compromise (nothing unethical). He may use your location for a rally if he promises to desist extorting.

👉 You ignore; he was shaking down tens of other businesses to try and raise funds to buy votes.

👉 You stall and delay, knowing he probably won’t get re-elected in a few months.

👉 You refuse to pay (zero tolerance), blah blah. The minister goes away.

I discussed all those scenarios with a client in precisely that crisis situation – pay or we drive you out of your most lucrative market in Asia. We worked out how to test the various options’ likely efficacy.

In a crisis, it makes sense to calibrate risk and scenarios to this degree. In a predictive risk assessment, it doesn’t. If I outlined every possible eventuality (and impact) in a risk assessment no one would read it, let alone action it. I leave that work to the Big 4 (joking, sort of 😜). My clients come (back) to me because, together, we rightsize risk and make it realistic. That is especially true when working with mid-caps and SMEs, who don’t have a team of advisers or risk modellers to stew on, and then track, every possible eventuality.

In a risk assessment, our focus is identification of possible issues and prioritisation. We should ask ourselves, ‘Could that occur? If it occurred, how much chaos could it cause?’ If the answer is ‘a lot,’ then we keep it simple and look at the steps to decrease the likelihood. Remember, probability is the (more) controllable variable, not impact. So, when doing a risk assessment, we keep it simple: not everything is a crisis.