Tiller-Tapping

In my recent conversation with Curly Moloney on my podcast we were riffing briefly on the idea of DAOs (Decentralised Autonomous Organisations which operate through blockchain technology) replacing most of the functions of a board, but that such organisations would still need real people for “tiller-tapping”.

In a similar vein, I was recently talking to a friend about the difficulty of replacing humans entirely by AI, at the current level of development – and possibly for the foreseeable future. As my friend said, humans are much better than AI in effecting introductions to other humans, often the basis of real innovation.

So, my mind has turned to the replacement of humans by AI in the field of risk management. A subject close to my heart. In my consulting I see many instances of risk management which are more akin to internal control departments, almost entirely focused on compliance. I firmly believe that over time AI will relieve humans of much of the burden of compliance checking: it is often manual, easily replicable, rule-driven and can be done by machines. This in turn will release humans to do the truly creative aspects of risk management and to focus on the value adding perspectives the discipline offers. So, at the moment, I see far fewer risk management teams that are taking a long hard look at the future of the organisation, the ecosystems within which they operate or even gaining a true understanding of the risk culture within which their operations function. None of these three disciplines is replaceable by AI (although AI tools might help). Let’s look at each of these.

Future state

Until AI is entirely learning on synthetic data about multiple futures, almost by definition, it will struggle to imagine the variety of futures that we will face. Ask Perplexity about existential risks in a given industry or for an organisation, and it looks at current activities and known vulnerabilities. Maybe if I spent much more time crafting my prompts, I could obtain better answers. But they are all based on current knowledge. In my view, humans are best placed to imagine the unimaginable, but they are rarely allowed to do so. Those who imagine Armageddon are rejected as being overly negative – and yet it is only by imagining the end, and working back, that we are able to come to sensible judgements about the existential risks that our organisations face.

Equally, it is important to envisage possible happy paths. What if we follow technological developments, and given the changes in global warming, where and how can we provide better service?

In effect the future demands that we use crystal balls, not to predict the future, but rather to imagine the range of futures that we might face.

In a world which today amply demonstrates the risk of staying too long in the comfortable certainties of today, I encourage all organisations to think outside the boundaries of today’s regulations, norms and accepted behaviours, and consider what tomorrow could look like. Perhaps then we can develop effective resilience to the chaotic world in which we all currently live.

Ecosystems

The failure to think about ecosystems in the current global crisis will be the end of many organisations. In other words: failure to understand properly who your organisation works with in order to achieve its objectives, which are often shared across the ecosystem, could be fatal. Have you clearly articulated your joint objectives? Do you know who holds the power? What government or regulatory forces are active on each participant? Are those forces complementary or divergent? What are the shared (or not) values? Who is taking what out of the relationship? All these attributes need to be understood and mapped.

They need to be mapped because of tariffs, because of the realignment of geo-politics, because of the cancellation of “normalcy”. We are already seeing the defence industry across Europe going through change, with for example, localised manufacture of the artillery shells being used in Ukraine. As the US knocks international trade in manufactured goods on the head, many companies will be reviewing their supply chains – maybe reducing reliance on US goods or maybe changing shipping routes. Even if the US Government keeps tariffs at 10%, that is multiple times higher than we have seen until now. As a consequence ecosystems are being erratically decimated seemingly from random asteroids coming from the most unexpected directions.

Recreating new ecosystems is going to take the art of a Kintsugi master and the skills of risk managers who both understand the issue and can imagine new networks and the risks that they hold.

Risk Culture

However much AI and technology affect the organisation, at the end of the day, the important issue of risk culture remains. It is not a well-understood concept. I have written about it extensively elsewhere. But of course, risk culture is even more important across your ecosystems: if you do not understand how your peers in other parts of your ecosystem will respond to risk, you cannot know how the totality of your risks will be managed with any certainty. Therefore, it makes evident sense that risk management needs to address this all-important part of the risk management equation.

And where is the governance?

I have been increasingly surprised by the large number of organisations, even if they claim to have an Audit & Risk Committee, where the importance is assumed to be the “audit” side of that nomenclature. Why do organisations persist in focusing on the accounting treatment of things that have already happened, rather than on their multiple tomorrows? The value of an organisation is almost entirely predicated on their ability to manage cashflows into the future. Once the money is spent, except to the extent that the fact of the spend reveals something about future intentions, it is almost irrelevant.

Maybe the problem rests with boards’ understanding of risk management. To the extent that they have seen risk management programmes, in just the same way that I do, they see compliance programme or internal control departments rather than genuine risk management. There is therefore an imagination gap as to how the “risk” side of the nomenclature can help protect and build value.

I contend that the best governance comes from managing risk, especially in these turbulent times, and boards need to readjust their expectations of risk management programmes and to do so they should be focusing more on big, hairy future risks, their ecosystems and risk culture.

NB: all images created by the author with the aid of AI in the form of Midjourney :-)