Terrorism and Risk Management
The world today is an environment of steadily growing risk for global organizations. Terrorism, threat of kidnappings, extortion, theft, vandalism, fraud and computer related attacks have created an unprecedented growth in the level of risk being managed by a wide variety of organizations. But numerous recent surveys of organizations, both governmental and NGOs, show that the level of risk management being applied to global threat assessments is at best receiving only a cursory review in boardrooms around the world. Rising compliance costs and a general suspicion of the growing power of audit and risk management has resulted in pressures on risk budgets with the focus directed towards compliance before all else. Faith in superficial risk mitigation strategies such as value-at-risk (VAR) analysis, regulatory audits and insurance management have left gaping holes in the risk coverage for most global organizations.
The reality is that the cost of risks from terrorism and other types of threats is growing at an alarming rate. It is estimated that the cost of the terror attacks on New York alone have easily surpassed US$100bn. The cost of measures to combat terrorism in the United States since 2001 will grow to more than US$1 trillion in 2005 and the losses from reduced investment around the globe are estimated to be well in excess of a trillion dollars. And yet with all the effort being made to protect urban centers and economic facilities, the attacks are growing along with the potential risk to organizations.
Risk management always begins with an assessment of the level of risk and the value of its impact without reference to why the risks exist. This provides quantitative measures that become the basis of risk policy design and actions. The assessment of risks must be blind to the historical nature of the ongoing risk except as it assists in understanding future trends or provides a future mechanism for mitigation. But rising violence and non-violent fraud in the world today is becoming critical to global organizations as their spheres of operation grow beyond their traditional borders and strong military control in many developing countries is replaced with less rigid and nubile democracies.
Political unrest and war are nothing new to organizational risk management but in the past the impact of these acts on subsidiaries and foreign operations were usually financially insignificant in comparison to the overall organization budget or value as to not warrant specific risk mitigation activities. Insurance, security practices, and mitigation through partnerships are the risk solutions of choice for global organizations today. But as insurance rates escalate and acts of terrorism move beyond the borders of developing nations and onto the shores of the industrialized world, organizations now have to assess the impact of risks that a decade ago were beyond their comprehension. Few building managers and their insurance companies would have ever anticipated or planned for the destruction in New York following the 11 September 2001 attacks. And even if an assessment had been performed, it is likely that the quantitative value applied to the risk probability would have been deemed financially insignificant. Today that assessment has changed throughout the world and nowhere more so than in London and New York.
There are a number of risk alternatives available to organizations for managing global threats. Improved security practices including tighter control of facilities and system access, increased monitoring of facilities, biometrics, personnel threat assessments and protection services, have reduced the level of threat for organizations that have implemented such measures. However the cost of these strategies is high and usually only available to very deep pocketed organizations such as governments or large global conglomerates. However, as terrorist acts move into local environments, all organizations and not just those with foreign operations are now facing new and financially significant risks and rising costs. An unusual effect of rising costs is the increase in organizations deciding to self-insure. In 2003, almost half of insurance executives surveyed in the US indicated that self-insurance would grow significantly. As insurance costs rise, self insurance becomes more economically viable but significantly raises the risk of catastrophic failure of key operations.
All of these strategies are designed to mitigate the actions of a single event but the difficulty in this approach is that terrorism is not only random it is often too costly or too difficult to mitigate – or is it? During the 1970s, hijacking of airplanes was on the rise and security practices at airports were reviewed with an eye to increasing the level of security. Initially, the cost of comprehensive x-ray machines was deemed to be too expensive but as the risk to expensive aircraft grew so did the cost of insurance for these planes and it is that economic shift in risk value along with the deep pocket of governments that resulted in the presence of x-rays and screeners in every airport. However, as late as 2000, airport security still allowed unlimited visitors to pass through security checkpoints and accompany travelers to the gates. Cockpit cabin doorways were never locked, tolerance for misbehavior on the planes by unruly passengers was almost never prosecuted and crews were not security screened. Today reinforced cockpit doors, tightened airport security and zero tolerance of in flight aggression are the rule.
Risk management is rapidly evolving as global threats and risks increase and the cost of traditional mitigation strategies escalate skyward. But never knowing where or when a risk will occur has never been much of an impediment to risk managers. The goal of risk management has always been about measuring threats and spending resources on mitigation with only a gambler’s intuition and the greatest risk managers are the ones that understand that risk is chaotic and unpredictable. In fact governments now waging a war on terrorists could learn a thing or two from organizational risk managers.