I was going continue the governance series today by writing about policies, but I had the idea to use my last few days to show how theory turns into practice. In particular, how I think about and do risk management in day-to-day life. I’m sure you do the same thing, but call it by a different name. “Thinking things through,” perhaps. The really cool thing about it is that it takes longer to describe than to actually do – and if it’s that reflexive for some things, it can become reflexive for everything.
The other day, I hit a pothole while driving and got a flat. Upon fixing the flat, I discovered that the sidewall had a chunk missing as if someone had taken a melon baller to it. It would have to be replaced. Because that’s not bad enough, my wife and I are planning to visit my inlaws -- that means I either have a deadline to get the tire replaced, or I have to postpone the trip. Let me put that into risk management terms:
Threat: Driving between cities on a “donut” spare tire might lead to an accident. Call it a medium probability, so 2 – I don’t need to be very precise for this type of analysis.
Impact: Variable, but could reasonably equal the value of my car, or physical damage up to and including death for my wife and I. My personal risk management policy defines impacts as “high” at least an order of magnitude below the value of my car, let alone death. What’s more, death is inconsistent with my mission to maximize the time I spend interacting with my wife. So high, or if one likes, “Very High.” So, 4.
Vulnerability: As things stand, I’m very vulnerable – there’s not a lot to protect you when you’re driving on a donut. Again, High, or 3.
Risk: 2 x 4 x 3 = 24!!! Far riskier than I’m willing to live with.
There are several options I could take to handle this.
I could mitigate the threat by driving on local roads instead of the highway at a cost of several hours of time. Running at a slower speed might take my threat down from a 2 to a 1, but that’s still a risk of 12, and the impact is still too darn high. That’s a bad decision. Security is about making good decisions, so no.
I could take the car to the dealer and get the tire replaced. Alas, the dealer doesn’t keep the tire in stock and it’s 5 days to order it, so the cost of this solution is having to postpone the trip. The threat would drop to 0, so the risk would drop to 0, at a cost of a ridiculously overinflated (you should pardon the expression) price, travel and waiting time at the dealer, and significant disappointment to my wife and I – contrary to popular stereotypes, I get along great with the Tweeds and love visiting. A good decision, but not a great one.
I could take the car to the fellow who can offer me a tire for the cheapest rate soonest. The cheapest tire is a used tire, and you never really know what you’re getting there. The threat drops from, say 2 to 1 again, or maybe we can call it .5 because I’m not afraid of decimal math. (While I might do this in a pinch, if I did so after a while I might reassess the threat as the tire proves itself.) But I don’t know the guy, so I don’t a basis to be confident that he’ll do a good job. A so-so decision.
I could take the car to the body shop I’ve been dealing with for years – mostly on my last car. He’s a few dollars more expensive than the cheap guy, but two thirds of what the dealer costs. I have a basis for trusting him because I know that he won’t try to sell me work I don’t need – he’s passed up plenty of opportunities and even come right out and told me when I was better off junking my old car instead of fixing it. Once again, the threat drops to 0, the price is reasonable, and I can travel when I planned to with confidence in the work. That’s the best decision I’m going to come up with, so that’s what I did earlier this afternoon.
Of course, I can afford a new tire because a while ago I did a risk assessment in which “There is a risk that my car will need repair” was mitigated by “I have savings for unforeseen emergencies.”
What threats have impacted you in the last few weeks? How did you handle them, and how did you think about it? Did knowing you had a plan and a path forward help avoid fear and therefore a bad decision? Does it fit into the model I’ve described, and if so does that help? I’d love to hear about it.
22 hours ago
