blind bats, black swans and red motorcycles: reducing the risk of teaching risk

1© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010 11

Blind Bats, Black Swans andRed Motorcycles:

Reducing The Risk of Teaching Risk

Dr. David H. McIntyre

Distinguished Visiting Fellow, Homeland Security Institute

Director, Homeland Security Programs, National Graduate School

979-575-4552 [email protected]

Alt [email protected]

mailto:[email protected]

mailto:[email protected]


EM Community and Higher Ed deserve credit• Per Claire Ruben: EM has responded to Δing times

and requirements• From Galveston and the Dust Bowl• To Civil Defense & FEMA• To Hurricane Ike and recent Wildfires

• Emergency Management: The American Experience, 1900-2005• http://works.bepress.com/claire_rubin/7/

• EM Higher Ed has responded too – especially since 9/11 & Katrina

• Invigorated EMI / FEMA Higher Ed program• “Principles of Homeland Security”• Expanded & Professionalized EM education

community

http://works.bepress.com/claire_rubin/7/

http://works.bepress.com/claire_rubin/7/


EM is in danger of missing the train . . . againEM missed the Δ in threat and scale in 1995

• Not ready to exert leverage• In 9/11• In Katrina

In 2006-2011 EM took control of its own destiny

Now EM is missing 3 major developments . . . Again1. Unified Theory/Strategy of HLS2. Coherent Framework for HLS3. Mechanism to Prioritize HLS resources / efforts


1. Unified Theory/Strategy for NS/HLS

Key element: Concept of Cause & Effect to achieve Homeland Security

The Department's mission: is to ensure a homeland that is safe, secure, and

resilient against terrorism and other hazards.http://www.dhs.gov/xabout/responsibilities.shtm

So . . . How to achieve this mission?

5© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010

National Security Strategy of the United States . . .for terrorism–Disrupt, Dismantle, Defeat overseas

For other national level issues–Develop a Sustainable Civil Society

For Homeland Security–Preparedness & Response

5

1. Unified Theory/Strategy for NS/HLS


Homeland Security Strategy

6

Event

Pre-Event Post-Event

Preparedness Response

Mitigation Prevention Protection Response Recovery Resilience

Example: National Infrastructure Protection Plan

Example: National Response Framework

Reduce Cost:Risk

ManagementResilience

Defacto Strategy: If we conduct adequate Preparedness and satisfactory Response, we can achieve the mission of HLS


2. Coherent Framework for Homeland Security

7

• National Security Strategy of the United States – June 2010– http://www.whitehouse.gov/sites/default/files/rss_viewer/national_security_strategy.pdf

• Strategic National Risk Assessment – Nov 2011• http://www.dhs.gov/xabout/structure/rma-strategic-national-risk-assessment-ppd8.shtm

• Quadrennial Homeland Security Review 2009– http://www.dhs.gov/xabout/gc_1208534155450.shtm

• PDD List (Clinton); HSPD List (Bush 43); PPD List (Obama)– http://www.fas.org/irp/offdocs/pdd/index.html– http://www.dhs.gov/xabout/laws/editorial_0607.shtm– http://www.fas.org/irp/offdocs/ppd/index.html

• National Preparedness Guidelines / National Preparedness System– http://www.dhs.gov/files/publications/gc_1189788256647.shtm • National Infrastructure Protection Plan (National Preparedness Framework TBD)

http://www.dhs.gov/files/programs/gc_1189168948944.shtm

• National Response Plan• National Response Framework Resource Center

http://www.fema.gov/emergency/nrf/

• Comprehensive Preparedness Guide 101, 201– http://www.fema.gov/pdf/about/divisions/npd/CPG_101_V2.pdf

http://www.whitehouse.gov/sites/default/files/rss_viewer/national_security_strategy.pdf

http://www.dhs.gov/xabout/structure/rma-strategic-national-risk-assessment-ppd8.shtm

http://www.dhs.gov/xabout/structure/rma-strategic-national-risk-assessment-ppd8.shtm

http://www.dhs.gov/xabout/gc_1208534155450.shtm

http://www.fas.org/irp/offdocs/pdd/index.html


Integrated Risk ManagementCycle In Simple Terms:

Risk = Threat x Vulnerability x Consequences

Where Threat = Likelihood of Threat / Hazard / Natural Disaster

But there are other approaches – Example: Texas Public Health Risk Assessment Tool•Residual Risk = Hazard Probability × Severity of Consequences / Mitigation•Severity of Consequences = Population Vulnerability × Impact on Health•Mitigation = Capability to Respond + Resources Available + Community Resilience

Task: Apply, Analyze, Evaluate . . . Using•DHS Risk Management aidhttp://learnaboutrisk.com/ •Office of Risk Management and Analysishttp://www.dhs.gov/xabout/structure/gc_1287674114373.shtm

3) Mechanism to Prioritize HLS resources / efforts


First: Essential Definitions RISK: potential for an unwanted outcome resulting from an incident, event, or

occurrence, as determined by its likelihood and the associated consequences

RISK ANALYSIS : systematic examination of the components and characteristics of risk

RISK ASSESSMENT : product or process which collects information and assigns values to risks for the purpose of informing priorities, developing or comparing courses of action, and informing decision making

RISK MANAGEMENT: process of identifying, analyzing, assessing, and communicating risk and accepting, avoiding, transferring or controlling it to an acceptable level considering associated costs and benefits of any actions taken

INTEGRATED RISK MANAGEMENT: structured approach that enables the distribution and employment of shared risk information and analysis and the synchronization of independent yet complementary risk management strategies to unify efforts across the enterprise

For more definitions see DHS Risk Lexicon – MAKE THIS EM LEXICON


Risk Management (RM) can help “See the Threat” and “See the Solution” and thus prioritize

– Without it we are Blind as a Bat

But RM can actually create additional Risk– By narrowing vision and promoting over confidence– Miss Black Swans: Low Probability but INEVITABLE High

Consequence Disasters– Miss Red Motorcycles: Disasters you see but don’t recognize as

a serious threat

Solution:– Use the tools of Risk Management in new ways– To BROADEN NOT NARROW leader understanding.

Bottom line Up Front


Conclusions developed during prep of White Paper

Sponsor: HSIHomeland Security Studies and Analysis Institute

Note the Requirement from the Sponsor:

Provide a New Perspective on an Enduring Problem: How to apply Risk Management to problems of Homeland Security

11

http://www.ngs.edu/strategies-and-methods-for-informing-risk-management/


Challenging Issues: The Language of Risk RISK means too much

– What kind of risk? Financial – Engineering – Health – EM – DOD – DHS . . . All use “Risk” to mean different things

– Risk = Threat (Hazard) x Vulnerability x Consequence . . . says who? . . . There is no “approved solution” for calculating risk.

RISK means too little– For non-professionals it has little power – Hard to sell a positive (security) with two negatives (reduce risk)

Improving Safety & Security . . . is just right– Everybody gets it– Everybody can do it – Whole of Government

The HSD/EM Enterprise should talk about Reducing Risk in terms of Improving Safety & Security


Unfortunately RM can Increase Risk We do need a way to prioritize resources

– We cannot afford to eliminate every Risk– Without some system of analysis, management, etc. we are “Blind as

Bats” But – High Risk Reductionism can Black Swans

– Unanticipated High Consequence Events– Underestimate Probability: Space Shuttle, Chernobyl, Bhopal– Underestimate Complexity: Flu, Electrical Grid, Deepwater Horizon– Underestimate Cascade: Hurricane Ike, Japanese Reactors

And High Risk Reductionism can Red Motorcycles– See it in traffic, but it does not register as a danger– Air Attacks on the Pentagon– Mt. Pinatubo: Earthquake & Typhoon together– Haiti & Cholera

Result: Simplifying decision making can bad decisions


How to Reduce Risk of RM?ANSWER: Better Inform Decision Makers

What does RM do now?– Obscure uncertainty by aggregating data

What else might Risk Management do?– Convey uncertainty (explain the Risk of Risk) by broader &

more aggressive data presentation

What should RM do differently?– Consider data in multiple ways – Use this process to change the understanding of problems and

solutions– Aggregate data for simplicity– Disaggregate data for clarity – Visualize in order to Analyze


Some Examples: New ways to display data RISK DISPLAY TABLE(s)

– This is a simple list of 4 columns. RISK = T x V x C Then group by R, by T, by V, by C

TARGET LIST– Group by type: CIKR, people,

recovery cost, government, private, etc.

TARGET MAP– Same as TARGET List but

overlaid on GIS info THREAT TABLE

– Grouped by type of threats and hazards (CBRNE, Natural Disaster, 15 scenarios, etc.)

• THREAT PROBABILITY TABLE•Grouped by Likelihood of threat

(or hazard) (3 groups? 5? 7?)• THREAT PROBABILITY MAP

•Display threat probability in colors and analyze geographic relationships

• THREAT RESPONSE Table•Group threats and identify

response capabilities - across jurisdictions. What do you need? What do you have?

• THREAT RESPONSE MAP•Display Threat Response data

showing geographic relationships, agreements, etc.

The fundamental idea is to list and group data in a variety of ways to discover relationships – rather than simply rank ordering risk


Examples: Better Inform Decision Makers RISK MATRIX (High/Low)

– 4 cell matrix with Vulnerability x Consequence on the X axis, and Threat on the Y axis.

VULNERABILITY REDUCTION DISPLAY

– How selected measures reduce grouped Vulnerabilities

CONSEQUENCE REDUCTION DISPLAY

– How Whole of Community Actions can reduce Contagion / Cascade

IMPACT TABLE– By Target and Type of Attack

Show Variety of IMPACTS ($, Health, Legal, Long Term Recovery, Environment, etc)

• CASCADE MATRIX– Show how loss of one target

impacts others• SEVERITY TABLE

– Show Risk + Cost of Prioritized Response

• CORRELATION EXPECTATION TABLE

– For every coordinated action proposed, How it will influence Consequence, Vulnerability, Threat and Risk Overall?

• RISK REDUCTION TABLE– For Plans Show: Target, Risk,

Planned Action, Anticipated Change to Risk

– For Evaluation Show: Target, Old Risk, Action Taken, Actual Risk Reduction, New Risk


An Example of Aggressive Use of Data

17


How to avoid Blind Bats, Black Swans and Red Motorcycles?

How to Reduce the Risk of Risk Management?

Continue to use Risk Management to calculate and prioritize risk

But PREVENT narrow focus and overconfidence by decision makers

By using the data and tools of Risk Management in innovative ways to promote a broader vision.

So . . . What to do?


Strengthen IRM in DHS/EM – TEACH RISK

1. See Recommendations from previous studies2. Professional Career Field

3. Progressive Sequential Education

4. Executive Leader Training & Ed

5. Training across the Enterprise

6. DHS produce its own Tng/Ed materials – on line – use modern techniques (example: Gaming)

7. Coordinate with Higher Ed community

8. Exploit FEMA, EMI, FEMA Higher Ed

9. Special focus areas (Intel, Exercises, Comms)

10. Sr Ldrs incorporate RISK into daily operations


Also --Build Risk Management Culture Establish a Sense of Urgency

– Include crises, potential crises and opportunities Create a Guiding Coalition

– Charge a group WITH POWER to push the change as a team Develop a Vision and Strategy

– What does success look like? What path will get there Communicate the Vision and the Change Required

– The actions of leaders speak louder than their words Give people in the system the power to make the changes work

– Find out what gets in the way of risk management, and get rid of it Plan for some short term wins

– Show examples of successes and give credit where it is due Leverage these gains to encourage more change

– Use the credibility gained to repeat the success Anchor the changes into the long term culture

– By planning for succession From: John Kotter

Leading Change


Build Risk Management Culture – thru Ed Establish a Sense of Urgency

– DONE!! By PDD-8 -- “the greatest risks to our national security” -- FEMA grant requests.

Create a Guiding Coalition– DONE!! Risk Steering Committee. Now . . . Principals lead

Develop a Vision and Strategy– MISSING BUT EASY TO DO. RMA/HIS w/ NPPD develop case studies

Communicate the Vision and the Change Required– THIS REQUIRES THE SECRETARY’S PERSONAL ACTION

Give people in the system the power to make the changes work– Briefings on improvements to the QHSR in terms of risk management

Plan for some short term wins– EASY – use National Risk Assessment, National Exercise Program, S&T, etc.

Leverage these gains to encourage more change– Practice on 2013 Budget , use IRM, NRA, NPS to inform 2014 budget.

Anchor the changes into the long term culture– Use to inform Congress / defend 2013 & 2014 budgets

Apply to HLS Ed


Blind Bats, Black Swans andRed Motorcycles:

Reducing The Risk of Teaching Risk

Dr. David H. McIntyre

Distinguished Visiting Fellow, Homeland Security Institute

Director, Homeland Security Programs, National Graduate School

979-575-4552 [email protected]

Alt [email protected]

blind bats, black swans and red motorcycles: reducing the risk of teaching risk

Documents