Risk analysis is the “second step” of enterprise risk management, as described in my May 25 blog, ERM – The Five Course Meal. To make an effective risk management decision, companies need to know not only what potential harm a situation poses, but also how great a loss may be, and how often it might occur. Gathering and analyzing this information, and ranking risks by their importance or impact, is referred to as “risk assessment.”

“Risk perception” is that personal judgment that people make about the characteristics and severity of a risk. Variations in personal risk perception can have a significant impact on ERM, leading to either an underestimation or overestimation of projections.

During the risk assessment process, evaluating potential frequency or severity of potential loss is often accomplished through a combination of individual interviews, surveys, and group meetings. Particularly for areas of risk where there is little concrete statistical or historical data, subjective opinions of managers and staff must fill the gaps. But with human input comes human bias—the unique perspective each individual has of the world.

Read More Risk Management Insights From Denise Tessier

When gathering risk information for ERM programs, it is important to understand some of the basic pre-set biases in the process—of both the participants/respondents, and the interviewer or study designer—to help minimize and correct for individual-specific variations. In many respects, the ERM process is much like a scientific, sociological, or epidemiological study in which qualitative data is gathered to test theories and help predict future events. As such, ERM programs may benefit appreciably from mitigation techniques developed in other analytical disciplines to reduce the effects of bias.

Respondent Optimism Bias

Social science and neuroscience suggest that people are more optimistic than realistic. On average, we expect things to turn out better than they wind up being. In analytical studies, the magnitude of this optimistic bias can make the responder perceive a risk or occurrence to be more or less frequent, or more or less severe.

Optimistic participants might not, for example, fully appreciate the impact of new law and regulation, accurately evaluate the financial impact of a breach of controls, or plan to launch the development of a new product without considering the “downsides” adequately. Several factors may increase or decrease the probability that individuals will misjudge some aspects of risk. Here are four of them:

• Events that can be easily imagined or recreated are judged to be more likely than events that aren't readily brought to mind. Studies show that the more concrete an event is the easier it is to imagine, and this often results in a higher degree of perceived future risk. People also naturally tend to notice and to look for what confirms their beliefs, and to ignore, not look for, or undervalue the relevance of what contradicts their understanding. Any information contrary to one’s own opinion may be ignored or given less weight.
• Optimism bias tends to be magnified when the risky event is regarded as controllable—that is, when the event might be prevented through controls, safety measures, or one’s own hard work or creativity. Despite statistics, individuals tend to feel they are less susceptible to events they think they can control to some degree, and more likely to suffer “chance” events.
• People express a greater concern for problems that appear to possess a direct or short-term impact on daily life versus long-term problems that may affect them. Optimism tends to be amplified when the risky event transpires infrequently, and less pronounced when a problem is perceived as common or “day-to-day.” Other studies have shown that optimism bias tends to diminish when the risky event is perceived as one of very serious magnitude, with significant financial or physical consequences.
• Self-esteem tends to magnify the effects of positive thinking. An association between self-esteem and optimism bias can be especially pronounced when the person believes they can control or prevent part of the risk. As such, often “experts” can be overconfident in their own opinions and may rely more on their own personal experiences than sufficient external, objective data. They may also fail to disclose the range of caveats and contingencies that could change their predictions.

“Researcher” or “Experimenter” Bias

Research bias, also called experimenter or design bias, occurs where the person performing a study influences the results, consciously or not. In addition to participant or respondent bias, potential bias of the ERM interviewer should be factored into the risk identification and analysis process, as well as during the digesting of results. Some research bias is inevitable, but the interviewer should strive to lessen the impact or take bias into account in the analysis to help develop a more realistic picture of risk.

Interviewer bias is common in situations where data is collected through face-to-face interactions. Here, the person leading the discussion may give subtle clues with body language or tone of voice that unconsciously influences the participant into giving answers skewed towards the interviewer’s own opinions, prejudices, and values.

Other research bias can include sampling bias, which occurs when the process of selecting participants and/or questions for the study introduces an inherent bias into the inquiry, either by “omission,” or “over-inclusion.”

Response bias can happen when the subject gives feedback that they think the interviewer wants to hear, or what theory he thinks the study is supposed to prove. In some cases, in a phenomenon referred to as the Hawthorne Effect, participants may actually change their normal behavior simply because they know they are being studied.

Further, reporting bias can result in the way that the results are disseminated to their intended audience with a particular slant, rather than accurately depicting what the data shows.

Reducing Bias in Risk Assessment

Minimizing bias can be difficult, but recognizing it is a first step. Bias controls culled from studies in other analytical disciplines are particularly suited for the ERM analysis process. Here are a few to note:

• Avoid fundamental interview and survey design problems by understanding the limitations of the sample group chosen to respond. Realize that some bias will exist due to a group being over-inclusive or under-inclusive of representatives, and strive to elicit feedback in as many departments or levels of staff as practical.
• Use a variety of questioning techniques. With surveys and questionnaires, ensure that questions are not leading, and include at least a few samples of anonymous questionnaires, which may lead to more candid disclosures. For face-to-face meetings, set up as many individual interviews as practical in addition to larger group meetings, to take advantage of the unique dynamics of different kinds of personal interactions. Tools such as survey touch pads can be helpful to elicit sensitive feedback in group settings.
• Give concrete examples of losses, past successes or failures, claims or risks as background. Use case studies, and provide detailed statistics about the frequency of risk to enable respondents to really “picture” the risk, helping extrapolate past experiences into the future.
• Recognize over-statements and super-positive responses which may naturally come from participant ego or self-confidence, and appreciate cultural differences in risk perception. Seek out and document the caveats and conditions under which risk assessment assumptions are made.
• While personal opinion of frequency and magnitude of potential loss is helpful, and may be the most readily available source of input into ERM risk assessments, continue to collect and research as much quantitative data as possible regarding a loss, risk or project.

As Ann Landers one said, “Rose-colored glasses are never made in bifocals. Nobody wants to read the small print in dreams.” An optimistic view of the world can lead to one overlooking the “small print” of risk that might affect measurements of likelihood and magnitude.

ERM practitioners must appreciate that all human input into a risk study is subject to bias, and adopt appropriate mitigation techniques to ensure a clear, sharp view of the future.