Howard Kunreuther: Today risk management has a high profile in many corporations, and enterprise risk management [ERM] is now part of the organizational culture in both large and small companies. But it will be viewed very differently depending on which organization you are dealing with. Each firm looks at enterprise risk management from the perspective of the backgrounds of the people involved and the types of activities in which they are involved. Some organizations, such as insurers or financial institutions, are concerned with quantitative information, while other companies view ERM more qualitatively.

T&R:  Within a company that is not as quantitatively focused, to what degree do the emotions and biases of specific individuals affect the practice of risk management? Do you have a feel for that?

HK:  In corporations, emotions and affect play less of a role than they do for a consumer, because decision-makers inside a company know that their actions will be judged by others. If they make a decision that doesn't make practical sense, other people within the organization may raise questions as to why they are behaving in that way.

Having said that, emotions such as fear or concern can play a very important role when an individual is making decisions that affect their personal lives. We all know that based on our own reactions to things. We all have good days and bad days, and there are times when we make decisions on the basis of our mood. The role of affect is not absent from decision-making in organizations, but it definitely is less prominent than in personal decisions.

T&R:  Is this something companies can control pretty well through policies, through setting clear risk management procedures?

HK:  When you have clear procedures, and when individuals have to provide justifications for why they have taken certain actions and describe the basis of their decisions, affect is likely to play a smaller role in people's decision-making. Policies that push individuals to think more logically about their decision process will help an organization reduce the effects of human emotions on specific actions or recommendations.

T&R:  And I guess having other people review decisions, or having multiple people involved in decisions, helps as well.

HK:  That helps a great deal because the decision-maker is going to get feedback from someone else, and that person is probably going to review the situation from a different perspective and perhaps more objectively than the decision-maker.

T&R:  To what degree should a company look at the risk appetites or risk aversion of individuals when hiring for finance or risk management positions?

HK:  It's extremely important to understand the ability of individuals to fit into the organization, so their personal attitudes towards risk should be considered in hiring decisions. The concept of risk appetite is a term we have been hearing frequently in interviews with decision-makers who deal with catastrophic risks facing their firms. An individual's risk appetite may differ from that of the organization, and they both need to be considered. The financial crisis reflects what can happen when individuals have risk appetites that are very different from what the organization would advocate.

T&R:  What can a company do to get a handle on its risk appetite?

HK:  One of the questions managers at every company should ask is: What are our long- and short-term objectives, and how much risk are we willing to take to meet or exceed these objectives? There is a tendency for decision-makers to be short-sighted, so their actions are suboptimal with respect to longer-term objectives of the organization. An organization needs to structure incentives so that individual decision-makers focus on the same time horizon as the company. If managers are going to get a very high bonus next year as a function of how well they perform this year, then they will behave very differently than if they have a bonus that is based on 5 or 10 years of performance.

Firms should raise questions like: Where would we like to be 5 or 10 years from now? What kinds of strategies do we want to follow to get there? What are the risks associated with following these strategies, not only for tomorrow or next year, but three or four years into the future? It would be useful to examine how these answers conform to decisions made by individuals in the firm. The organization should consider developing guidelines that encourage employees to take actions that are likely to address their long-term goals and objectives.

T&R:  What other factors undermine logic in business decisions?

HK:  One factor that is extremely important, for individual consumers as well as for managers and firms, is past experience. A lot of the research that we are currently undertaking at the Wharton Risk Center focuses on how firms and managers deal with low-probability, high-consequence events—extreme events that don't occur very often but can be catastrophic when they do. Natural hazards, terrorism, and the financial crisis are all examples.

The conclusion that we've come to is that past experience can be extremely important for characterizing decision-making under uncertainty. After experiencing a loss, the natural reaction is to ask 'What steps can be taken now to prevent this from happening in the future?' There is normally a very short time window during which this self-reflection takes place. Companies can take advantage of that window by developing policies and procedures to avoid a similar incident in the future.

Public entities have a similar reaction to experiencing a severe loss. A good example is the reaction of Florida after Hurricane Andrew caused an enormous amount of damage to the Miami-Dade County area in 1992. It was discovered that one-third of the losses could have been avoided if building codes had been enforced. Florida took this finding very seriously, and the state now has one of the most well-enforced building codes in the country as result of that experience. Similarly, corporations will behave in a very different way after experiencing a disaster so as to avoid similar losses in the future.

T&R:  Is there a way to reduce the effect of past experience on risk management calculations—or is that even something companies should try to do?

HK: The other side of the past experience effect is the tendency to think extreme events are not going to happen to us. It can be challenging to get corporations and firms to think about taking steps to mitigate catastrophic risks before they go through the personal experience of a disaster. Developing ways to get people and the firm to think long-term helps focus their attention on undertaking protective measures.

To illustrate, say a firm believes that the likelihood of some event occurring next year is 1 in 100. Managers might say, 'That's below our threshold level of concern, so we're not going to worry about it.' But if they stretch the time horizon from one year to 25 years, they may now be told that there is a greater than 1 in 5 chance that at least one of these events will occur over the 25-year period. Just stretching the time horizon can make people pay attention to the risk where they would otherwise have behaved as if 'It will not happen to me.'

T&R:  So, should corporate risk managers evaluate different scenarios from a variety of time perspectives? Before making decisions about buying insurance or taking other actions, should they look at the risks and the possible consequences one year out, five years out, and 20 years out?

HK:  That is an excellent way of doing things. A risk manager could say, 'If it's a 1 in 100 chance next year, what's the likelihood of this event occurring over a five-year period? What is the likelihood over 10 years?' Just constructing those scenarios is likely to change the way firms view risks. Suppose one wants to encourage a firm to purchase insurance against an extreme event. One way to do this is to construct a scenario highlighting the consequences the firm would likely face if it didn't have insurance and does not invest in protective measures. Just changing how the problem is framed can shift the thinking of decision-makers from 'It's not going to happen to me' to 'If it does happen to me, how will I deal with it?' It can get firms to pay attention and analyze risk in a more logical manner.