I’m sure you’ve read about the offer from Warren Buffett and Quicken Loans to pay $1 billion to anyone with a perfect NCAA men’s basketball bracket, and you probably also know that before the sweet sixteen has begun, there are already zero entries that could win. But what a great way for Quicken Loans to gather millions of leads with personal information, without any genuine risk.
After all, no one has submitted a perfect bracket in the sixteen years that ESPN has been running a competition and the odds of a perfect bracket are about 1 in 128 billion even for someone who knows quite a bit about college basketball, according to DePaul math professor Jay Bergen. So, even for those who try running computer programs with sophisticated algorithms that take into account many of the factors that lead to a basketball game win, the likelihood of getting it right still depends more on dumb luck than anything else.
It all comes down to understanding that there are things that you can predict well, given the right data and methods of analysis, and other things not so much. Why? Because the variables are so numerous and so complex and co-dependent that the odds of getting some things right are just ridiculously bad. And yet, in business we talk quite confidently, when maybe we shouldn’t, about conducting risk assessment for strategic decisions that, in many cases, would potentially yield as big a return or cause as big of a loss (at least in relative terms) as the $1 billion dollar gamble Warren Buffett put on the table.
In too many cases, “risk assessment” takes the form of asking executives for their opinions or general ranking of risk for a particular action, factoring in some information we may have gained from outside and internal sources, and using a very generic heat map that ranks risks in relationship to each other and an ill-defined “risk appetite”. In other cases, we aren’t even thinking about the organization’s appetite for risk, or how well it can tolerate the impact of taking a risk and realizing a negative effect, we are only looking at level of risk in the abstract based on the limited and untested data we consider.
That’s all well and good if you are on the bracket-writer side of the Buffett bet. The risk of entering your bracket most likely is only that Quicken Loans will start calling or emailing you to sell you something. Maybe they will sell your data to others who will bother you too. But you can’t be faulted if the potential reward, and the pleasure of thinking you might obtain it, outweigh the annoyance of those potential calls. So why not play? Just take the limited information you have from watching games all season, analyze which players are out injured and what that means, consider the time zones each team must adjust to, and pick your winners. Or just go with the team names, mascots or uniforms you like best; what have you got to lose?
It’s a different story and different analysis when we are talking about a real business decision with real impacts and outcomes. In that case, we need to manage the risk assessment in a much more meaningful way and we need to ask ourselves some key questions. Here are just a few of them.
- Can we limit the variables that affect the assessment, not by leaving them out of the analysis but by actually controlling them and turning them into non-variable factors?
- Do we have valid, quantifiable information about each variable or are we simply guessing?
- Are we drawing on the right experts, data sources, and business operators (both managers and line employees in some cases) to get a full picture?
- If our qualitative data is solid, is there a way to give it more weight in our analysis (or, conversely, give less weight to more qualitative/less quantitative data)?
- Do we know how to factor in qualitative information that adds value?
- What factors make such an impact that we need to continually monitor them for change?
- Do we have a method to maintain a current view and adjust our analysis when circumstances are altered?
- Do we understand the way that algorithms we may employ actually work and know when to disregard them?
- How can technology help in this process and what would cause it to lead us to an incorrect analysis?
Thinking about coming into $1 billion dollars is fun, and I’m sure that Warren Buffett enjoyed watching millions of people try to grasp it with about the same likelihood of success as a three year old jumping up to touch the rim of the basket on the basketball court. But it’s less fun, in fact no fun at all, to try to defend a business decision gone wildly awry, if your “pre-game” analysis isn’t defensible.
Learn more about risk assessment in the OCEG GRC Capability Model (Red Book).