How do you plan for the unknown?

Think how many risks we manage today that were completely unanticipated just 3 years ago …

Speaking recently to Paul Bessant at Retail Risk, we came up with a brilliant new idea.The concept centred around risk assessment. Every retailer undertakes risk assessment; at least the successful ones do. And I am quite proud of the track record we at ASEL have in encouraging retailers to undertake comprehensive business wide risk assessments to fully understand their vulnerabilities as a precursor to deciding what the business wants to do about that risk.

Not only have I written extensively about how we assess, model, mitigate and assure that we have dealt with risk effectively, but by offering our AI based risk modelling service to retailers for free, I think we have removed an impediment to effective risk management for a goodly number of businesses that otherwise would perhaps baulk at the time and resources required to do this properly.

So, we can all assess risk, but how do you assess unknown risk. How do we deal with the “unknown unknowns” a phrase made famous by United States Secretary of Defence Donald Rumsfeld when answering a question at a U.S Department of Defence news briefing in 2002, about the lack of evidence linking the government of Iraq with the supply of weapons of mass destruction to terrorist groups.

Rumsfeld stated: “Reports that say that something hasn’t happened are always interesting to me, because as we know, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns—the ones we don’t know we don’t know. And if one looks throughout the history of our country and other free countries, it is the latter category that tends to be the difficult ones.”

The statement caused much controversy at the time, not least because to many people it seemed to be gobbledegook! However, the Rumsfeld Matrix as it subsequently was referred to can be broken down as follows…

Known knowns: Things we are aware of and understand.
Unknown knowns: Things we understand but are not aware of.
Known unknowns: Things we are aware of but don’t understand.
Unknown unknowns: Things we are neither aware of nor understand.

Known unknowns refers to risks you are aware of, such as cancelled flights, whereas unknown unknowns are risks that come from situations that are so unexpected that they would not be considered.

So back to my conversation with Paul Bessant…
How do we in risk prepare to meet the challenges of unknown unknowns. These are challenges that are so unexpected that they would not be considered. So far off the curve or beyond the norm that we would not anticipate the behaviour nor understand it.

And before you start to wonder, has Hardy lost his mind (arguably a known known!), and why is he chuntering on about all this hypothetical stuff when we have real world challenges that need to be met, pause and reflect… Post covid, why are people so intolerant and why are they increasingly attacking shop workers? Three years ago, that would be categorised as an unknown unknown!

And why are we seeing a spread of lawlessness that is so endemic that some retailers, like Target, are literally raising the white flag, shutting shops and saying that they simply cannot trade in the hostile environment in which they now find themselves. There’s another unknown unknown from three or so years ago.

I bet that any risk manager faced with a consultant asking them to model risk for an environment where crime is so out of control that they cannot trade without incurring huge losses would have been dismissed as a crank. Yet here we are…

For Retail Risk – London we are hoping to present an innovative, experiential installation. Full details will be emerging over the coming weeks. However, it is not something that has EVER been done at Retail Risk before, in its entire 23 year history, nor at any other show in this country that I can remember.

The basic concept is to put Risk Managers in scenario with which they believe they are familiar, but in the process to make them realise that they have not correctly identified the challenges of the situation from the get-go and then find themselves in a situation that they neither anticipated nor understand. What can they do to recover the situation.

This kind of next level innovation in risk management is going to become increasingly important in risk management as the pace and direction of criminal activity divert from what we have seen before.

An example of this evolution can be seen in crimes around heavy plant. It makes you think…

First the heavy plant was attacked in order to steal the satellite navigation systems. Those attacks then evolved into stealing the heavy plant itself – typically a JCB 525, which then in turn became the weapon of choice for ATM attacks. The attacks were thwarted with greater defences so instead the JCB became the vehicle used to drive through stores scooping up cash tills for the cash that was stored with them. Retailers then removed cash to a central location, the operational antithesis of where they wanted to be at when they got rid of the cash offices.

Who would have foreseen that moving cash to the till point would result in raids causing massive disruption and damage to stores as JCBs were driven through them scooping up till points!

It is the development of this kind of perspicacity – this breadth of thinking – that I am hoping ASEL can help to develop, to move risk modelling on to the next level and stay ahead of the bad guys.

Dan Hardy

Group MD