Imagine receiving a birthday card. With no return address and a printed label, you curiously open the envelope to see who actually remembers your birthday when you catch the paper at just the right angle for a paper cut.
You don’t need to physically slice your finger again to feel the shiver or quick gasp of pain that seemingly harmless piece of paper inflicted on you. You know what it feels like, and you don’t want to feel it again so much so you can’t forget it. But what if you hadn’t? What if you’ve survived this long without even witnessing one? Why then would you believe me if I warned you that a piece of paper could draw blood? How could you know how to compare it to other injuries?
As human beings, we are meant to learn from past experiences. To not rush into decisions or push big red buttons. We gather information about the world around us to make informed decisions for our survival. But not all information is treated equally by our brains, an important fact to remember when thinking about how we process and prioritise risks. Two of the most common types of information bias to challenge are availability and recency bias.
The more we hear the same pieces of information, the more valid we believe they are, and thus, the higher the weighting we give them when making decisions. For example, we hear more about deaths from shark attacks than deer attacks on the news, so naturally most of us are more afraid of swimming in shark infested waters than driving down a country road with a ‘warning deer sign’.
And yet the statistics don’t lie. Deer kill about 200 times more people a year than sharks.1 No one tells us that and it is definitely not what we see in the cinema. Our availability bias from what we have repeatedly seen makes a very different risk ranking in our head. Does reading this fact give you a change of heart about swimming in shark infested waters? No, likely it does not, and you may now hear the Jaws theme tune at the back of your head. One-time facts alone often aren’t enough. This is the availability bias2.
It reveals the importance of challenging your sources when it comes to creating your risk register. But how can you ensure you exposed to all aspects of a risk before ranking its impact? By reaching out and challenging your risk register – and your assumptions that went into constructing it – regularly.
In the WTW Airport Risk Index we used the ability to separately explore risks by impact and likelihood as a way to challenge against a single metric that included both to prompt exactly these questions.
If we only surrounding ourselves with like-minded people, we will continue to overweight our own views with the added strength of others who agree. We strong believe in the importance of challenging bias in the WTW Research Network, and why we’ve spent 17 years creating a network of organisations and people who will challenge us as much as we challenge them.
When we experience or learn something first hand, the more valid we believe the information is because of the previously discussed availability bias. To compound that weighting, the more recently the experience has occurred the higher we value it. This compounding effect is known as recency bias, which can be a wicked problem for risk registers. Try as we might, no person is exempt from bias and, because most companies use people rather than pure data to create their risk registers, no register is exempt either.
This can be seen with a look at the top risks for companies in 2017 compared to 2022. A comparison of the 2007 annual reports from today’s top 10 fortune 500 companies will reveal that only one mentioned the word “pandemic”. Today, you will find pandemic in the top 10 of all ten, some with entire sections dedicated to it. What has changed since then? Experience. The return periods for a pandemic didn’t change. The data was always there that another pandemic could occur, but that data wasn’t personally available or recent.
Throughout history pandemics have played a major role in reshaping human civilisation, but, while the majority of people living in 2020 might have learned that fact now, outside of epidemics in Asia and Africa, the Western world had never experienced a pandemic first hand, creating an availability bias that currently dominates risk lists. Recency bias took hold once we had experienced COVID-19 and a risk that was consistently forgotten by many geographies was brought to the top across the board.
A healthy risk culture looks back as much as it does forwards to understand how to build resilience, and all organisations should be exploring the way they think about and use risk registers. How long will we continue to find pandemic in our risk registers if society doesn’t experience another soon? What other risks have we been ignoring because we haven’t experienced them? And how do we combat the issue for an entire generation that all pandemics will look like COVID-19 when asked to imagine one? Or the issue reported by the Global Preparedness Monitoring Board in September 2019 just before COVID-19 that hindered response?:
“Trust in institutions is eroding. Governments, scientists, the media, public health, health systems and health workers in many countries are facing a breakdown in public trust that is threatening their ability to function effectively. The situation is exacerbated by misinformation that can hinder disease control communicated quickly and widely via social media.”3
These biases have evolved to aid in our survival. They help us to prioritise the risks in our lives we believe are most pressing and prevalent. This evolution becomes maladaptive and a real risk for companies when availability and recency biases cause us to be comfortable with the risks on our registers.
Risk registers are meant to be a proactive tool that helps companies prepare for the risks ahead. To create letter openers, or better yet emails, if you will, to prevent the paper cuts of the future. They are not meant to be retroactive logs of past events. They are meant to question how the company is prepared with scenarios that make boards uncomfortable at the thought of being caught unawares. If there isn’t a single risk your register that you question perhaps it is time to reassess.
Four questions to ask yourself and your colleagues, include:
Most importantly, if you don’t know the answer that’s okay. No one person can know everything, that’s the approach we take in the WTW Research Network – be prepared to say you don’t know and be empowered to find out.
1 Why Deer Are More Deadly Than Sharks
2 Availability: A heuristic for judging frequency and probability
3 Annual report on global preparedness for health emergencies
