Wednesday in the Woods · episode 022
Risk as Rain: Interdependence of Incidents
3:53youtube · Licensio, LLC
description
Canoe believe that I took a little skate down to the banks of the Red Cedar? That’s because we’re trading wetlands for wet land - specifically, flood plains - to help demonstrate what water can teach us about managing risk.
You’ve probably heard the phrase that “when it rains, it pours.” And when this rain falls in the late winter or early spring here, it doesn’t just pour. The rain falls on days when the air temperature is high enough to melt snow - the same kind of day when the ground heaves under thaw. The kinetics of a hard rain cause the snow to melt even faster.
Where the soil finally shows its face, mud quickly forms. Skates and snowshoes may work well on ice and snow, but mud is a different story.
Then, the ice on the river breaks. Big slabs, like tectonic plates, start to slowly flow and bump. At bends in the river - or where the heave-ho of thaw has dropped a big tree into the river - the ice stops, jamming or damming up the flower. Then, the real flooding starts.
When the real flooding starts, the roads become impassable - even for emergency responders. Objects - even big ones, like cars - get carried away, deposited in mysterious or inconvenient places.
Then, the temperature drops overnight and it all turns into ice again.
So, what’s the lesson? As insurers and reinsurers will tell you, risks are often much more interdependent or “correlated” than you wish. Sometimes, the drivers of this correlation are geographic. Instead, they might related to the industry you operate in. Or, the correlation might be caused by certain open source libraries like log4j or IaaS providers like Amazon Web Services.
When you inventory your risks in a register, you probably list out probabilities. But each one lives on a separate row, independent and isolated from the others.
Do you have a Teams outage listed separately from an Azure outage? Is the threat of payroll service provider interruption correlated with the same ransomware wave that might hit your own devices?
Some organizations model threats more holistically, using a graph, network, or correlation matrix as inspiration. These methods can be helpful, especially as part of risk program reviews, but the real value isn’t in complex diagrams - it’s in being mindful of the risk of correlated risk.
So, yes, as the Ink Spots and Ella sang, into each life, some rain must fall. We can’t avoid most risks, and we can’t even change the underlying drivers that create their correlation. But, we can at least plan and prepare for these worlds.
Personally, I’d recommend a canoe or little fishing boat. You won’t even notice the flood with a picnic basket or fish on the line.
transcript
~476 words · showhide
from the human-edited captions published with the video. timestamps jump to that point in the video.
- 0:31
Good afternoon and welcome to this week's episode. I decided to walk on down here to the Red Cedar because I thought it'd be a good time to talk about why I like to think about risk as if it were water. See, there's a saying about rain. When it rains, it pours and when it pours, it often floods. And I think this is a great way of thinking about the fact that risk is typically not as independent as we wish it were. This this river here, this is a floodplain I'm standing on, in the summer can be totally dry - run just down to a trickle.
- 1:10
In reasonable years in the spring, the water might be, say, ten yards yonder. You could walk out there, stand on a little, it's not a sandbar, but a mud bar and enjoy the sound of the river, maybe fish a little bit, launch your canoe. But today with an ice dam and some snow on the ground that's just melted. and obviously more than a lick of rain we have a different situation. There's probably a 50,000-fold increase in water coverage in this floodplain between today, as the fog rolls in, and the average width or water coverage area of the river here.
- 2:02
And this is not unique to water. In many situations, the drivers of risk are correlated. and when we look at our our, let's say, risk register and we see these independent risks because we've written them down on separate lines. We often model their probabilities separately. We think about them separately. Our mitigation plans, our tabletop planning, we don't properly consider the idea that many of these risks are correlated.
- 2:33
When it rains, it pours, and when it pours, it floods, and sometimes, when it floods at the wrong time of year, the ice is submerged under ice dams and the flooding isn't just a little flood, it's a lot of flood. And so, next time you're thinking about your risk management program or your risk register, I'd like to suggest that you stop for a moment and really consider, not just the independent probabilities in your register, for example, but how those independent - or seemingly independent - register items might be correlated.
- 3:11
Next time you do a tabletop, think about combining two or three elements in the story together. Don't let yourself get away easy on these things, because again, in reality, as insurers and reinsurers will tell you, these risks are correlated, and when you most need to manage them, you will find that they occur together. So I'm not going to go much further out here because the water still runs pretty hard back here, but I hope you have a nice week and I hope you're warmer and drier than I am.
- 3:44
See you next time.