1© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010 11
Blind Bats, Black Swans andRed Motorcycles:
Reducing The Risk of Teaching Risk
Dr. David H. McIntyre
Distinguished Visiting Fellow, Homeland Security Institute
Director, Homeland Security Programs, National Graduate School
979-575-4552 [email protected]
2© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010 2
EM Community and Higher Ed deserve credit• Per Claire Ruben: EM has responded to Δing times
and requirements• From Galveston and the Dust Bowl• To Civil Defense & FEMA• To Hurricane Ike and recent Wildfires
• Emergency Management: The American Experience, 1900-2005• http://works.bepress.com/claire_rubin/7/
• EM Higher Ed has responded too – especially since 9/11 & Katrina
• Invigorated EMI / FEMA Higher Ed program• “Principles of Homeland Security”• Expanded & Professionalized EM education
community
3© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010 3
EM is in danger of missing the train . . . againEM missed the Δ in threat and scale in 1995
• Not ready to exert leverage• In 9/11• In Katrina
In 2006-2011 EM took control of its own destiny
Now EM is missing 3 major developments . . . Again1. Unified Theory/Strategy of HLS2. Coherent Framework for HLS3. Mechanism to Prioritize HLS resources / efforts
4© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010 4
1. Unified Theory/Strategy for NS/HLS
Key element: Concept of Cause & Effect to achieve Homeland Security
The Department's mission: is to ensure a homeland that is safe, secure, and
resilient against terrorism and other hazards.http://www.dhs.gov/xabout/responsibilities.shtm
So . . . How to achieve this mission?
5© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
National Security Strategy of the United States . . .for terrorism–Disrupt, Dismantle, Defeat overseas
For other national level issues–Develop a Sustainable Civil Society
For Homeland Security–Preparedness & Response
5
1. Unified Theory/Strategy for NS/HLS
6© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
Homeland Security Strategy
6
Event
Pre-Event Post-Event
Preparedness Response
Mitigation Prevention Protection Response Recovery Resilience
Example: National Infrastructure Protection Plan
Example: National Response Framework
Reduce Cost:Risk
ManagementResilience
Defacto Strategy: If we conduct adequate Preparedness and satisfactory Response, we can achieve the mission of HLS
7© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
2. Coherent Framework for Homeland Security
7
• National Security Strategy of the United States – June 2010– http://www.whitehouse.gov/sites/default/files/rss_viewer/national_security_strategy.pdf
• Strategic National Risk Assessment – Nov 2011• http://www.dhs.gov/xabout/structure/rma-strategic-national-risk-assessment-ppd8.shtm
• Quadrennial Homeland Security Review 2009– http://www.dhs.gov/xabout/gc_1208534155450.shtm
• PDD List (Clinton); HSPD List (Bush 43); PPD List (Obama)– http://www.fas.org/irp/offdocs/pdd/index.html– http://www.dhs.gov/xabout/laws/editorial_0607.shtm– http://www.fas.org/irp/offdocs/ppd/index.html
• National Preparedness Guidelines / National Preparedness System– http://www.dhs.gov/files/publications/gc_1189788256647.shtm • National Infrastructure Protection Plan (National Preparedness Framework TBD)
http://www.dhs.gov/files/programs/gc_1189168948944.shtm
• National Response Plan• National Response Framework Resource Center
http://www.fema.gov/emergency/nrf/
• Comprehensive Preparedness Guide 101, 201– http://www.fema.gov/pdf/about/divisions/npd/CPG_101_V2.pdf
8© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010 8
Integrated Risk ManagementCycle In Simple Terms:
Risk = Threat x Vulnerability x Consequences
Where Threat = Likelihood of Threat / Hazard / Natural Disaster
But there are other approaches – Example: Texas Public Health Risk Assessment Tool•Residual Risk = Hazard Probability × Severity of Consequences / Mitigation•Severity of Consequences = Population Vulnerability × Impact on Health•Mitigation = Capability to Respond + Resources Available + Community Resilience
Task: Apply, Analyze, Evaluate . . . Using•DHS Risk Management aidhttp://learnaboutrisk.com/ •Office of Risk Management and Analysishttp://www.dhs.gov/xabout/structure/gc_1287674114373.shtm
3) Mechanism to Prioritize HLS resources / efforts
9© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
First: Essential Definitions RISK: potential for an unwanted outcome resulting from an incident, event, or
occurrence, as determined by its likelihood and the associated consequences
RISK ANALYSIS : systematic examination of the components and characteristics of risk
RISK ASSESSMENT : product or process which collects information and assigns values to risks for the purpose of informing priorities, developing or comparing courses of action, and informing decision making
RISK MANAGEMENT: process of identifying, analyzing, assessing, and communicating risk and accepting, avoiding, transferring or controlling it to an acceptable level considering associated costs and benefits of any actions taken
INTEGRATED RISK MANAGEMENT: structured approach that enables the distribution and employment of shared risk information and analysis and the synchronization of independent yet complementary risk management strategies to unify efforts across the enterprise
For more definitions see DHS Risk Lexicon – MAKE THIS EM LEXICON
10© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
Risk Management (RM) can help “See the Threat” and “See the Solution” and thus prioritize
– Without it we are Blind as a Bat
But RM can actually create additional Risk– By narrowing vision and promoting over confidence– Miss Black Swans: Low Probability but INEVITABLE High
Consequence Disasters– Miss Red Motorcycles: Disasters you see but don’t recognize as
a serious threat
Solution:– Use the tools of Risk Management in new ways– To BROADEN NOT NARROW leader understanding.
Bottom line Up Front
11© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
Conclusions developed during prep of White Paper
Sponsor: HSIHomeland Security Studies and Analysis Institute
Note the Requirement from the Sponsor:
Provide a New Perspective on an Enduring Problem: How to apply Risk Management to problems of Homeland Security
11
http://www.ngs.edu/strategies-and-methods-for-informing-risk-management/
12© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
Challenging Issues: The Language of Risk RISK means too much
– What kind of risk? Financial – Engineering – Health – EM – DOD – DHS . . . All use “Risk” to mean different things
– Risk = Threat (Hazard) x Vulnerability x Consequence . . . says who? . . . There is no “approved solution” for calculating risk.
RISK means too little– For non-professionals it has little power – Hard to sell a positive (security) with two negatives (reduce risk)
Improving Safety & Security . . . is just right– Everybody gets it– Everybody can do it – Whole of Government
The HSD/EM Enterprise should talk about Reducing Risk in terms of Improving Safety & Security
13© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
Unfortunately RM can Increase Risk We do need a way to prioritize resources
– We cannot afford to eliminate every Risk– Without some system of analysis, management, etc. we are “Blind as
Bats” But – High Risk Reductionism can Black Swans
– Unanticipated High Consequence Events– Underestimate Probability: Space Shuttle, Chernobyl, Bhopal– Underestimate Complexity: Flu, Electrical Grid, Deepwater Horizon– Underestimate Cascade: Hurricane Ike, Japanese Reactors
And High Risk Reductionism can Red Motorcycles– See it in traffic, but it does not register as a danger– Air Attacks on the Pentagon– Mt. Pinatubo: Earthquake & Typhoon together– Haiti & Cholera
Result: Simplifying decision making can bad decisions
14© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
How to Reduce Risk of RM?ANSWER: Better Inform Decision Makers
What does RM do now?– Obscure uncertainty by aggregating data
What else might Risk Management do?– Convey uncertainty (explain the Risk of Risk) by broader &
more aggressive data presentation
What should RM do differently?– Consider data in multiple ways – Use this process to change the understanding of problems and
solutions– Aggregate data for simplicity– Disaggregate data for clarity – Visualize in order to Analyze
15© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
Some Examples: New ways to display data RISK DISPLAY TABLE(s)
– This is a simple list of 4 columns. RISK = T x V x C Then group by R, by T, by V, by C
TARGET LIST– Group by type: CIKR, people,
recovery cost, government, private, etc.
TARGET MAP– Same as TARGET List but
overlaid on GIS info THREAT TABLE
– Grouped by type of threats and hazards (CBRNE, Natural Disaster, 15 scenarios, etc.)
• THREAT PROBABILITY TABLE•Grouped by Likelihood of threat
(or hazard) (3 groups? 5? 7?)• THREAT PROBABILITY MAP
•Display threat probability in colors and analyze geographic relationships
• THREAT RESPONSE Table•Group threats and identify
response capabilities - across jurisdictions. What do you need? What do you have?
• THREAT RESPONSE MAP•Display Threat Response data
showing geographic relationships, agreements, etc.
The fundamental idea is to list and group data in a variety of ways to discover relationships – rather than simply rank ordering risk
16© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
Examples: Better Inform Decision Makers RISK MATRIX (High/Low)
– 4 cell matrix with Vulnerability x Consequence on the X axis, and Threat on the Y axis.
VULNERABILITY REDUCTION DISPLAY
– How selected measures reduce grouped Vulnerabilities
CONSEQUENCE REDUCTION DISPLAY
– How Whole of Community Actions can reduce Contagion / Cascade
IMPACT TABLE– By Target and Type of Attack
Show Variety of IMPACTS ($, Health, Legal, Long Term Recovery, Environment, etc)
• CASCADE MATRIX– Show how loss of one target
impacts others• SEVERITY TABLE
– Show Risk + Cost of Prioritized Response
• CORRELATION EXPECTATION TABLE
– For every coordinated action proposed, How it will influence Consequence, Vulnerability, Threat and Risk Overall?
• RISK REDUCTION TABLE– For Plans Show: Target, Risk,
Planned Action, Anticipated Change to Risk
– For Evaluation Show: Target, Old Risk, Action Taken, Actual Risk Reduction, New Risk
17© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
An Example of Aggressive Use of Data
17
18© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
How to avoid Blind Bats, Black Swans and Red Motorcycles?
How to Reduce the Risk of Risk Management?
Continue to use Risk Management to calculate and prioritize risk
But PREVENT narrow focus and overconfidence by decision makers
By using the data and tools of Risk Management in innovative ways to promote a broader vision.
So . . . What to do?
19© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
Strengthen IRM in DHS/EM – TEACH RISK
1. See Recommendations from previous studies2. Professional Career Field
3. Progressive Sequential Education
4. Executive Leader Training & Ed
5. Training across the Enterprise
6. DHS produce its own Tng/Ed materials – on line – use modern techniques (example: Gaming)
7. Coordinate with Higher Ed community
8. Exploit FEMA, EMI, FEMA Higher Ed
9. Special focus areas (Intel, Exercises, Comms)
10. Sr Ldrs incorporate RISK into daily operations
20© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
Also --Build Risk Management Culture Establish a Sense of Urgency
– Include crises, potential crises and opportunities Create a Guiding Coalition
– Charge a group WITH POWER to push the change as a team Develop a Vision and Strategy
– What does success look like? What path will get there Communicate the Vision and the Change Required
– The actions of leaders speak louder than their words Give people in the system the power to make the changes work
– Find out what gets in the way of risk management, and get rid of it Plan for some short term wins
– Show examples of successes and give credit where it is due Leverage these gains to encourage more change
– Use the credibility gained to repeat the success Anchor the changes into the long term culture
– By planning for succession From: John Kotter
Leading Change
21© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010
Build Risk Management Culture – thru Ed Establish a Sense of Urgency
– DONE!! By PDD-8 -- “the greatest risks to our national security” -- FEMA grant requests.
Create a Guiding Coalition– DONE!! Risk Steering Committee. Now . . . Principals lead
Develop a Vision and Strategy– MISSING BUT EASY TO DO. RMA/HIS w/ NPPD develop case studies
Communicate the Vision and the Change Required– THIS REQUIRES THE SECRETARY’S PERSONAL ACTION
Give people in the system the power to make the changes work– Briefings on improvements to the QHSR in terms of risk management
Plan for some short term wins– EASY – use National Risk Assessment, National Exercise Program, S&T, etc.
Leverage these gains to encourage more change– Practice on 2013 Budget , use IRM, NRA, NPS to inform 2014 budget.
Anchor the changes into the long term culture– Use to inform Congress / defend 2013 & 2014 budgets
Apply to HLS Ed
22© 2010 The National Graduate School of Quality ManagementEDU301 O 09022010 2222
Blind Bats, Black Swans andRed Motorcycles:
Reducing The Risk of Teaching Risk
Dr. David H. McIntyre
Distinguished Visiting Fellow, Homeland Security Institute
Director, Homeland Security Programs, National Graduate School
979-575-4552 [email protected]