Why risk aversion is increasing your risk of delivering a bad service

‘Risk management’ isn't a topic that comes up a lot in conversations about how we design better services. 

It's usually something that we are vaguely aware of but is either someone else's job to deal with, or something that we feel we don't want to, need to - or sometimes - can't get involved in. 

Yet it's our organisation’s often misplaced sense of risk, and bizarre way of ‘managing’ it that stands in the way of our ability to design better services.

There are the obvious ‘risk averse’ sectors that are incredibly difficult to make changes in (borders, justice, health are all, for good reason naturally more risk averse environments) but it's not just our general sense of ‘how much’ risk we can accommodate, it's what exactly we think is risky.

We often see agile ways of working as riskier than a more traditional waterfall process, but as Paul Downey once tweeted many moons ago;

“agile is making it up as you go along, waterfall is making it up at the beginning and living with the consequences"

Which seems riskier when we reframe it this way?

Design and user research are often seen as ‘risky’ activities as they introduce an element of uncertainty. What do our users need? We don't know until we've asked them! But both of these activities, if we want to think of them in the context of risk, are simply ways of re-risking decision making so that we are more certain that we’re right. 

These examples show us that we have a tendency to err on the side of ‘out of sight out of mind’ when it comes to risk.

If we just ignore the fact that we don't know what we should build, or what our users need, or even how we should meet those needs, and we carry on with The Plan, then EVERYTHING WILL BE OK. And of course, there are risks. 

This isn't the only risk we're creating from a skewed sense of risk, there’s also the fact that we tend to deliberately displace risks we already know about, in order for them not to be our problem. Want to stop cardiac arrests happening on commercial fishing vessels at sea? Put in place a mandatory BMI check for fishermen and watch them get risky bariatric surgery to try and meet the requirement!

Don't want your ride-hail customers to be hacked and defrauded? No? Then what about requiring mandatory two-factor authentication code whenever they speak to you so that when they lose their phone in the back of a cab (and their ability to get their code), their only way of ‘contacting’ their driver is to track them using ‘find my phone’! Perfect. 

I like to call this particular phenomenon risk displacement where risk doesn't go away in our service, it just gets moved somewhere else where we can see it less. Like a floor-drobe shoved in a cupboard.

Our inability to see, assess and then appropriately deal with risks in our service is one of the biggest causes of bad services. It leads us to engage in risky risk management (waterfall processes) and change our services so they create more risk (displacing it to places we can't see).

By far the greatest issue though, is that our misplaced sense of risk leads to worse decisions, which in turn leads to panic that creates the kind of short term thinking that more risk thrives in. Not properly engaging with risk means we become ever more short term, managing smaller and smaller risks while veering strategically off course.

So, how do we deal with this issue? First and foremost (like everything else in Bad Services) we have to recognise it’s happening and that short term decisions will not solve long term problems.

Look out of the window; take a deep breath

The world around us may become increasingly reactive, divisive, fraught and out of our control. When people have to fight for scarcer resources, we will face conflict. Conflict can lead to more risk aversion and the continuation of austerity-era service design, but that isn’t inevitable.

Our job is to break the cycle of short-term decision-making by reducing the current levels of panic we feel as an organisation and making the unknown less of a scary place to be. To do that you will need to put on your own oxygen mask first. So, before you attempt to do something like this, think of how you might find help and support to do this work.

De-escalate the crisis

It is almost impossible to get an organisation in crisis to think long term. Sometimes that panic is of our own creation through a lack of prioritisation, and an ever-decreasing tolerance for risk. Seeing those long-term patterns when all we can think about is the next deadline is really difficult.

If you’re in a position to do so, prioritise what you’re working on. If you were to do the things you’re currently doing well, with the right user research, the right number of people and the right amount of time, how many projects could you reasonably do? What does ‘doing things well’ look like for your organisation? Can you describe it? Is it different to what you’re doing now? If you had 10 years, how would you approach what you’re working on?

It’s likely that you’re doing too many things at once. Maybe you’re even focusing on the wrong things. Either way, to make a change to our current to-do list we may well need to use tactics to shift our focus from short-term urgent work to longer-term important work.

This is just the start of our journey of truly engaging with risk more effectively.

For more tips on how to spot where mismanaged risk might be causing worse services in your organisation, check out our new book, Bad Services and episode 11 on our podcast on risk.