If you have been active in risk management for a while, you have probably heard of the 4 T ‘s. These—at a very high level—are the four possible responses to risk. Conveniently, each begins with the letter T:
They appear in various risk management standards. They pop up in books, articles and web searches.
Would you believe they are incomplete?
They are indeed. There is a fifth response not covered by the other four.
I’ll give you a hint: It is widely used by insurance companies.
Do you know what it is?
The answer is slightly counter-intuitive, so I won’t tell you right away. Let’s start with some background.
In my 2004 paper Defining Risk, I identify the two essential components of risk:
- exposure, and
Uncertainty is self-explanatory. If there is something you don’t know, you are uncertain.
Exposure is having “skin in the game”—a reason to care. You may be uncertain what will happen to the price of Google stock tomorrow. If you have no position in Google stock, you are not exposed—you are uncertain, but you don’t face risk.
In my paper I give the example of a man jumping from an airplane without a parachute. Some might say he is taking extraordinary risk, but that’s not true. He is exposed because his life is on the line. But if he is sure to die, he faces no risk. Risk requires uncertainty.
Many risks can be reduced or eliminated by reducing or eliminating exposure. Suppose a wheat farmer faces risk because he doesn’t know what price he will receive for this year’s crop. He can reduce or eliminate the risk by selling wheat futures. According to the 4 T’s, this is a means of “treating” the risk.
So risk can be reduced or eliminated by reducing or eliminating exposure. What about reducing or eliminating uncertainty? Will that work too?
Not according to the 4 T’s. They don’t cover this.
But reducing uncertainty works! Here is an example.
Suppose a rare genetic disease runs in a young man’s family. There is a 50-50 chance that he carries the gene. If he does, he will come down with the disease. Otherwise, he will not.
The man is exposed and uncertain, so he faces risk.
Now suppose the man’s doctor performs a genetic test to determine if the man carries the gene. Whether the test comes back positive or negative, the man’s risk will be eliminated. Why? Because his uncertainty will be gone. Like the man jumping from the airplane, he will face no risk.
So some risks can be reduced or eliminated merely by investigating them.
Insurance companies do it all the time. They employ actuaries who investigate risks. This reduces the risks to the minimum level possible, so the insurance companies can charge competitive rates on insurance policies.
So we must add “investigate” to the 4 T’s, making them the 4T’s & I. Here is the new list.
I know what you are thinking: Isn’t there a synonym for “investigate” that begins with T?
Sorry. I checked my thesaurus and found nothing.
If you like, here is an idea.
It is not common, but some people describe risk responses with 4 R’s instead of 4 T’s. These are
And there is a synonym of “investigate” that begins with R. How about “research”?
If you are okay with that, we can toss the 4 T’s and go with the 4 R’s. Only now they will be 5 R’s:
Now the list is complete.
To me your 4 or even 5 R’s seem more suitable words than 4T’s.
Simple and thought provoking.
Minor point but couldn’t you think of research as one of the tools available to Reduce uncertainty? Is there a subtle difference i am missing?
Glyn, under Treatments, could you write about or share a good reference to illustrate the suite of treatments that are typically used or have been historically tried in various situations.
I agree. REDUCE is so broad that it might encompass both RESEARCH and REASSIGN. After all, hedging a risk REDUCES that risk, but many hedges might be considered to also REASSIGN the risk.
If we stick with the “4T’s and I”, there is less of a problem. I doubt many people would consider RESEARCHING a risk to be a means of TREATING it.
For this reason, I prefer the 4 T’s over the 4 R’s. But this is a matter of taste and semantics. User jahangir commented that he prefers the 4 R’s to the 4T’s.
As a practical matter, authors and standards that cite the 4T’s or 4R’s generally clarify what each response is assumed to encompass. Although usage from one to the next is not always consistent.
I break RESEARCH out as a fifth response because such clarifications never mention it as encompassed by REDUCE (or encompassed by TREAT or any other response). People tend not to realize they can address some risks merely by investigating them. Including RESEARCH as a fifth standard response makes people aware.
As for a list of treatments that can, or have been used to address risk, I am happy to write on the topic. Keep an eye out for a blog post on the topic soon.
I would add another “R” word: relinquish. I’ve seen lots of situations where the line unit had far more political power than the risk group, basically disagreed to management about the situation, won, and the risk group relinquished the control. For example, we told our interest rate swaps group that Libor could dive really low. They disagreed citing their long grandfatherly history with the company and deep knowledge of the markets. They won. We changed our risk assessment. And of course, rates really did dive really low. And that senior manager is retired now, living very comfortably in Marin north of San Francisco in what I’m sure is an amazingly expensive house. I think he has a vineyard.
Or, if we look at this from management’s perspective, your new “R” could be “Reprimand” as in “reprimand the risk manager.” That sure makes the risk go away!
Such events are unfortunate but common. Good risk management comes from the top, as does bad risk management.
Wonderful article and very thought provoking. However, I do disagree with you to an extent in that risk identification inherently includes research.
Risk is the probability associated with a negative outcome. Risk identification and assessment is the process by which we evaluate those outcomes and either increase our knowledge of the potential outcome, or reduce the probability of it occurring.
I do not believe that uncertainty alone produces risk. One may be fully aware of the hazards of jumping out of an airplane without a parachute, and still remain tolerant of that known outcome. The knowledge or lack of knowledge about a particular outcome often bear no consequence to whether the outcome occurs.
Your use of certainty and uncertainty really describe our knowledge AND perception of the probability associated with a particular outcome.
For instance, using your medical example, the patient who gets test for a genetic disorder may “still” be at risk if the test results are flawed. He may “perceive” that his risk is reduced whereas in reality, his exposure and risk remain though his “certainty” has changed.
If you’ll pardon the invocation of Donal Rumsfeld, he once stated that there are known-knowns, known-unknowns, unknown-knowns, and unknown-unknowns. This is actually a wonderfully succinct way of describing the relationship between knowledge and probable outcomes.
Really appreciate your thoughtful piece. Thank you,
Thanks for commenting!
I am familiar with that definition of risk, that “Risk is the probability associated with a negative outcome.” It is a poor definition. Literally, it is saying risk is a probability. No. Risk is more than that. Indeed, risk is a more fundamental notion than is probability. Probability is a human invention. Risk is a human experience (an experience of any cognizant being, actually) that predates that invention.
For example, a Neanderthal confronting a saber toothed tiger faced risk despite there being no concept of probability at that time.
Risk has two components: exposure and uncertainty. If either is absent, there is no risk. If I have appeared to say otherwise, that was not my intention.
Personally, I think any invocation of Donald Rumsfeld is unpardonable :-) (But it is a good quote nonetheless).