Rule-driven and risk-driven management
In this second post on the 7 principles of managing for safe behavior, we focus on regulations in the manager’s toolkit. The word “risk” is used here in a broader sense and refers to the dangers that need to be managed in a boardroom. For example, submitting a bid is a risky process. In the case of a large contract, a miscalculation can put the organization in jeopardy.
The essence of entrepreneurship
Entrepreneurship involves taking calculated risks. Organizations that manage their risks best are more successful and better equipped to survive economic fluctuations. We often label risks as something negative, but strong companies distinguish themselves by handling risks effectively. Organizations that take too few risks may deliver a perfect product but fail to innovate sufficiently. Kodak is a prime example of how this can end. On the other end of the spectrum, organizations that take too many risks may experience rapid growth but lack stability during economic turbulence. Think of Lehman Brothers. Surviving in a competitive environment is best achieved by finding the optimum point on the risk spectrum. This optimum varies by industry and process.
The regulation paradox
Safety management is often mentioned in the context of eliminating risks. This can lead to confusion between eliminating risks and managing them. Classic safety science tends to want to eliminate risks from processes by describing as many activities as possible in rules. This is recommended for all standard processes. However, the price paid for this approach is that a rule-based approach typically leads to a rigid structure that makes it difficult to adapt to changing situations. Moreover, goal-oriented employees may be tempted to bypass rules if it makes it easier to achieve results. Safety measures unintentionally lead to new and unforeseen risks, putting safety in jeopardy once again—the regulation paradox.
The optimum level of regulation
We can view safety management as an integral part of organizational governance. Analogous to the optimum point on the risk spectrum, there is also an optimum level of regulation. A lack of rules leads to chaos and repeating the same mistakes. It indicates a failure to learn from the past. Too many rules make an organization rigid and less agile. Rules work well for foreseeable risks and standard processes, but they fall short when deviations occur. An excess of rules also stifles innovation.
Incubators
This is often observed in over-organized companies. As a response, they start using incubators, small startups that operate independently of the parent organization and its mandatory policies. They serve as breeding grounds for developing new products and services. There is nothing inherently wrong with incubators. The problem lies in not questioning why they are needed in the first place. If an organization believes that good initiatives cannot thrive within the organization’s structure, it should at least reconsider the level of regulation.
Regulation obsession
The reason why organizations don’t question this may have two causes. The first is that they are so accustomed to regulation as a control mechanism that they keep falling back on it. Rules become a modern panacea for all ills. The second reason is that organizations don’t see the alternatives. Can you organize without regulating everything? What possibilities exist besides using a rule?
From rule-based to risk-based
Brain-Based Safety invites us to seek solutions in our original behavior, in our basic human programming. After all, our ancestors survived and reproduced without rules to protect them from risks. They lived through it repeatedly. Risk management is, therefore, in our blood or, more accurately, in our DNA. We call this ability risk-based behavior, the ability to respond adequately to risks in our environment and our plans.
Rule-based – top-down
Rule-based management implies top-down control. Typically, an expert from staff formulates a procedure that is then rolled out through the line organization. The message from the top is, “This is how you should do it.” The same staff later reports whether the implementation has proceeded as planned, which is part of the management review or audit. Rule-based management falls under process control.
Risk-based, also bottom-up
Risk-based management means, among other things, that there is a dialogue about potential risks and ways to manage them at every level in the organization. The top’s message is, “Show me that you are aware of the risks and are equipped to handle them.” This message has a pedagogical dimension because we must first be educated/initiated before we can understand the risks. To quote Johan Cruyff, “You only see it when you get it.” Social interaction precedes risk-based action. Therefore, this falls under social control with clear bottom-up elements.
In conclusion
Of course, there are more aspects to social control. It’s essential to realize that both leeway for action and management attention from the top are required to make this control effective. The following posts will delve into this topic further.
Juni Daalmans
September 2016
