Leading Resilience and Managing Risk

In this episode:

In this episode of Learning In Action, host Bryan Benjamin sits down with Dr. Laurel Austin, Associate Professor of Management Science at Ivey Business School, to explore how organizations can effectively build business resilience, identify and manage risks, and develop strategies for sustainable, long-term success.

Listeners will gain practical insights on how to build an organizational culture that embraces business resilience, including the importance prioritizing long-term outcomes over short-term financial metrics. Further, she explores the psychology of risk preparation, decision-making in crisis, and how leaders can effectively navigate new forms of disruption.

Other ways to listen:

• Apple Podcasts
• Spotify Podcasts

What is Learning In Action? 

Hosted by the Ivey Academy at Ivey Business School, Learning in Action explores current topics in leadership and organizations. In this podcasting series, we invite our world-class faculty and a variety of industry experts to deliver insights from the latest research in leadership, examine areas of disruption and growth, and discuss how leaders can shape their organizations for success. To learn more about the Ivey Academy and the services we offer, visit us at IveyAcademy.com.

The Ivey Leadership Certificate Podcast Mini-Series

Learning In Action presents a special six-part series: the Ivey Leadership Certificate Podcast—designed to equip emerging leaders with strategic insights, practical frameworks, and the mindset to thrive at the executive level. In each episode of this mini-series, Bryan Benjamin sits in conversation with a professor from Ivey Executive Education to discuss timely challenges affecting leaders today.

Episode Transcript:

BRYAN BENJAMIN: Welcome to our special six part series on leadership, resilience, and agility. I'm Bryan Benjamin, and our guest today is Dr. Laurel Austin, an expert in risk management and decision making. She is an associate professor in management science at Ivey Business School. She uses behavioral and decision making science methods to study individual decision making under risk and uncertainty. 

Organizations today face a complex and unpredictable business environment, and leaders must be prepared to identify risks, develop robust strategies to manage them, and ensure their organizations remain resilient in the face of challenges and opportunities. Today, we're exploring the critical discussion on business resilience and risk management in leadership and how leaders can enhance their organizations resilience, mitigate risks, and ensure long term sustainability. 

So risk management has become a critical aspect of leadership today. We hear it all over at the organization, the team, and the personal leadership level. From your perspective, why is it so important for leaders to actively assess and manage risks? 

LAUREL AUSTIN: You know, Bryan that's a great question. I think it's so important for leaders to actively assess and manage risk, because the rate of change in the world is increasing, especially in terms of new technologies and changing climate. And these new technologies have greater reach and greater potential impact that climate change is bringing more and more extreme weather events to so many places and challenging organizations and communities. 

And of course, any change brings uncertainty. It brings possible new events and thus potential risks. So organizations are literally facing new risks at a faster pace than in the past, and the magnitude of risk is growing. These risks can have bigger impacts. And so it's really important to manage risk, to assess and manage risk because that's what's needed to build resilience in organizations. 

Building resilience capabilities has to do with building capabilities that allow an organization to suffer some sort of setback, to suffer some sort of a hit, to suffer something bad and come back and keep going. It also has to do with having the capabilities to see new opportunities and take advantage of those. So being agile might be a way to think about it. So it is important to manage risk in order to build resilience and ensure business continuity. 

BRYAN BENJAMIN: Your comment around bigger faster-- so, you know, we used to hear, oh, that's the 100-year storm or the 100-year flood. And then the next year we hear it happening again, so it definitely feels like it's happening at a quicker pace and on a bigger magnitude. And these are just the ones that are sort of publicly visible. We know there's a whole lot going on at the organizational level that may not necessarily be as relevant or as broadly known. 

Let's dig in a little bit on what are some of the common risks that leaders may overlook? So we think about some of these large scale ones, but are there some common ones in your experience that you've seen leaders potentially overlook? 

LAUREL AUSTIN: I think actually we all have a tendency to underestimate how likely risks are. And, you know, part of that has to do with, it's an availability bias, right? What I have available is what's happened to me. And the things I think about are what's available in my memory and what have I experienced. And we aren't really aware of the experiences that are going on around us that we don't experience ourselves. 

So I think we all tend to underestimate the chances of things happening, especially things that are somewhat rare. But these aren't really super rare risks that we're talking about. Risks that leaders-- common risks leaders overlook might include one is just the risk of new technology, right? So 2 or 3 years ago no one talked about AI. Now, we're all sort of talking about AI, but no one's quite sure how it impacts them. Is it a threat? Is it an opportunity? Does it offer both? 

And so it's sort of back of mind, but I don't know that many organizations are actively thinking about how do we manage the risk of AI or other new technologies, right? Five years ago, hardly anyone was concerned about cybersecurity risk. A case that I use in my classes on risk management and resilience is based on a manufacturing company in Ontario. 

So a medium sized manufacturing company that will tell you they visited my class many times. They weren't prepared for a ransomware attack. It wasn't on their radar. It wasn't on anyone's radar in 2019. And unfortunately, it still isn't on a lot of organizations radar, but it's becoming more and more common. So it's easy-- but it's easy to overlook. 

The example that our case is about was a situation where they knew that a backup system had failed and that impacted their information technology. So they had a backup system that had failed, but they had another backup system, so they weren't too concerned about it. And they put it into their funding lineup. So things were going to talk about when we talk about funding, but they didn't prioritize that this was something important because they thought, well, they knew it was important, but they thought they had another-- they had redundancy. 

Then what happened is their systems got encrypted. Their online backup now wasn't available. Their tape backup wasn't available because they hadn't redone that yet. And so they were in a jam because they didn't have a backup. Now, luckily for them, they actually did have a third backup, which was due to some unusual situations. So that was sort of just luck. And they were able to come back. They did everything right in terms of coming back and being resilient. And they were very lucky. They had a happy ending. Many companies don't, that suffer these kinds of attacks. 

So cyber security risk is certainly one that I think leaders overlook. And the third is extreme weather events. You know, we see them happening in more and more places. But unless it's happened to us, it isn't again front of mind. And so I think we overlook that. I think organizations also overlook a lot of internal risk. Technology offers more opportunity for fraud. Our it systems make everything interconnected. And so any problem with our IT system, you know, internally the way we maintain systems can cause a problem. 

In a different vein, organizations are under increasing pressure to focus on short term financial gains, which leads to pressure to make decisions that leaders might believe or suspect, put long term performance at risk, and put resilience at risk. But they're still feeling pressure to focus on the short term. Unfortunately, I think there are lot of risks we might all tend to underestimate and therefore overlook as we're going about our day to day business. 

BRYAN BENJAMIN: Well, and I think, you know, you hit on something that I think that many will resonate with, which is, oh, what's the chance of it happening to me? We say that in our personal lives all the time, right? And you expand that to business. 

And I think the profile of the organization that you shared the case on is actually the profile of many organizations in Canada that kind of mix up our economy. it's not just the big global players that kind of get hit. They often get the press. It's these other ones that maybe could be quite surprised and it could be quite detrimental. 

So building resilience and what leaders can do. So let's talk a little bit more about why resilience is so important for organizations. And maybe you can also kind of come at it from there's resilience in terms of quote unquote "bouncing back'' from an event or something significant. And I wonder if there's even sort of an element of can we exercise and build that muscle before something actually happens so that we're not just always in reaction? 

LAUREL AUSTIN: Yeah. I think in order to be resilient, it really is about building capabilities and building a mindset and habits that allow employees, people within an organization to experience something unusual, something new that they haven't experienced before and be able to sort of quickly adapt to that. 

We talked earlier about how these risk events can be fast, how things can happen very quickly. In risk management and resilience programs that we cover at Ivey, one thing we often talk about is Knight Capital as an example of how lack of resilience capabilities led to the loss of over $400 million in 75 minutes and the sale of the company two days later. 

In 2012, 10% of all trades on the New York Stock Exchange went through Knight Capital. And so even if a lot of us hadn't heard of them, they were a big player. They were doing a standard software update to comply with new requirements. It wasn't a standard update, so it was a specific update, but the kind of thing they do all the time. 

Unfortunately, some old code that they had disabled 10 years earlier came back into play and they didn't realize it, and it messed up the update. So it was a glitch in their system. And that glitch caused trading that they couldn't control, and they didn't have the capabilities to figure out immediately what happened. They shut it down about 75 minutes later. In those 75 minutes, they lost over $400 million. And two days later, the company was sold. It's an example of a company that wasn't very resilient to an extreme event, to an unexpected event. 

And so what organizations need to do is to build a culture and habits that allow them to act quickly, to think quickly, to address sort of problems as they come. An example, an organization that does this really well, I think, is NASA. So in 1970, there was a crewed space mission in the United States that was intended to land on the moon. And then it needed to be aborted due to an explosion. They didn't know what happened and nothing was making sense. Just like with Knight Capital. They're seeing things happening, nothing made sense. 

It wasn't a scenario that they had anticipated at all, but because they had a culture that they had built up through a lot of scenario planning and simulations, thinking about various problems, experiencing various problems, solving problems together, they had developed a culture and habits that allowed them to experience something unexpected and work hard to figure out-- work quickly to figure out what was going on. To sort of overcome that bias of thinking just about what are we familiar with? What do we know? But how do we operate in unexpected situations? 

When Gene Kranz, the flight director, wrote a book called Failure Is Not an Option, he wrote of being angry that they'd wasted 15 precious minutes by not assembling the pieces sooner. So that's how quickly they were able to act. And I think what leaders want to do is develop the culture, the habits, the ability to sort of think on our feet and to overcome problems as they arise. 

BRYAN BENJAMIN: Your comments around sort of mindset and sort of deliberate habit and culture really resonate because we can't anticipate every scenario. Every company probably has a couple of here's a likely potential, but things are moving so fast and changing so rapidly that there may be a scenario that they just couldn't anticipate. But if they're able to put it into action, OK, something is happening, here's what we need to do in order to understand, assess, and move forward. And having that in place before you need it. 

Let's move towards, you know, we've sort of talked about sort of larger risk events. We've talked about building capacity and sort of mindset. You actually mentioned something in your opening comments that I grab on to, and I want to come back to, which is short term and long term. And how do leaders manage between short term risks but also focusing on long term sustainability? 

LAUREL AUSTIN: Yeah. I mean that's a tension that all organizational leaders or business leaders really I think face these days. It's a real challenge for a lot of organizations, because there seems to be increasing pressure to show short term financial outcomes, right? And one way, unfortunately, to do that is to ignore longer term needs, right. To reduce your costs, to reduce your overhead, to reduce your employees, to reduce your maintenance. 

Rob Austin, who's another Ivey faculty member, calls this performance hacking, where an organization is hacking away at long term performance in order to get short term financial gains. And so he's written a case, and it's one that I love to use in my courses on risk management and resilience called Boeing Commercial Airlines-- Industry Leadership Lost. And they're in that case, what we see is a change in leadership in 1998, where a new CEO literally said the performance of this company is unacceptable. It's unacceptable to our investors and to our board. 

We were looking at a company that was known for taking great risks in order to achieve producing the best airplanes in the world, and had done so since forever since we had airplanes. So they took great risks and they did have big financial swings as a result. But they always managed and they managed to create these great airplanes, and they were known for the quality of their engineering. 

But 1998, we saw this change in focus, and the focus became investors and Wall Street, and they became very risk averse. And they stopped taking big risks and they stopped working on new innovations. Unfortunately, through discussion, when I talk about this in programs and courses, through discussion, we talk about what role did performance hacking play in the challenges that we see in the news every day for Boeing? 

But Boeing is not alone in this. This isn't a problem just for them. They just unfortunately happened to be in the news a lot these days. There was a World Economic Forum report a few years back called Building a More Resilient and Sustainable World. And they point out that since 1980, as a percentage of net income, shareholder distributions have doubled. 

Well, the way you can double shareholder distributions is to be showing more profit, cutting your costs is a pretty typical kind of response. And so this is a challenge that leaders face. This between short term profitability and building long term resilience. And the World Economic Forum in their report, they attribute the ability to increase shareholder distributions to not investing in building resilience. Not investing in those things that we need for long term business continuity. And so it is a real tension. 

It's hard for organizations to put money into building resilience because, you know, we're talking about things like building in redundancies. We're talking about building quality and seeing things that we don't necessarily see in the short term. And so it is really a hard thing for leaders to manage. 

BRYAN BENJAMIN: I'm going to bring us to a close with one last question around leading through uncertainty. I think that is probably the one thing we know, is this going to continue? And if the past is any predictor, the pace probably is going to pick up and the complexity is going to continue to increase. So maybe you can draw out some of the key skills and strategies. You know, if you could give me a sort of top 2 or 3 that you feel leaders need to be able to do to make effective decisions and ultimately navigate through uncertain environments as it relates to resilience. 

LAUREL AUSTIN: Some of the key skills I think that leaders want, you know, if we think about things that impact quality of our decision making, there are things that we see over and over, right. And these affect our ability to deal with uncertainty, to be in uncertain environments. One thing that leaders want to be aware of and then be thinking about, and there are some strategies to overcome, this is what we call a confirmation bias or an early hypothesis bias. 

So we're in an uncertain situation, and we have a hypothesis about what's going on. And often as I said earlier, you know, we rely on what have we experienced before. It must be happening again, right? Or this looks like something I've seen before. The problem is, once we have a hypothesis, a belief about what's going on, we tend to look for confirming information. 

And we're very good at looking for confirming information. We ignore disconfirming information. We rationalize away things that don't make sense, and so we overlook other possibilities. This was something that in Apollo in that situation, they were really good in Apollo 13 at saying, because they did initially say, oh, it looks like the time the antennas were a problem, it looks like this-- but they quickly put those aside. But if we don't have the habit of putting aside and thinking about what else might be going on, then we can get into problems. 

So one strategy is to always look for disconfirming information, right? And to carefully map out what do I have that confirms various hypotheses, and what do I have that disconfirms my various hypotheses to help us think things through? Another strategy when we're dealing with uncertainty is to be aware of what we call an overoptimism bias. And we all tend to have this. We're overoptimistic about our own capabilities. We're overoptimistic about our own knowledge. 

Certainly, when people are putting together proposals for solutions to problems that you have, they tend to be overoptimistic, right? And we all put on sort of these rose-colored glasses. So, you know, leaders want to be aware when others bring you proposed solutions, they're likely to be overconfident in their own solution. So can you-- how do you have systems in place that allow you to respectfully, you know, challenge and question solutions that people are bringing? 

Can you bring in devil's advocates? How can you bring in an outside view to look at things more objectively, right? And to assess the strengths and weaknesses. Because we do we do tend to be overly optimistic about things that we're proposing, the ideas that we have, and putting those forward. 

BRYAN BENJAMIN: I want to say thank you, Laurel, for another fantastic conversation on business resilience and risk management. Every time I talk to you, I learn something new. I get a little scared, but it's good. I should be scared because it's going to push me into action. But I always appreciate your expertise and your generous insights. 

Laurel's module on building resilience and risk in leadership is part of our Ivey Leadership Certificate series, where leaders can learn to navigate these uncertain times and build resilient organizations.

Thank you to all of our guests and listeners. I hope you found the discussions as insightful as I did, and that you're feeling more empowered to lead with confidence, resilience, and vision. Thank you for listening to the Ivey Leadership Certificate Podcast. 

[MUSIC PLAYING] 

About The Ivey Academy at Ivey Business School

The Ivey Academy at Ivey Business School is the home for executive Learning and Development (L&D) in Canada. It is Canada’s only full-service L&D house, blending Financial Times top-ranked university-based executive education with talent assessment, instructional design and strategy, and behaviour change sustainment. 

Rooted in Ivey Business School’s real-world leadership approach, The Ivey Academy is a place where professionals come to get better, to break old habits and establish new ones, to practice, to change, to obtain coaching and support, and to join a powerful peer network. Follow the Ivey Academy on LinkedIn.