Your Top Risks are Mysteries, Not Puzzles

By Melanie Lockwood Herman

It may not surprise you that many people who are drawn to risk management are undaunted by puzzles. At NRMC we often hear a commitment to “figure this out,” or “sort and rank our risks.” My sense from these conversations is that risk champions in our sector sometimes feel overwhelmed by the number of pieces in their respective risk puzzles. I also sense a belief that somehow the pieces will eventually fit together, creating a neat picture of risk in the organization and the clues to what is required to thwart or evade those troubling ‘what ifs.’

I’m guilty of the puzzler point of view: I’ve told many people that during a risk assessment the NRMC team gathers pieces and perspectives from an array of constituents and then puts the pieces of what we’ve heard together. I enjoy a good puzzle and the satisfaction of putting the final piece in place.

But what if risks—the most significant possibilities—facing your nonprofit today, are mysteries, not puzzles? This troubling (!) thought came to me as I was reading Curious, by Ian Leslie. In a chapter devoted to the topics of puzzles and mysteries, the author cites the distinction between the two made by Gergory Treverton, a security and intelligence expert. Treverton opined that mysteries are murkier and pose questions that can’t be answered definitively. Why? Because they depend on various factors, including the knowns and unknowns, that are interrelated in interesting and complex ways.

Leslie writes that “Puzzles tend to be how many or where questions; mysteries are more likely to be why or how.” Leslie explains that when we see challenges as puzzles, “we are limited by the goals we understand, ignoring the possibilities we can’t yet see.”

Sleuth, Don’t Solve

No risk professional will be ever celebrated for simply coming up with a refined or ranked list of concerning risks facing their organization. Each of us in a risk role is expected to follow up risk identification with action. That leads us to the endless task of trying to solve concerning risks instead of understanding them. Our determination to find solutions leads us to ask:

• What exactly will this risk look like when it happens (severity) and what is the precise chance it will happen (likelihood)?
• What can we do to prevent this possibility from ever happening?
• What policies or practices should we adopt to make sure we are absolutely ready if it happens?
• How can we assure management/the executive team/the board that we have this risk well in hand?

When we shift to sleuthing, instead of solving risks, the questions are much harder. Sleuthing requires that we ask:

• What do we really know about this possibility? More importantly, what don’t we know or understand?
• What are the potential consequences of being wrong about this risk? Misunderstanding its causes or consequences?
• What are the various ways this risk could manifest here?
• How is this risk similar to or adjacent to others we’re concerned about?
• Who would have strong views or unique insights on the ways in which this risk could unfold?
• What are the types of decisions we should consider to build resilience in the face of this and adjacent risks?
• What are we doing today that creates fertile ground or momentum for this risk?
• How could this risk lead to new opportunities for us? What can we do to prepare?

Stop Searching for Easy Answers

If there appear to be easy answers (e.g., adopt a new policy, retrain everyone, announce new rules at the next town hall, etc.) to your toughest risks, you’re ignoring or simply missing the risk’s inherent complexity. When a nonprofit team agrees to focus on a short list of risks this year (something NRMC strongly recommends!), all the risks on your list will be complex, connected in some ways, and mysterious in others.

Put aside the knee-jerk reactions we’ve all heard from others, and admittedly have tried ourselves. Remember that when you treat risks as puzzles, you will experience frustration when your top risks don’t dissipate simply because you took action. Recast your top risks as mysteries you may never solve—even after some of them materialize. You may never truly understand a strange convergence of events and circumstances both within and far outside your control.

Lean into your risks (mysteries) and stay obsessively focused on what you don’t know. Take the words of Ian Leslie to heart: “Mysteries are more challenging, but more sustaining. They inspire long-term curiosity by keeping us focused on what we don’t know. They keep us feeling ‘alive and active’ even as we work in the darkness.”