Every year our governments spend a lot of money to attempt to successfully forecast hurricanes, even though such forecasts are not useful. As a nation, we raise a fit (understandably) about the threat of nuclear proliferation, yet continue to suppress evidence or learn effectively from such situations in the past.  Pressure on both world oil and food supplies is increasing, yet we inefficiently transform food into an oil substitute, a process that is not environmental or economic, but political. We have a national train system that is inefficient by all measures, yet we continue to pour tens of billions of dollars per year into subsidies of it. The top accountants in the nation believe our economic future is disastrous, and there are credible predictions of dire bear markets ahead, yet the political will to do anything about it is neutralized, while the markets continues to climb towards an inevitable market adjustment.  When corporate scandals occur, there is nearly always great political knashing of teeth to manage such issues, a rush to judgement, and typically major new legislation (and resulting investments) are rolled out to appease the public outcry. As a result, we end up with things like Sarbanes-Oxley, even though the costs and value of such approaches are highly questionable. Legislators pass speed laws, thinking that behavior will be affected, despite evidence to the contrary.

What is going on? One possibility (from many possible memory biases) is confirmation bias, the tendency to interpret new information within the mental models of current beliefs. The extent and persistance of conspiracy theories are further demonstrations that we have tendencies to be attracted to fascinating stories (whether right or wrong), rather than managing by facts and data.

Within organizations, it can often seem to the grass roots as if leadership operates in a similar fashion, adopting 'leadership theories' which can also be based upon fascinating stories, hopes, and fears that may or may not be relevant or appropriate to a particular work setting. The koolaid that feeds this behavior can sometimes be driven more by everyones' common belief system, rather than a serious and dispassionate appraisal of relative strengths and weaknesses that different approaches to problems always have. Organizations can thus exhibit the symptoms and behaviors of attention deficit disorder, just like individuals.

In addition, organizations also exhibit herd behavior, which is why critical analysis and thoughtful leadership are so essential to establishing meaningful change for any group. You can't just blindly apply any concept, even those that can be useful and effective practices in appropriate situations - too much of any good thing can be bad, and the right things in the wrong combination can produce chaos. Like drugs, best practices have to be prescribed carefully, and applied professionally, and only after a full consideration of the impacts to a portfolio's health over time.

Here are the facts. Life is cyclical. There will always be mixtures of bad and good weather ahead. You won't always be able to predict when things will change, because you can't control everything. Now it's global warming, but not long ago it was global cooling. You need to prepare for each circumstance, and in reality, at different places and times, both are always going on. Such preparation means being able to recognize and act on where the real leverage is. Systems thinking can help here, but only when appropriately broad perspectives, from diverse backgrounds, are brought to bear.

What does this all mean to risk management as a practice, in specifics such as the hurricane prediction mentioned above, or in managing projects? Both people and organizations only have so much attention to give. An important question must therefore be, where should we give that attention? In seeking answers to that question, critical thinking is an even more important skill than risk management (or should at least be a necessary precursor to it). Perhaps organizational learning is an equally important element for a viable long term strategy.

Risk management is a good thing to do, but if the risks you manage are the wrong risks, it may not matter as much if you manage them or not. The concept is risk management, not risk awareness, so to realize real value from investing in that technology, you shouldn't just be focussed on how well risks can be identified and tracked; adequate attention must be given to how effectively you are doing at mitigating them. In the insurance industry, that's typically accomplished by managing the contents of your portfolio itself, with analytical knowledge of the exposure inherent over time to resulting risks. Within project management, wouldn't this imply a more frequent exclusion of projects that fail to practice effective project management from your portfolio?

In that regard, any effective business strategy should provide credible reviews and oversight to assure that best practices are usable, effective, consistently applied, and are actually delivering the results that are expected.  Otherwise, you may find yourself sailing into stormy weather without a compass or map!