Steve Keller, CPP

Steven R. Keller and Associates, Inc.

ABSTRACT

Risk can be managed but it must be understood. Sometimes it is necessary to look at risk differently to understand it. Humans have a tendency to avoid thinking about risks and when they do, they tend to worry about the wrong ones. Often, they misunderstand the mathematics of risk.

DISCUSSION

Last month, I had an interesting and revealing conversation with a museum director on the subject of risk. I suggested that conditions were poor in the museum with regard to security, and that the museum may want to consider devoting more resources to security projects over a multi-year period. The director told me that he disagreed, since the museum had not had a theft, fire or act of vandalism in over ten years, so they must not have a problem.

I explained that what he is doing is playing the odds, but he is playing the game incorrectly. The director had been presented with objective facts in the form of my security survey report, which showed problems with the museum’s access controls, parcel controls, and a total lack of any internal security controls in the form of pre-employment screening or internal audits. In addition, he had been presented with the experienced opinion of his registrar and of his consultant that a serious risk exists and that the museum is long overdue for an incident. But even in light of these facts and opinions, he chose to conclude that since no problem had occurred in the past, no problem would occur in the future.

My task was to convince him that he and I were comparing apples to oranges. I was saying that a risk exists and conditions would permit a criminal to take advantage of the opportunity presented by the museum’s poor security. Worse, conditions were also conducive to a serious fire. He, on the other hand, was playing the odds, ignoring the facts that a risk exists, and was saying that nothing bad would happen because it had not happened in a long time.

Now, I agree that past performance is sometimes an indicator of future performance. If, for example, one has excellent security controls in effect and no incident has occurred, then it is safe to predict that the chance of an incident occurring in the future might be reduced. This doesn’t mean that a risk doesn’t exist. If a museum is located in a high crime area, you still have a risk. If you deal with the risk by providing physical and electronic security and trained guards and good procedures, then you simply have managed the risk. The risk hasn’t gone away.

Here is how I showed the director the error of his ways. You can use this method, or this concept, the next time your superiors say to you, "It won’t happen here because it has never happened here." First, I got him to agree that deficiencies did exist in all areas of security and fire prevention. All that was contended was whether ten years of crime-free and fire-free existence was a predictor of future event-free status, or whether it should send a message to him that their time may be running out.

I took out a quarter and flipped it, asking the director to call heads or tails. He called heads. The coin came up heads. "OK", I said. "You just had one crime and fire free year. You get to keep your job. Let’s flip again."

We flipped the coin again and it again came up heads. "Wow," I said, "A second crime and fire free year. You can work here for another year." We repeated this process for nine flips of the coin and each one came up heads. "Amazing luck", I said. "Nine years in a row you faced a risk that we all agree exists, and you came out unscathed. Let’s bet your job on one more flip of the coin. If it comes up heads again, you get to keep your job. If it comes up tails, indicating a theft or fire, you lose and your Board will re-consider your employment for being so foolish for betting the museum’s assets on such poor odds. But let’s put some real risk in this test."

I pulled a $100 bill out of my wallet and laid it on the table. "I’ll bet $100 of my money against $100 of your money that the coin will come up tails. If I win, you not only quit your job for failing to manage risk, but you pay me $100 of your own money."

The director looked at me like I was crazy. I slid my special two headed coin into my pocket and pulled out a regular quarter, ready for 50-50 odds that I’d win. He thought about the likelihood that a coin, tossed ten times in a row, would always come up heads, and declined the bet. For ten years he had failed to see the risk or the odds. For ten years he had bet the museum’s assets, each year thinking that the longer he went, the better odds he faced, when, in fact, that was not the case.

My point is that humans fail to understand risk and odds. Sometimes odds are too abstract. It wasn’t until he faced having to pay me $100 of his own money that the logic of my point hit home.

I was in San Francisco recently, working on a museum project, when the architect said to me, "How can you stand living in Florida with all those hurricanes?" Here was someone who lives on an earthquake fault and subject to building collapse without warning while he sleeps, telling me that I am in grave danger, even though hurricanes usually give weeks of warning and hit North Carolina and Louisiana and Texas more often than they hit Florida. He just wasn’t thinking. I have a friend who smokes and rides a motorcycle, but won’t fly. Go figure.

Humans often fail to look at the big picture when assessing risks. And we are programmed to think more closely about certain types of risks than about others. When a 747 goes down and hundreds die, we are appalled and disgusted. But every day, so many children die of malnutrition that it roughly equals over 100 crashing 747’s, and few think about this number.

K. C. Cole, author of "The Universe and the Teacup: The Mathematics of Truth and Beauty", says that parents worry more about their children being abducted by strangers or dying from a drug overdose, when the risk is far greater of them dying from choking, falls, drowning, burns, and other accidents which they often ignore. They allow their kids to bicycle without helmets, etc. Forty-three thousand people will die in auto accidents this year but nearly half million will die from tobacco. We license and test drivers but allow anyone to smoke.

Our sense of risk depends upon our culture, our training, our awareness, and our basic human psychology. Perhaps the museum director wasn’t aware of the number of museum thefts that actually occur. I asked him. He wasn’t. He didn’t subscribe to IFAR reports and didn’t read the Museum Security Network on the internet. Neither did his director of security. And he had other conflicts that blinded him. He had budget concerns and, in his mind, perhaps he was balancing the risk of a theft with the risk of having to not hire that new curator he had been counting on. But that’s another subject called "criticality". Which is more critical to the museum, losing its collection and building in a fire, or not hiring that curator. The director had made his decisions based on bad information. He hadn’t considered the ultimate impact or consequences of his actions.

People tend to think that things which are beyond their control are a greater risk than things they can control. And most people fear exotic risks more than day to day risks. I’m sure that this director worried more about the safety of his paintings in transit when being shipped to Europe than he did when they were in their unalarmed gallery protected by a 70 year old untrained night watchman.

Math professor Sam Saunders of Washington State University notes that we tend to accept risks that come upon us slowly, and become alarmed at risks that confront us suddenly. Maybe this is why the museum director accepted the security risk. He had learned to live with it. Saunders says that if you put a frog in hot water, it will struggle to escape, but if you put it in cool water and slowly heat the water, it will remain calm until it cooks. Have you become complacent with your situation? Do you face risks that no longer bother you because you have lived with them for so long. Most important, are they getting worse, getting more critical, while you ignore them?

Professor Saunders makes a point. He asks us to imagine that cigarettes, by themselves, are not harmful, but that one cigarette in every 18,250 packs is packed with enough dynamite that when it is smoked, it will blow the smoker’s head clean off. Under such conditions, 1,643 people per day would die a sudden explosive death or be disabled, because 30 million packs of smokes are sold each day. Would cigarettes be banned as a result of this much carnage? You bet. Why aren’t they banned today? That is roughly the same number of people killed or disabled from smoking each day. We just don’t think about risk logically.

K.C. Cole notes that ego plays an important role in understanding and accepting risk. We over estimate the risk of bad things happening to others, but underestimate the risk of the same things happening to us. We are psychologically programmed to think that things won’t happen to us. Without this internal program, we’d be too afraid to do anything, and humans would still be hiding in caves.

So how can we sell others on the need to consider risk and take it seriously? When advertisers want to convince us that drinking and driving is bad, they show us the faces of children killed in alcohol-related accidents. We relate better to people with a face and a name than to a statistic, so orphaned children in third world countries are used in commercials that seek financial sponsors for the children. Taking a lesson from them, perhaps we need to personalize our appeal for improved security.

First, you be the one to take the water’s temperature and escape from the pot before it gets too hot. Don’t wait for your boss to tell you what to do. You are the advocate for good security, not your director. Be alert to opportunities that allow you to personalize risk. Nothing helped my security program more when I was a security director than a theft at a nearby museum. It was close to home and it had a face! I subscribed to IFAR reports and circulated a monthly fact sheet reporting on the thefts that occurred during the month. There is nothing like reporting on thefts that no one realized had occurred, then putting a face on them such as, "A Monet was stolen from Boston and a Picasso from Rome" . Subscribe to the Museum Security Network on the internet and forward the daily list of museum thefts and incidents to everyone in your organization who may not realize the extent of the problem. It can be sobering when it happens to museums you know.

Work with your local police and fire officials, your security consultant or even some of your security contractors and vendors, to compile statistics that may support your case that risk is real. Think of creative ways, like those above, which re-state risk in a manner your boss can understand. Most important, make your boss aware that risk CAN be managed. Too many people tend to ignore--or hide from--risks that they feel they can’t control. They feel that if they ignore a risk, it will go away. They are aware that a problem exists and that there will be consequences if the disaster occurs. But they kid themselves about the likelihood of the problem occurring. By identifying the risk and assessing the criticality of the risk occurring, you can target risks objectively. Which risk is more likely to occur? Which has the greatest impact if it does occur? This process helps you decide where to devote limited resources and offers your boss a real solution to the problem of managing risks.

Copyright 1998 by Steve Keller, Steven R. Keller and Associates, Inc. All Rights Reserved.

May be reproduced in the Proceedings manual with the copyright notice and may be reproduced by colleagues for fair use in their institutions if properly attributed and unmodified.