The reaction to the pandemic at all levels – government, social, individual – strikes me first and foremost as a failed exercise in risk management.  We all do a lot of risk management, often at an almost subconscious level.  A large part of my job is risk management (and the rarely-mentioned yin to risk management’s yang – risk acceptance).  In particular, I spend my time on catastrophic risk – highly unlikely, but highly expensive, risk.

One piece of my risk management portfolio is our risk finance program, which consists of a captive insurance company and mind-boggling amounts of re-insurance (essentially, umbrella policies).  Insurance provides a certain discipline to risk management – the risks that are being insured are closely defined, if you bother to read the policy, and the price of laying off that risk is in black and white – the premium that you pay for a policy.

An example of one risk financing exercise – the total value of all of our facilities is close to $1BB.  Unfortunately, no insurance company will sell us (or anybody) a policy for more than $800MM.  About the only way we could anywhere close to $800MM is if our big hospital was completely destroyed, and about the only way that could happen is if an airliner crashes into it.  Not impossible, but how much should I really spend to cover that risk?  Since the cost of umbrella coverage above $800MM is basically the cost of capital, why should I buy what amounts to a line of credit for $200MM, every year, for a risk that remote?  So I don’t.  Some risks are so remote you just can’t spend on them, whether through insurance/risk finance or a risk mitigation program.

The ideal, I suppose, is that you spend no more financing and mitigating a risk than the present value of that risk – its severity discounted by its likelihood.  Sounds very mathy and objective, doesn’t it?  One would think that the insurance business, chock full of data and analysts and actuaries, would be driven almost solely by numbers.

But its not.  The presence of all that data, etc. only highlights how subjective it is.  The insurance companies (and these are big global companies) aren’t just interested in what’s in our claims history (all that data they can analyze).  That’s historical, and they are mostly interested in what could happen during the next year, the one covered by the policy they are trying to sell.  Sure, the past is prologue and all that, but they want face-to-face meetings because they want to lay eyes on the people actually creating/mitigating the risk, to get some handle on whether they know what they are doing.  They also want some view of our risk mitigation capabilities.  Their (subjective) impression of how well run an organization is has a surprisingly large influence on what they will sell you and what they charge.

This is all based on assessment of the likelihood and severity of risk, which is a projection – subjectivity is baked in.  At the end of the day, how many claims you might have in the future, and how expensive they might be, is a SWAG.

So let’s take a look at a few risk management pitfalls, as exemplified by our recent experience with terrible risk management – the pandemic.

Tunnel Vision.  The public health wallahs are guilty of this.  They focused on one virus, one disease, to the exclusion of everything else.

Good risk management does not consist of shifting risk out of your bailiwick and onto someone else’s.  The temptation to do this is strong in bureaucratized organizations, and in fact is probably the root cause of a great deal of conflict between corporate divisions or government agencies.  Shifting risk is more in the nature of career risk management, not real risk management, as it doesn’t reduce risk to anyone except, perhaps, you.

Risk management, always and everywhere, requires trade-offs.  What’s the cost (in time and money) of this countermeasure?  What will we not do because we are doing this?  What are the likely knock-on effects and downsides?  None of this was part of the public health response to the pandemic.

Bad Metrics.  A challenge throughout any organization is landing on the metrics you will use to give you some view of organizational performance.  Picking metrics is a never-ending struggle.  Good risk management is a long game – you are looking at performance over time, so changing metrics in midstream is suboptimal, shall we say (although it is necessary from time to time).

The problems with metrics for dealing with the pandemic are legion.  First, they jumped around – cases (really, positive tests), hospitalization, ICU capacity, deaths, vaccinations, etc.  Second, many of them were disconnected from the actual risk of the disease.  Cases/positive tests, for example, only lead to outcomes anyone should care about (death, severe illness) a very small percentage of the time.

Vaccinations as a metric of public health success are also flawed, largely because they were a short-term remediation strategy.  Everyone knew that the virus would mutate out from under the vaccine, so whatever effectiveness the vaccines may have had would wane over time.  Sometimes short-term is all you can do, and sometimes its something you should do anyway.  Presenting a short-term measure as the final solution is a guarantee of failure in risk mitigation and therefor risk management.   Sacrificing the long-term (herd immunity) for the short-term (vaccination) is a cardinal sin.

Credibility.  Risk management is a leadership exercise.  All leadership requires credibility.  Creating and maintaining credibility is beyond the scope of this post (I’m going to need a higher per-word rate for that one), but one thing is clear – our public health enterprise vaporized their credibility with a large segment of the population.  I hardly need to reiterate for this crew the series of statements and mishaps that destroyed the credibility of public health officials at the national and local levels.

But you don’t turn on a dime, such as by suddenly embracing public mask wearing after decades of saying it was ineffective, without making a very solid case for it, one that you cannot make without admitting your previous stance was mistaken.  You don’t respond to serious dissent with a sneering dismissal.  You don’t change the rules, such as by changing what you count from “deaths from” to “deaths with”.  You don’t just ignore that your previous predictions were dead wrong.  You don’t retreat to appeals to authority to support your diktats.

To keep and build credibility requires humility.  I have learned that, counterintuitively, being willing to admit error builds credibility.  Once people see you are willing to admit you have made a mistake, when you do plant your feet and say “This is the way I see it”, they tend to believe you have good reasons.  Humility is apparently not a virtue with which our public health officials are well acquainted.

Credibility, like other forms of trust, is difficult if not impossible to regain once it is lost.  Public health has a role, and our public health masters have done serious long-term damage to their ability to function effectively.   As things stand, our public health masters have made themselves incapable of risk mitigation and management.