In this piece I will introduce the field of Risk Management (capitalised to represent entire body of knowledge and field of practice). I will explain how it differs from Science in terms of motivations, methods, and outputs, and then argue that an understanding of Risk Management, in theory and in practice, will be essential if we are to permanently solve the problem of pandemics.
(You can read more about Risk Management in theory here and Risk Management in practice here.)
I’ll start by defining my terms:
Science is the process of testing hypotheses, in controlled environments, against large datasets, with all the time, tools, and technology needed to do so.
Risk Management is the practice of making decisions, in volatile or uncertain environments, with whatever data, tools, and resources you have available at the time.
Along every axis of these (brief and stylised) definitions, it should be clear that Science and Risk Management are categorically different things.
They are different methods, practiced by different professionals, with different skillsets, in different environments, to achieve different goals. One method would be more effective than the other, depending on the environment in which they were applied and the overall purpose of the enterprise. Neither method is universally superior – despite what the popular culture may have led you to believe.
In short, they are different toolboxes for different problems.
With our introductions done, let's explore the contrasts between Risk Management and Science in more detail...
The goal of Science is to produce true statements about life, the universe, and everything in it. What is an atom? What is an electron? Why does the electron orbit the nucleus? What is gravity? What is electromagnetism? How are they all related to each other?
The answers to these questions are precise statements the are universally and eternally true. Science is the right tool for the job. The Scientific method was designed to produce fixed answers to fixed questions like these.
The goal of Risk Management is, ultimately, survival. A ‘risk’ is any event or future state of the world which could cost you time, money, health, or any other resources were it to arise, and Risk Management is the method by which we minimise those potential costs. The key idea is that if you can manage the risks while they are still risks, then the threat may never materialise. Or at the very least, you will be prepared for it when it does.
Risk Management can be applied to any ‘thing’ (organisations, infrastructure, consumer products, strategic situations) but no matter the context, the goal is always the same: to make the decisions that will ensure the preservation of some valuable thing, be it your home, your savings, your workplace, your community, or your life.
Science is a slow, theoretic, and extremely specific process. It is a very thorough process too, often requiring all relevant variables and alternative hypotheses to be tested one by one until a firm conclusion can be reached – no matter how long that takes.
Most Science takes place in a quiet office or a sterile laboratory where highly-credentialled nerds use precision instruments and advanced technology to analyse a small number of variables. A structured environment is necessary so that all variables can be controlled, the effects can be identified and disentangled and the paths of causality revealed.
Risk Management is a practical, dynamic, and strategic skillset which involves goal-setting, planning, resource management, and tactical decision-making. Risk Management takes place wherever it is needed, by whoever happens to be present, and it can start or stop at a moment’s notice. Ideally though, it begins a long time in advance of the risk event.
While the methods of Risk Management can be applied anywhere, the typical environments would be a battlefield, a house fire, a football field, or the poker table. In these contexts, there are infinite options, limited information, and you’ve got your skin in the game i.e. if you make the wrong decisions, you are going to suffer.
Science is frequentist: it waits for the data to accumulate before reaching a conclusion. Risk Management is Bayesian: it starts with a position and updates as it goes with whatever data becomes available. Science wants to make that one, big, final statement on the matter, and is happy to wait as long as is necessary to do so. Risk Management is constantly adapting because the environment is dynamic and the ‘right’ answers are always changing.
Again: different toolboxes for different problems.
Scientists are motivated by precision whereas Risk Managers are motivated by precaution. Scientists are focused on the centre of the distribution whereas Risk Managers are obsessed with the tails. Scientists are optimisers because they can afford to be. Risk Managers are satisficers because they can’t afford not to be: they are dealing with life and death decisions, and at a scale and complexity that Science still cannot handle. Near enough is often good enough in Risk Management, but never in Science.
Science defaults to ‘no action’ and needs overwhelming evidence to budge from this position. Risk Management defaults to protective action and does not relent until there is conclusive proof that the threat has passed. The Scientist needs to be convinced that the noise in the bushes is a dangerous animal, whereas the Risk Manager has already run away. (Humans have Risk Management in their DNA – we couldn’t have survived as a species without it!)
Science makes accurate statements based on what it does know, whereas Risk Management makes adequate decisions based on what it doesn’t know, and that is why Risk Management is essential in a crisis.
One of the most fundamental difference between Science and Risk Management is that the former method is dedicated to making statements whereas the latter is dedicated to making decisions.
Making statements and making decisions are two very different things!
When we make a statement, we are committing to an intellectual position or a belief about the world. When we make a decision however, we are committing ourselves to a particular course of action. Making decisions is about doing, not stating or believing. Statements can be withdrawn or updated as new information becomes available, but actions, once taken, are final.
So a wrong decision is far more dangerous than a wrong statement, especially when the playing field is volatile or uncertain and the stakes are high.
Many important decisions have to be made in situations where Science cannot function. A contagious outbreak, for example, is a complex environment with infinitely many variables and options, where even the first order effects are not well described. Science can’t process the number of paths nor model the complexity that these situations create. We need a better way to safely navigate these environments, and that’s where Risk Management comes in.
Risk Management is the study and practice of judgement under uncertainty. That is, making decisions and taking actions when the situation is dangerous or uncertain and you don’t have enough information to make the decision for you. In these environments, we don’t have the option of waiting for comprehensive data. Even if we did, the relatively small number of precise statements that Science could generate would be of little use to us. We would still be left with the ultimate question: what do we do about it?
Think about it like this: Science can tell you what a hurricane is, whereas Risk Management can tell you what to do about it. That's a BIG difference! And which would you rather know? Which body of knowledge would be more useful to you in your life?
Imagine there was a Cat 5 hurricane headed your way. Would you rather have a Scientist there to tell you the precise definition of a hurricane and to explain how they form? Or would you prefer to have a Risk Manager there who could calmly advise you how to protect your home and your family, and otherwise best use your remaining time until landfall? (I’d take the latter, for what it’s worth.)
Now apply the same logic to outbreaks and epidemics: would you rather have a Scientist advising you, or a Risk Manager?
The Scientist can tell you whether a pathogen is airborne and how fast it's spreading. The Risk Manager can tell you what to do about it either way. Again, which would you rather know? Which body of knowledge would be more valuable to you. Which skillset would you rather develop in yourself?
And which of these two guys would you want leading your national response to a highly-contagious outbreak? (Because we went with the Scientists during Covid and that did not work out for the best.)
This is why wars are fought by generals (generalists) not scientists (specialists). The scientists can provide information which improves the decision-making process, but ultimately it is the generals who make the decisions. Even when the scientists invent decisive military technology, it is still the army generals who decide if and when and where it will be deployed.
Science can inform, but it cannot decide.
At the end of the day, Science and Risk Management are different toolboxes for different kinds of problems, and it should be no more controversial than that. Both are necessary, both can lead us to important truths, but they serve completely different purposes and should only be used where they are appropriate.
One of the key takeaways for policy-makers is that they need to understand the nature of the problem they are trying to solve before they decide which toolbox to use.
Blindly applying the Scientific method in all environments is perhaps preferable to pure guesswork, but making statements when you should be making decisions is no better than hammering a screw or eating soup with a fork: you won’t get the results you want and you are likely to make a mess.
We need Risk Management because there are unavoidable questions in life which Science cannot answer, or even adequately address: What do you do when there isn’t enough data to tell you what to do for sure? What do you do when there is no prescribed formula or well-trodden path? What do you do when the environment is constantly changing and you have important decisions to make? What do you do when all of the above are true, and there are thousands of lives on the line?
The ultimate question: What do you do, when you don’t know what to do?
(Answer: You keep yourself alive – you manage your risks!)
We need to let go of our misplaced faith in the omnipotence and infallibility of ‘The Science’, and recognise instead the essential and irreplaceable value of Risk Management – especially crisis management.
Successful outbreak control calls for goal-setting, planning, preparation, resource management, and tactical decision-making in the moment (Risk Management), not precise statement-making at a lag (Science). We cannot end the threat of pandemics until the people in positions of power and influence understand this distinction.
As things stand, those people are generally medics, academics, and scientists. They don't want to admit it but their skillsets are unsuited to the problem: medics are trained in cure, not prevention; academics are concerned with theory, not practice; and scientists make statements, not decisions. They can all make valuable contributions, but they cannot lead - we need Risk Managers for that. (You can read more about Risk Managers here.)
The principles of Risk Management should guide our decision-making before (planning and preparation), during (tactical decision-making), and after (‘black box’ / post-mortem analysis) all crises. If and when that happens, humanity will be one major step closer to making pandemics a thing of the past.
