This post first appeared on Risk Management Magazine. Read the original article.
Over the past several years, psychologists, behavioral scientists and academics have helped to advance our understanding of human psychology and, specifically, how humans respond to high-risk and crisis situations. This research has highlighted how a lack of pre-crisis training and preparation may exacerbate risk and cause unnecessary errors during times of stress and uncertainty.
The good news is that these experts can also help us better understand the best ways for businesses to help individuals prepare and train for such situations so they can contribute positively to the risk management and crisis mitigation process.
But while the need for crisis and business continuity planning is clearly recognized by a wide swath of businesses and many endorse and utilize such programs, the degree to which companies and their risk managers have embraced the findings of what some call “the psychology of risk” is sorely lacking.
Risky Thinking
The psychology of risk is the study and understanding of the mental processes underlying our responses to risky situations, the recognition of a risk’s impact, and the development of frameworks that can help individuals make sound judgments in the face of risk.
When it comes to the psychology of risk, “there is still a lot of room to go and businesses are only at the beginning in terms of understanding that there are coherent frameworks available that could help them improve the practice of risk management,” said Hersh Shefrin, the Mario L. Belotti professor of finance at Santa Clara University’s Leavey School of Business and the author of Behavioral Risk Management: Managing the Psychology that Drives Decisions and Influences Operational Risk.
According to Shefrin, psychology has likely played a larger role in crisis response than many people realize. “Every single risk management disaster in the last 15 years, including financial disasters, has had psychological issues at the root,” he said. “Whether it’s an earthquake, natural catastrophe or a financial disaster, it is often compounded by our psychological imperfections.”
These issues can result in bad decision-making, he added, citing as prime examples the errors in thinking that led to the explosion of BP’s Deepwater Horizon in the Gulf of Mexico, General Motors’ faulty ignition switch recalls in the United States, and the nuclear meltdown at Fukushima Daiichi in Japan. Events such as these, he said, should be a clear incentive for more companies to implement and regularly update risk and pre-crisis training, and to incorporate a heightened understanding of human psychology into such programs.
“Pre-crisis training that takes psychological factors into account makes a notable difference” in a company’s response to an unexpected or crisis event, said Timothy Sellnow, professor of strategic communications for risk management at the University of Central Florida, where his research focuses on pre-crisis planning. “When we are able to rehearse for risks, we develop the kinds of muscle memory to enact a positive response more quickly and efficiently. With proper training, we can also draw employees’ awareness to psychological pitfalls that can occur when under stress, helping to ensure that they avoid these pitfalls and faulty decisions that can exacerbate outcomes.”
Hardwired Responses
Recognizing the importance of psychology in risk training starts with understanding that humans are hardwired to avoid threats in their surroundings at all costs and that the traditional “fight or flight” response is one of the most primal instincts. In a crisis, the brain’s threat response occurs quickly—within milliseconds—and can cause strong physiological reactions, such as increased heart rates, but can also diminish cognitive ability and seriously impede the ability to make effective decisions.
“Risk is an inherently complex concept and is an invention of the human mind to help people deal with things that can be harmful and dangerous,” said Paul Slovic, professor of psychology at the University of Oregon and president of Decision Research, who has written extensively on how individuals perceive risk differently. “Once we start to characterize events in life with the word ‘risk’ and then try to quantify the level of risk, we are entering the domain of subjectivity and emotion.”
Risky situations and crisis events can produce a range of negative stress responses. One example of this is “cognitive lock-in,” the tendency to stick with one’s first decision, even in the face of new information that suggests a wiser or better course. Another response is what some experts call “task saturation,” wherein people lose sight of the big picture and only focus on small or less important problems. Risk can also cause individuals to succumb to “groupthink,” which allows them to be unduly influenced by the thinking of a group and make potentially irrational decisions based on consensus rather than objectivity.
Retraining the Brain
Research shows, however, that we also have the ability to train our brain to react to a crisis in less emotionally-charged and more organizationally-savvy ways. Ideally, this is what can be achieved by constructive and helpful corporate training that takes human psychology into account.
But how is this accomplished? Business continuity advisers say the last thing you want to do is develop a complicated 150-page crisis and business continuity plan that no one wants to read.
“Detailed procedures and lengthy PowerPoint plans do not work well,” said Sean Murphy, CEO and founder of the business continuity advisory firm Lootok. He favors a less-detailed plan coupled with real-world, interactive training, because he believes this gives employees and executives the ability to improvise their risk responses.
“Many companies rely on online training that is a ‘check-the-box’ kind of experience,” said Connie Stack, director of marketing at Digital Guardian, a provider of cybersecurity technology and online training. “That approach is a waste of time.”
Instead, a growing number of psychologists and business continuity advisers favor the use of games and crisis simulations—either offline or online—to help retrain the brain to have positive and constructive responses during a crisis.
“When we look at how we learn, it does not change significantly from childhood,” Murphy said. “The more play we can incorporate into training, along with storytelling and a friendly social environment, the better the learning process.” This allows for better memory retention, and group activities allow instructors to “layer-in” the training process in a more convivial way, he added.
Lootok, for example, employs 60 types of group crisis-related games—including attack-and-defend scenarios, rapid-fire “who’s in charge” scenarios and warehouse attack games—all of which encourage role-playing and competition among employees during theoretical risk scenarios, allowing trainers to gather useful data about the vulnerabilities and strengths of the company and its employees. “I can get more out of the dialogue that comes with gameplay than a week’s worth of sit-down surveys and interviews,” Murphy said.
Stack is also a great believer in online games as an effective risk training tool. This method can help employees learn to identify both good and risky online behavior, rewarding those who abide by a company’s cyber rules or punishing those who break them, she said. “We inject game strategy and game theory into the entire training process, which encourages people to do the right thing and, ultimately, remember what they have learned,” she explained. The game format can continue offline, with employees who have learned their lessons well receiving badges, public rewards and gift cards.
The same approach can also be applied to cyber training for C-suite and board-level executives. PwC, for example, has launched a digital gaming and training tool that introduces executives to the choices that must be made in the event of a cyberattack and the mindset and psychology of the hacker. Over the course of eight hours of online gameplay, executives gain a better understanding of the risks to their business, mistakes that can be made, and best strategies to employ during and after such an event.
Academics and psychologists see additional benefits to these pre-crisis training approaches. “If we simulate the risk situation and experience it in a game format, our initial reaction may not be the best reaction, and games can quickly bring that out,” Sellnow said. He likes game-based training expressly designed for group participation and interaction because “you will need to collaborate in a crisis, so you may as well start doing that during the training process.”
Sellnow pointed out that risk training in a gaming environment can help to overcome the “dread factor,” or the tendency of individuals to avoid thinking about risk because of the pain and fear that it can evoke. “With gaming and simulations, we can give people proper tools and training so they become inoculated and avoid slipping into a dread mindset,” he said. Instead, they are reminded that they are not helpless and they can then focus on more positive outcomes and scenarios.
Shefrin is also a proponent of game simulation as a form of pre-crisis training because it helps to prepare participants for the strong emotions they might experience during a crisis. With the heightened focus it can induce in players, the gaming format can help individuals retain important psychology lessons and learn how to more quickly identify and mitigate various biases in decision-making or psychological pitfalls that can occur during times of high stress.
These can include “availability bias,” the tendency to base judgment on information that is most readily available, rather than doing more research. Other biases include “excessive or unrealistic optimism,” which can lead individuals to overestimate the probability of a favorable outcome; “overconfidence,” which can result in the underestimation of risk; and “confirmation bias,” the tendency to look for information to confirm what one already believes while downplaying information that is contrary to, or inconsistent with, this belief.
“If you are going to do training well in a gaming or simulated format, you need to train people to recognize the susceptibility to these sorts of psychological phenomena and then build organizational cultures to help people mitigate these vulnerabilities,” Shefrin said.
Ultimately, such training will help businesses and their personnel better prepare for a crisis—both physically and mentally. Because, as Shefrin put it, “managing risk is all about managing psychology.”