The firewall -- has the "magic" box lost its mojo?
May 3, 2016
Ebola and Risk Management
September 14, 2014
When the issue of repatriating American missionaries infected with Ebola came up, I began thinking about it from the perspective of a risk manager, which is how I think about most things. Let me say up front that this blog entry is intended in no way to be a political statement. I am happy we were able to get our people back and help them. My intent is to help the reader understand the concept of risk management using a current event.
When we risk managers evaluate a risk, we look at two variables: the probability of a risk occurring; and the cost in monetary and other terms if the risk occurs. A risk with a low probability of occurrence and a low cost is not one we spend a great deal of time worrying about. On the other hand, a high probability risk with a high cost is one we start fixing immediately.
Applying this approach to an Ebola outbreak in the US as a result of repatriates, we probably have a low risk of occurrence. I say probably, because while we are told Ebola is transmitted only by exchange of bodily fluids, a number of doctors have been infected. With a non-airborne pathogen, a face shield, gown, and gloves should be sufficient to mitigate the risk of spread, except for the poor person who has to deal with the bed pans. The doctors claim to have followed WHO precautions, which are much more stringent, and yet they got infected. Despite this lingering question, let’s assume for the sake of argument that the risk is really low. The cost of an outbreak would be extraordinarily high cost, both in lives and money.
Now, if this were a low business risk with an extraordinarily high cost, a risk manager would recommend that it be mitigated aggressively, because while it is not likely, the cost if it does would threaten business survival.
Using this logic, if I were asked to make the decision using basic risk management analysis techniques, the infected folks would not have been returned to the US.
We can derive two risk management axioms from the above: 1) Risk is not always easy to calculate, so it is always better to err on the safe side; 2) Always remember, Murphy lives!
Now, think about seemingly low risks to your organization in the above terms, and see if you have any work to do.