Conversations with Mark Siwik

These conversations are a three-part interview series about the evolution of modern uncertainty practice, its standards history, and its limits in real decisions.

Three conversations on decision-making

These three interviews with Mark Siwik of SandRun Risk trace a line from my first encounter with uncertainty, through the ISO working groups that codified 'risk management' into a global standard, to the practical question every organisation should be asking instead: how do we help our Deciders make better decisions?

The Universal Decision-Making Method is the method every Decider already uses, whether they apply it deliberately or stumble through it unconsciously. These conversations cover why Roger Estall and I came to that conclusion, why we abandoned the 'risk management' construct entirely, and what we advocate in its place.

From Flixborough to ISO 31000

Part 1 traces my career from the insurance industry in England, through BHP Billiton and Aon Pacific, to the ISO working groups that produced ISO 31000. The starting point was the Flixborough chemical explosion in 1974, which killed 28 people and destroyed nearby homes. I joined the UK Health and Safety Executive in the aftermath, and the work I did there, generating information about what could happen, its impact, and its likelihood, went directly to decision makers. Nobody called it 'risk management.' Nobody used the word 'risk.' The information helped people decide.

That changed when I joined the Australian and New Zealand standards committee in 1995. I served on that committee for fourteen years and chaired it for seven. The first edition of AS/NZS 4360 had something useful behind its alien language: a simple process that, imperfectly, pointed toward decision-making. But in 2005 we got drawn into the rabbit hole of ISO standards-making, and the result, ISO 31000, was the curate's egg: only good in parts. The simple step-by-step process survived. The mangled thinking on the 'framework' turned a decision-making aid into an administrative edifice, and maintaining that edifice became the point. ISO itself invented over forty formal definitions of 'risk' in different standards and recently abandoned an attempt to reconcile even some of them. When your core term requires that much explanation, the discipline is not a discipline.

Why we abandoned the frame entirely

Part 2 turns to Deciding and the method Roger and I built over three decades. Mark pressed on why we abandoned the 'risk management' frame entirely rather than reforming it. Roger had asked the question that crystallised the problem: “If risk management is the answer, what was the question?” He had tried to answer it from inside the ISO committee, proposing a first-principles design specification for the revision of ISO 31000 that started with the problem rather than the solution. The politics killed it. Roger left the committee and joined me as an ISO 'refugee.'

The answer is structural. The apparatus of COSO ERM, the IIA Three Lines Model, and their offspring were never designed to help a specific person make a specific decision. They were designed to demonstrate that uncertainty had been 'considered.' Consideration and decision-making are different activities. The advocates of various forms of 'risk management,' each represented by a three-letter acronym (GRC, ERM, RBT), promoted the view that their approach had inherent value, a fundamental truth. In our book, we liken these to systems of religious belief. The result is a parallel universe where the risk management edifice becomes self-justifying but irrelevant to the work of the organisation, sustained by a pernicious triangle of codification, certification, and consultancy sales.

Roger's career illustrated what genuine impact looks like. As chairman of the New Zealand Fire Service Commission, he drove reforms that achieved a 60% reduction in accidental deaths from fire within two years. He did this not by building a compliance apparatus but by changing the culture of fire services to a proactive approach built around public education. That is what happens when the focus is on actual outcomes rather than on demonstrating that a process has been followed.

What an organisation should actually do

Part 3 is the most practical. We discussed what Deciders need from the conversations that surround every decision: the right tone, a deliberate structure, and techniques that surface assumptions rather than paper over them. The tone determines whether participants contribute their genuine thinking or tell the Decider what they want to hear. The structure ensures the conversation proceeds logically and that the Decider, by organising the conversation, clarifies their own understanding of the question. Roger once told me about his first boss, who described the power of prayer this way: in order to pray, one first had to get one's thoughts in order so as not to seem stupid in conversation with God. The same discipline applies to every decision conversation.

We discussed who should be in the room: nay-sayers who challenge groupthink, futurists who can envisage changes in context over the life of a decision, and people with skin in the game who will implement whatever is decided. The Australian Royal Commission into the finance sector, which we reference in Deciding, revealed that directors of major financial institutions had deviated from their institution's Purpose when making important decisions, for the simple reason that there was no shared understanding of that Purpose. The resulting damage to careers, reputations, and financial performance proved the point Roger and I returned to throughout our work: the problem was never a shortage of apparatus. It was a shortage of awareness about what was being assumed.

Start with one decision. Apply the five steps of the method. State the Purpose. Surface the assumptions. Rate each by importance and confidence to determine significance. Build monitoring into the decision before it leaves the desk. No register. No heat map. No annual risk appetite statement. The thread running through all three conversations is a question Mark raised early: if 'risk management' has been so thoroughly institutionalised, why does it persist despite the evidence? I have written about this in Unburdened by Risk Management Myths: four groups sustain it, each with strong self-interest. Each has legitimate reasons to study uncertainty. None of them is trying to help a specific executive make a specific decision on a specific timeline.

---

Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.