Is fear of risk your biggest risk?

A new acronym has entered the Oxford English Dictionary: VUCA. It is used to describe situations or environments that induce high levels of volatility, uncertainty, complexity and ambiguity. With the onset of Brexit’s staggering complexities and a constantly-evolving European regulatory environment, the pharmaceutical industry has entered into a particularly VUCA realm, where players who are risk smart rather than risk averse will prosper. Limited resources and increased competition can lead organisations toward a risk averse culture.

Faced with challenges like stripping out cost without compromising compliance, a culture of risk aversion can create an unworkable, and eventually unsustainable, level of complexity; risk aversion starts to actually create greater risk. While once considered a desirable strategy to protect a business, risk aversion can also be bad for business in many ways:

• Chasing a “zero risk” game smothers creative and critical thinking, often when it is most needed
• Risk aversion creates the dangerous illusion of certainty when there is none
• Risk aversion adds complexity, when simplification may be vital and essential

The urge toward safety is correct, but if left unchecked can lead to disaster. Forward-thinking companies may want to change their risk assessment paradigm to become less risk averse and more risk smart. That may provoke tough choices in terms of moving away from reactive risk assessments to proactive risk management.

Like this story? Subscribe to Cleanroom Technology magazine for incisive analysis of the latest news and developments in hi-tech industries manufacturing in controlled environments.

Decision making based on risks

Let’s begin with an exercise in risk-based decision making. Imagine I’m standing in front of you with £50. You can take it now (a low risk, but a sure bet) or double your money at the toss of a coin (but stand the risk of losing it all.) Heads, you win £100, tails you leave empty-handed. What would you do? What is your risk threshold? Most would probably take the £50. After all, losses loom larger than gains and most people are risk averse.

However, you are not the only player in this game. Your fiercest competitors are playing right alongside you, and the first to make the right choice takes the prize. In a volatile and uncertain business, playing safe and maintaining the status quo may be the riskier option.

Here is a simple yes/no quiz to help determine your organisation’s risk tolerance:

• Does your company take a zero-risk approach to most things?
• Is risk defined as the consequence of severity of harm, probability of occurrence and likelihood of detection?
• When taking steps to reduce risk, do you habitually amplify risk through complexity, by adding more checks, more double signatures, more detailed instructions, more discussions and more measures?
• When faced with risks, are you guilty of overthinking/“paralysis by analysis?”
• Is “failure mode effect analysis” your main risk assessment tool?
• Do you typically err on the safe side when things go wrong?

If you have more “yes” than “no” answers, you may be mired in a risk averse culture.

While risk aversion is both natural and attractive, it comes with a price. “Playing it safe” habitually can stunt creativity and critical thinking skills essential to competing for an uncertain world.

Risk aversion adds complexity and confusion at a time when simplicity and clarity are vital, slowing innovation and improvements when we need them most. Being risk smart rather than risk averse acknowledges uncertainty rather than ignoring it.

Five steps to becoming risk smart

1. top defining risk in terms of severity of harm and probability of occurrence; it implies risk is painful, dangerous and to be avoided. Risk smart companies succeed because their leaders are not bound by institutional risk aversion and understand the natural existence of risk at every level.
2. Ban the term “zero risk” and replace it with “risk smart.” Zero risk is a dangerous illusion. It doesn’t exist. Remember the role intelligent risk management has played in every human advance. Being risk smart doesn’t mean gambling with patient safety. It is just a trigger to remind us that risk is everywhere; in every decision we make and in every problem we solve.
3. Recognise that risk-based decision making is a skill that can be taught, practised and perfected. Remember that risk management and making risk-smart decisions is about managing uncertainty. Rather than focus on the uncertainty itself, focus on the decisions you make to drive uncertainty out of the process.
4. Create a culture that allows you to fail fast. An open-loop culture uses problems, errors and mistakes to drive continuous improvement. When the opposite happens and problems and errors are considered bad news, a risk averse and potentially toxic and blame-driven culture follows.
5. Educate, educate, educate. To become risk smart, understanding the science of risk-based decision making and (importantly) probabilities is essential. When faced with assessing risk, numbers can help navigate the wash of sentiment that often leads to a risk-averse decision. Numbers, in the form of probability, offer a platform from which to make informed, risk smart-decisions. Acquiring some level of statistical literacy is a vital component to risk-smart decisions.

Changing behaviours to manage risk and costs

Let’s consider the following real-world study to highlight five steps companies can employ to better manage risk, either on their own or by engaging experts.

Problem: a company found high levels of microbial contamination on the gloved hands of fully trained operators working in the Grade A (Class 100) and Grade B areas. Batches had been rejected. The company’s investigation identified inconsistencies in hand sanitisation. Retraining efforts failed and problems continued at a cost of over £1.2 million in lost time and unsaleable batches.

Combining a compliance mindset with an understanding of risk helps companies
understand where risk enters their processes

Risk-smart solution: The company needed to pinpoint where risk entered their processes, identify tested and trusted solutions to drive down that risk at every level, and train, motivate and engage operators in quality and safety-centred solutions.

1. Identify the specific behaviour to be changed. A risk-smart mindset understands that risk exists as a natural component in every level of the organisation, and rather than focusing on risk aversion, it uses critical thinking to create strategies to drive down risk everywhere it is found. In this example, the desired behavioural change was improving hand sanitation.
2. Identify the causes of the existing behaviour. Here is where being risk smart, rather than risk averse, continues to come into play. Combining a compliance mindset with an understanding of risk, rather than abject aversion to it, helps companies understand where risk enters their processes and allows focussing on driving it down, rather than simply working around it.
In this case, the existing culture of risk aversion had led to an extremely complex standard operating procedure (SOP) that, combined with poor sanitiser bottle design and inconsistencies in bottle location, created a cognitive overload for the operators. The company was performing self-sabotage through risk aversion.
3. Motivate people to change. Provide the “What’s in it for me?” or the bigger-picture impact of why following the new practices is important. In our example, the company brought in experts to assess the micro lab, in part to demonstrate to the operators the company’s commitment to helping them support the safety of their product for the end user. They looked at (and smelled!) real bacteria.
Getting an outside perspective helped link the consequence of contamination to patient risk for the operators and served as a conduit for front-line improvements from lab to leadership.
4. Make it easy to change. People are far more likely to change behaviour when the newly-desired behaviour is easier than the old habit. Often, cutting out unnecessary complexity also decreases risk and improves efficiency. In this case, the company used experts to put their SOP through a “brutal simplification” process, which reduced the SOP from eight pages to just six bullet points. The result: Operators were no longer daunted by the SOP and followed it more precisely.
5. Create a new habit. Old habits die hard, but they die much more quickly when replaced by stronger ones, especially if the new skills or habits are taught, practised and perfected. This company built into the new hand sanitisation SOP the components of the habit loop (trigger-routine-reward), and then guided the operators through expert trainer-led, precise practice sessions until they sanitised their hands correctly and automatically.

Reward and benefits: After 12 months, no further batches have been rejected. Operators feel engaged in risk management alongside leadership and are encouraged to think creatively about product quality and safety. The company is also now using the same five-step process to change other GMP and workplace behaviours.

The crux is this: The urge toward safety in the pharmaceutical industry is right and good; after all, mistakes can cost lives. But it is possible for the pendulum of risk management to swing too far toward caution, crippling companies with complexity and inefficiency.

Creating a culture that is confidently risk smart, rather than risk averse, may be the factor that establishes industry leaders for years to come.

N.B. This article is featured in the December 2018 issue of Cleanroom Technology. The digital edition is available online.