Risk mitigation is imperfect by definition. Mitigate doesn’t mean eliminate. It means reduce the impact. “Make less severe or painful,” according to Merriam-Webster.
The main reason why risk mitigation is imperfect is that, even when we see risk coming, we don’t know exactly how it’ll manifest. The shape of things to come is extraordinarily fuzzy. Even when the sky is falling, the shadows on the ground tend to keep changing position.
So, how can we best mitigate risk if we can’t freeze-frame the future?
Some general principles are relevant for both people and organizations:
Shore up overall resilience: In essence, the more fit you are, the better off you’ll be whether disaster hits or not. Building resilience is almost always a good call—unless you get obsessive about it to the point of negative ROI.1
Strengthen connections: People and companies don’t exist in isolation. Part of resilience is nurturing a strong web of connections: family, friends, allies. Those who will cheer for us when we succeed, catch us when we stumble, care about us through it all. Isolation is weakness, as any gazelle would tell you (if it could talk!). Even acquaintances can strengthen each other’s overall resilience. A neighbor who knows you may be more likely to knock on your door if the building’s on fire.
Periodically assess the horizon: Look at the promising versus ominous forces at play in the current environment. Assess their relative strengths to the best of your ability, and try to figure out which ones are likely to dominate in the near- and mid-term future. It’s impossible to perform this exercise perfectly, but it’s an instinct you can hone, just like you can train physical muscles.
Be prepared to change direction, but don’t act too soon: If you can increase readiness to move in any of several directions on relatively short notice, you can mitigate the imperfection of risk mitigation! Increasing preparedness may mean learning new skills, setting up informational interviews, researching potential destinations for a move, or starting a low-stakes side business that you can build up or abandon based on initial results.
Perfection is fiction
In the end, though, the fact remains: no plan is foolproof. As a comedic illustration of this point, I had several boxes of supplies shipped to my parents’ and aunt’s houses in January and February 2020, prior to Covid’s explosion in the US. (Yes, they thought I was bonkers.) Some of these items turned out to be useful; others, not so much. What I didn’t see coming was the toilet paper apocalypse: I bought zero rolls.
You do the best you can, and then roll with the punches.
Yes, there is such a thing as too many controls, too strict a fitness regimen, and so on. It’s understandable to avoid eating out if you’re risking your life by eating restaurant food—but if you’re just trying to maximize your physique, maybe try being 98% compliant instead of 100%.
One of the strategies in biosecurity* that was not obvious to me when I was outside was using broad approaches which managed a lot of different risks. Rather than focusing on specific pests, we would look at approaches which could manage many, like ensuring sea containers coming into New Zealand were stored in conditions which reduced levels of contamination.
*biosecurity in the New Zealand sense, which is protecting plant, animal and human health from new pests and diseases
The calculation of risk and mitigation, a perennial discussion in industrial organisations around the globe. The discussions over "why didn't you see this coming" or "how did you not identify this risk as being more significant than you did" happens in both design and production / service arenas.
You make some very pertinent points about aiming for perfection and the reasoning behind sensible resilience, especially in the context ROI, or its cumbersome cousin Loss of Revenue.