In this piece I will introduce the field of Risk Management (capitalised to represent entire body of knowledge and field of practice), explain how it differs from Science in terms of motivations, methods, and outputs, and argue that an understanding of Risk Management in theory and in practice will be essential if we are to permanently solve the problem of pandemics.
(You can read more about Risk Management in theory here and Risk Management in practice here.)
Definitions
I’ll start by defining my terms:
Science is the process of testing hypotheses, in controlled environments, against large datasets, with all the time, tools, and technology needed to do so.
Risk Management is the practice of making decisions, in volatile or uncertain environments, with whatever data, tools, and resources you have available at the time.
Along every axis of these (admittedly brief and stylised) definitions, it should be clear that Science and Risk Management are categorically different things. They are different methods, practiced by different professionals, with different skillsets, in different environments. It stands to reason that one method would be more effective than the other, depending on the environment in which they were applied and the overall purpose of the enterprise.
We will return to the discussion of suitability of methods later in this piece. First, let's explore the contrasts between Risk Management and Science in more detail...
Risk Management vs Science
Goals
The goal of Science is to produce true statements about life, the universe and everything (or some small, specific part therein). What is an atom? What is an electron? Why does the electron orbit the nucleus? What is gravity? What is electromagnetism? How are they all related to each other?
The answers to these questions are precise statements that are universally and eternally true, and Science is the right tool for the job: Science was designed to produce fixed answers to fixed questions like these.
The goal of Risk Management is, ultimately, survival. A ‘risk’ is any event or future state of the world which could cost you time, money, health or any other resources were it to arise, and Risk Management is the method by which we minimise those potential costs. The key idea is that if you can manage the risks while they are still risks, then the threat may never materialise. At the very least, you will be prepared for it when it does.
Risk Management can be applied to any ‘thing’ (organisations, infrastructure, consumer products, strategic situations) but no matter the context, the goal is always the same: to make the decisions that will ensure the preservation of some valuable thing, be it your home, your savings, your workplace, your community, or your life.
Methods
Science is a slow, theoretic, and extremely specific process. It is a very thorough one too, often requiring all relevant variables and alternative hypotheses to be tested one by one until a firm conclusion can be reached – no matter how long that takes. Most Science takes place in a quiet office or a sterile laboratory where highly-credentialled nerds use precision instruments and advanced technology to analyse a finite number of variables. A structured environment is necessary so that all the effects can be identified, disentangled, and controlled, and the paths of causality revealed.
Risk Management is a practical, dynamic, and strategic skillset which involves goal-setting, planning, resource management, and tactical decision-making. Risk Management takes place wherever it is needed, by whoever happens to be present, and it can start or stop at a moment’s notice. While the methods of Risk Management can be applied anywhere, the typical environments would be a battlefield, a house fire, a football field, or the poker table. In these contexts, there are infinite options, limited information, and you’ve got your skin in the game i.e. if you make the wrong decisions, you are going to suffer.
Science is frequentist: it waits for the data to accumulate before reaching a conclusion. Risk Management is Bayesian: it starts with a position and updates as it goes with whatever data becomes available. Science wants to make that one, big, final statement on the matter, and is happy to wait as long as is necessary to do so. Risk Management is constantly adapting because the environment is dynamic and the ‘right’ answers are always changing too.
Motivations
Scientists are motivated by precision whereas Risk Managers are motivated by precaution. Scientists are focused on the centre of the distribution whereas Risk Managers are fanatical with the tails. Scientists are optimisers because they can afford to be. Risk Managers are satisficers because they can’t afford not to be: they are dealing with life and death decisions, and at a scale and complexity that Science still cannot handle. Near enough is often good enough in Risk Management, but never in Science.
Science defaults to ‘no action’ and needs overwhelming evidence to budge from this position. Risk Management defaults to protective action and does not relent until there is conclusive proof that the threat has passed. The Scientist needs to be convinced that the noise in the bushes is a dangerous animal, whereas the Risk Manager has already run away. (Humans have Risk Management in their DNA – we couldn’t have survived as a species without it!)
Science makes accurate statements based on what it does know, whereas Risk Management makes adequate decisions based on what it doesn’t know, and that is why Risk Management is essential in a crisis.
Making Statements vs Making Decisions
The fundamental difference between Science and Risk Management is that one method is dedicated to making statements whereas the other method is dedicated to making decisions. Making statements and making decisions are two very different things!
When we make a statement, we are committing to an intellectual position or a belief about the world. When we make a decision however, we are committing ourselves to a particular course of action. Making decisions is about doing, not stating or believing. Statements can be withdrawn or updated as new information becomes available, but actions, once taken, are final. So a wrong decision is far more dangerous than a wrong statement, especially when the playing field is volatile or uncertain and the stakes are high.
Many important decisions have to be made in situations where Science cannot function. A contagious outbreak, for example, is a complex environment with infinitely many variables and options, where even the first order effects are not well described. Science can’t process the number of paths nor model the complexity that these situations create. We need a better way to safely navigate these environments, and that’s where Risk Management comes in.
Risk Management is the study and practice of judgement under uncertainty. That is, making decisions and taking actions when the situation is dangerous or uncertain and you don’t have enough information to make the decision for you. In these environments, we don’t have the option of waiting for comprehensive data, but even if we did, the precise statements it could generate would be of little use to us. In situations like these, we need to make decisions which will guarantee our survival.
Think about it like this: Science can tell you what a hurricane is, whereas Risk Management can tell you what to do about it - BIG difference! And which would you rather know? Which body of knowledge would be more useful to you in your life?
Imagine there was a Cat 5 hurricane headed your way. Would you rather have a Scientist there to tell you the precise definition of a hurricane and reel off statistics about historical Cat 5’s? Or would you prefer a Risk Manager who could calmly advise you how to protect your home and your family, and otherwise best use your remaining time before landfall? (I’ll take the latter, for what it’s worth.)
Now apply the same logic to outbreaks and epidemics: Science can tell you whether a pathogen is contagious or not, but Risk Management can tell you what to do about it either way. Again, which would you rather know? Which skill would you rather develop in yourself and in your communities? Who would you want leading your national response to a highly-contagious outbreak – a Scientist or a Risk Manager? (I’ll take the latter again.)
Science can inform, but it cannot decide. That’s why wars are fought by generals (generalists) not scientists (specialists). The scientists can provide information which improves the decision-making process, but ultimately it is the generals who make the decisions. Even when the scientists invent decisive military technology, it is still the army generals who decide if and when and where it will be deployed.
Different Toolboxes for Different Problems
At the end of the day, Science and Risk Management are different toolboxes for different kinds of problems, and it should be no more controversial than that. Both are necessary, both can lead us to important truths, but they serve completely different purposes and should only be used where they are appropriate. One of the key takeaways for policy-makers is that they need to understand the nature of the problem they are trying to solve before they decide which toolbox to use.
Blindly applying the Scientific method in all environments is perhaps preferable to pure guesswork, but making statements when you should be making decisions is no better than hammering a screw or eating soup with a fork: you won’t get the results you want and you are likely to make a mess.
We need Risk Management because there are unavoidable questions in life which Science cannot answer, or even adequately address: What do you do when there isn’t enough data to tell you what to do for sure? What do you do when there is no prescribed formula or well-trodden path? What do you do when the environment is constantly changing and you have important decisions to make? What do you do when all of the above are true, and there are thousands of lives on the line?
The ultimate question: What do you do, when you don’t know what to do?
(Answer: You keep yourself alive – you manage your risks!)
Conclusion
We need to let go of our misplaced faith in the omnipotence or infallibility of ‘The Science’, and recognise instead the essential and irreplaceable value of Risk Management in all crisis management, but especially pandemic prevention.
Successful outbreak control calls for goal-setting, planning, preparation, resource management, and tactical decision-making in the moment (Risk Management) not precise statement-making at a lag (Science). We cannot end the threat of pandemics until the people in positions of power and influence understand this distinction.
As things stand, those people are generally medics, academics, and scientists. Although they may not want to admit it, their skillsets are unsuited to the problem of pandemic prevention: medics are trained in cure, not prevention; academics are concerned with theory, not practice; and scientists make statements, not decisions. They all have valuable contributions to make to pandemic prevention, but they cannot lead - we need Risk Managers for that. (You can read more about Risk Managers here.)
Science can inform, but it cannot decide, so when Science leads, it will fail. Instead, the principles of Risk Management should guide our decision-making before (planning and preparation), during (tactical decision-making), and after (‘black box’ / post-mortem analysis) all crises. If and when that happens, humanity will be one major step closer to making pandemics a thing of the past.