In his book Decision Making: Risk Management, Systems Thinking, and Situation Awareness (Argos Press, 2003), Alan McLucas introduces the concept of the risk management paradox. “If risks are being effectively managed as a matter of routine, there will be very few surprises,” he writes. “Nobody becomes aware of just how effective careful risk-management actions have proven to be.... In stark contrast, however, if risks are managed poorly, the whole world lines up to say so.”

This paradox provides two critical insights. The first, and most obvious, is that being a risk manager in an organization is a thankless task—one that rarely draws praise, yet is the first to be put under scrutiny when outcomes are not as planned. The second insight is that organizations are not adept at measuring the outcomes of risk management and the value it adds to the organization.

 …