There Are No Solutions, Only Trade-Offs: The Real Value of Operational Risk Management

Operational Risk Management • RCSA • Risk Appetite • Governance • Decision-Making

“There are no solutions. There are only trade-offs.” — Thomas Sowell

Economist Thomas Sowell's famous observation captures one of the most important, yet frequently overlooked, principles of effective Operational Risk Management (ORM). Risk management is not about eliminating risk. It is about understanding the trade-offs involved in taking, reducing, transferring or accepting risk. Every decision involves uncertainty. Every control has costs. And actions designed to eliminate one exposure can create entirely new risks, sometimes with more serious consequences than those originally being addressed.

For financial institutions, this has profound implications for risk appetite, Risk and Control Self-Assessment (RCSA), control design, investment decisions and the value delivered by the ORM function.

A ship in harbour is safe — but that is not its purpose

Author John A. Shedd captured another essential principle:

“A ship in harbour is safe, but that is not what ships are built for.”

The observation is particularly relevant to ORM. Financial institutions do not exist simply to avoid losses, incidents or operational failures. They exist to deliver financial services, support economic activity, serve customers and create value. Achieving these objectives necessarily involves taking risk. A bank could avoid many operational risks by declining to introduce new products, adopt new technologies, expand into new markets or engage third-party providers. But such an approach would also undermine its ability to compete, innovate and fulfil its purpose.

Indeed, refusing to change can itself create significant risks as technology, customer expectations and competitive conditions evolve. The objective of ORM should not be to prevent the ship from leaving harbour. It should be to help ensure that the ship is seaworthy, the crew understands the risks, and the voyage is undertaken with appropriate safeguards. This is the essence of risk appetite: determining which risks an organisation is willing to take in pursuit of its objectives, and which risks must be limited or mitigated.

It also highlights the importance of proportionality. Excessive controls can constrain innovation, increase costs and prevent organisations from pursuing worthwhile opportunities. The most effective ORM functions therefore act as enablers of informed risk-taking, not simply as guardians against potential loss. Risk is not merely something to be minimised. It is something to be understood, managed and, where appropriate, deliberately taken.

Uncertainty is unavoidable — certainty is an illusion

Another observation, commonly attributed to Voltaire, captures the challenge facing every risk manager:

“Uncertainty is an uncomfortable position. But certainty is an absurd one.”

Organisations understandably seek certainty. Boards want assurance, management wants predictable outcomes, and risk functions are expected to provide confidence that risks are being effectively managed. Yet operational risk management operates in a world of incomplete information, changing circumstances and inherently uncertain outcomes. Risk assessments, control evaluations, scenario analyses and business cases all rely on assumptions and judgements. Even sophisticated quantitative models cannot eliminate uncertainty.

The danger arises when estimates and assumptions are treated as facts, or when the desire for certainty drives excessive controls and risk avoidance. Effective ORM should therefore help decision-makers understand the degree of uncertainty surrounding their choices, rather than create a false impression of precision. This means challenging assumptions, considering alternative scenarios, recognising the limitations of available evidence and remaining prepared to revise decisions as new information emerges.

It also reinforces the importance of back-testing. By comparing actual outcomes with earlier forecasts, organisations can identify where their understanding was incomplete or mistaken and improve subsequent decisions. Sowell reminds us that every decision involves trade-offs. The observation attributed to Voltaire reminds us that those trade-offs must be evaluated under uncertainty. Good risk management does not promise certainty. It enables informed decisions despite uncertainty.

The illusion of risk avoidance

The precautionary principle is often invoked to justify avoiding activities that might cause harm, particularly where the consequences are uncertain. Precaution can be entirely appropriate, especially where potential harm is severe or irreversible. However, a problem arises when decision-makers focus exclusively on the risks of taking action while neglecting the risks of not acting. The question should not simply be, What might go wrong if we proceed? It should also be, What might go wrong if we don't? Doing nothing is itself a decision, with its own risks and consequences.

An important technique that I advocate is the pre-mortem, which encourages decision-makers to anticipate potential failures before they occur, rather than waiting for an incident to expose weaknesses. This involves asking three fundamental questions: What could go wrong? How would we know if it were happening? And what could we do now to prevent it, reduce its likelihood or limit its consequences? The second question is particularly important because it encourages consideration of detective controls, early-warning indicators and the organisation's ability to recognise emerging problems before they escalate. The third extends the discussion beyond prevention to preparedness, response and recovery, recognising that not every failure can be avoided.

Embedding this approach into everyday decision-making, project planning, change management and risk assessments helps develop a genuine risk and resilience mindset and culture. Rather than treating risk management as a periodic assessment or compliance exercise, it encourages people throughout the organisation to anticipate what might go wrong, recognise emerging warning signs and consider how they would respond. Importantly, the same discipline should be applied to decisions not to act, since maintaining the status quo can create vulnerabilities and missed opportunities just as readily as introducing change.

Risk avoidance is rarely risk elimination. More often, it is a decision to exchange one set of risks for another.

Nuclear power: when avoiding one risk creates another

Physicist and quantum computing pioneer David Deutsch offered a striking example in a recent interview with Chris Williamson on Modern Wisdom. Deutsch argued that opposition to nuclear power, motivated partly by concerns about safety and environmental harm, contributed to slowing the development of a technology capable of generating substantial quantities of low-carbon electricity. In his view, the resulting greater dependence on fossil fuels produced environmental consequences that might have been substantially reduced had nuclear power been developed more extensively.

This is a counterfactual argument rather than an established historical conclusion. Nuclear development was influenced by multiple factors, including economics, construction costs, safety concerns, public attitudes and government policy. Nevertheless, the underlying lesson is powerful. A decision intended to reduce one risk can increase overall risk when its wider consequences are not adequately understood. Deutsch's wider philosophy emphasises that progress depends on creating knowledge, correcting errors and recognising the limits of our ability to predict the future.

This is particularly relevant to risk management: decisions made under uncertainty must remain open to challenge and revision as new evidence emerges.

COVID-19: difficult trade-offs under extreme uncertainty

The COVID-19 pandemic provides another powerful example. Governments faced exceptionally difficult decisions involving public health, healthcare capacity, economic activity, education and individual freedoms. Measures such as lockdowns, school closures and restrictions on economic activity were intended to reduce transmission, protect vulnerable populations and prevent healthcare systems from becoming overwhelmed. However, these interventions also created significant costs, including disrupted education, economic hardship, delayed healthcare and adverse effects on wellbeing.

The existence of these consequences does not establish that the interventions were necessarily wrong. Their effectiveness and proportionality depended on the circumstances, timing, available alternatives and evidence. Rather, the pandemic demonstrated that even measures intended to protect people can create substantial secondary risks. Effective risk management requires considering both the consequences of intervention and the consequences of inaction, particularly as new information emerges. The appropriate question is not whether a decision eliminates risk, but whether it produces a better overall outcome than the available alternatives.

What does this mean for Operational Risk Management?

The same principle applies directly to financial institutions. Consider a bank introducing increasingly restrictive controls to prevent fraud. Additional authentication, transaction limits and verification procedures may reduce fraud losses. However, excessive controls can also create customer friction, processing delays, operational complexity and financial exclusion. Similarly, an institution seeking to eliminate third-party risk by bringing activities in-house may inadvertently increase costs, reduce specialist capability and create new operational vulnerabilities.

Even decisions to avoid emerging technologies such as AI involve trade-offs. Not adopting AI may reduce certain model, data and third-party risks while increasing exposure to inefficiency, competitive disadvantage and outdated operating processes. The objective is not simply to minimise an individual risk in isolation. It is to understand whether the proposed response improves the organisation's overall risk position.

RCSA: When fewer controls can mean better risk management

One of the most practical applications of Sowell's principle is the Risk and Control Self-Assessment (RCSA). RCSA should not simply identify risks, assess control effectiveness and highlight gaps requiring remediation. It should also help management determine whether the existing control environment is proportionate, efficient and economically justified. Controls are not free. They consume resources, introduce processes and complexity, create friction and can themselves generate operational risks. As Andrew Sheen and I observed in Integrated Operational Risk Management (Wiley, 2025, p. 164):

“As the old saying goes, you can never have too much of a good thing. This may be true for guitars, cars and even handbags, but too much control can be inefficient, costly, and counterproductive.”

Consider an organisation with multiple layers of checking, approval and reconciliation. Each control may have been introduced for a legitimate reason, perhaps following an incident, audit finding or regulatory concern. Over time, however, the cumulative control environment may become unnecessarily expensive and complex. Some controls may duplicate others, address risks that have materially diminished, or deliver little additional protection. A mature RCSA should therefore challenge not only whether controls are effective, but whether they remain necessary and proportionate. This creates opportunities to:

• Remove redundant or duplicative controls.
• Simplify overly complex processes and approval arrangements.
• Replace expensive manual controls with more efficient automated controls.
• Reallocate resources towards more material risks and weaknesses.
• Consciously accept certain residual risks where further mitigation would be disproportionate.

Importantly, reducing controls does not necessarily mean weakening risk management. In some circumstances, a simpler, more targeted control environment can be more effective, more transparent and less vulnerable to operational failure. The key is to understand the trade-off between the cost of control, the reduction in risk achieved and the residual exposure retained. For material risks, this assessment must also consider regulatory requirements, customer impacts, severe but plausible outcomes and the organisation's risk appetite. A control cannot simply be removed because its cost exceeds recent historical losses.

The economics of control: are we spending money wisely?

A simple example illustrates the potential value of this approach. Imagine a financial institution operating a manual checking control costing £200,000 annually. The control addresses an operational risk with estimated annual losses of £100,000 before mitigation. If the control reduces expected losses to £20,000, the annual risk reduction is £80,000.

On these assumptions, the organisation is spending £200,000 to avoid £80,000 in expected annual losses. That does not automatically mean the control should be removed. It may prevent rare but catastrophic outcomes, fulfil regulatory obligations or protect customers from harms that are difficult to quantify. However, it should prompt a fundamental question: Could the organisation achieve an acceptable level of risk at a significantly lower cost? Perhaps a simpler control costing £40,000 could achieve most of the same risk reduction. Alternatively, some residual risk might reasonably be accepted within the organisation's risk appetite.

This is where ORM can create tangible commercial value through informed challenge and control optimisation.

From prediction to evidence: the importance of back-testing decisions

Understanding trade-offs requires more than identifying potential risks and benefits. It also demands discipline in estimating their likelihood, costs and consequences — and subsequently testing whether those estimates proved accurate. Consider a major transformation project, new technology implementation or control enhancement. The business case will typically include projected financial benefits, implementation costs, efficiency improvements and anticipated risk reductions. These forecasts help justify the investment and secure management approval. But how often does the organisation return to those assumptions after implementation?

Were the projected benefits actually realised? Did implementation and ongoing operating costs exceed expectations? Were the anticipated risk reductions achieved? Did the initiative introduce new operational risks, complexity or unintended consequences? Too often, attention moves to the next project once implementation is declared complete, without sufficient examination of whether the original decision delivered the expected outcomes. A project delivered on time and within budget is not necessarily a successful project if its promised benefits and risk reductions never materialise.

Closing the loop: forecast, decide, measure and learn

Effective ORM should help establish a disciplined cycle:

1. Forecast: Document expected benefits, costs, risk reductions, residual exposures and key assumptions before making the decision.
2. Decide: Evaluate alternative courses of action, including the option of doing nothing, and explicitly recognise the trade-offs.
3. Measure: Establish indicators and evidence to determine whether the expected outcomes are being achieved.
4. Back-test: Compare actual outcomes against the original forecasts, including costs, benefits, incidents, control effectiveness and unintended consequences.
5. Learn and adjust: Identify forecasting errors, challenge assumptions and use the findings to improve future decisions, controls and investment proposals.

This approach should be embedded in project governance, benefits realisation, RCSA, control optimisation and risk appetite monitoring. Importantly, back-testing should distinguish between poor decision-making and outcomes that differed from reasonable expectations because of unforeseen developments. A good decision can produce a disappointing outcome, just as a poor decision can occasionally produce a favourable one. The objective is not to judge decisions solely with hindsight, but to improve the organisation's ability to assess uncertainty and make better decisions over time.

A further source of value for ORM

This creates another opportunity for the ORM function to demonstrate tangible value. Rather than simply challenging risks before projects commence, ORM can help ensure that management's assumptions are explicit, measurable and subsequently tested. Where forecasts repeatedly prove inaccurate, the lessons should inform future business cases, risk assessments and control decisions. Without systematic look-back and back-testing, organisations risk repeating the same forecasting errors, overestimating benefits, underestimating costs and maintaining controls whose value has never been demonstrated.

A mature ORM function should therefore help organisations learn not only from incidents and failures, but also from the accuracy of their everyday business decisions.

Nuclear energy: the costs of not acting

The history of nuclear energy offers a striking illustration of Sowell's trade-offs and David Deutsch's argument that progress depends on developing knowledge and solving problems. Decisions to restrict, defer or abandon nuclear power have often emphasised legitimate concerns about safety, radioactive waste, construction costs and long-term liabilities. But rejecting nuclear power did not remove risk: it also involved choices with consequences.

Depending on the country and its available alternatives, those consequences could include prolonged reliance on fossil fuels, greater exposure to imported energy and geopolitical shocks, additional carbon emissions, and lost opportunities to develop engineering capability and advanced reactor technologies. These outcomes should not be assumed in every case: renewable energy, storage, efficiency and grid investment may offer different and sometimes more attractive trade-offs. Nuclear projects themselves can also suffer major delays and cost overruns. The essential point is that non-adoption is not a risk-free baseline.

Deutsch adds a further dimension. We should evaluate decisions using the evidence and constraints available today, while recognising that innovation may change what is technologically and economically possible tomorrow. Excessive caution can sometimes inhibit the development of solutions that would reduce the very risks policymakers are seeking to manage.

For operational and strategic risk management, the lesson is to assess the risks of action, inaction and credible alternatives, including opportunity costs, unintended consequences and how the balance may evolve. One of the greatest failures of risk management is to scrutinise the risks of action while treating the risks of inaction as though they do not exist.

This question is especially relevant to AI infrastructure and electricity demand, explored further in our Insight on AI's hidden dependencies, power, politics and infrastructure and our analysis of electricity as a constraint on AI.

The commercial value of ORM

This illustrates an important source of value that ORM functions do not always communicate effectively. A strong ORM function should help the business both reduce unacceptable risk and eliminate unnecessary control costs. Its contribution should therefore be measured not only through incidents prevented, control deficiencies identified and remediation completed, but also through improvements in operational efficiency and the quality of risk-informed decisions. The first line owns the risks and the decisions concerning controls and residual exposure.

The second line provides independent oversight and challenge, helping management assess whether proposed changes remain within risk appetite and meet applicable regulatory requirements. Importantly, risk functions should not measure their effectiveness by the number of controls introduced, the volume of remediation actions raised or the size of the risk register. More controls do not necessarily mean better risk management. The ultimate objective is to optimise the control environment — achieving appropriate risk mitigation at a proportionate cost.

Six questions every risk manager should ask

1. What risk are we seeking to reduce, and by how much? Consider both expected losses and severe but plausible outcomes.
2. What does the proposed control cost? Include implementation, operation, complexity, customer friction and risks introduced by the control itself.
3. What are the consequences of doing nothing? Recognise that inaction also involves risk and opportunity costs.
4. Could an alternative approach deliver a better outcome? Consider simplifying, automating, replacing or removing controls, as well as introducing new ones.
5. How will we monitor and revisit the decision? Risk exposures, technologies, business processes and control effectiveness change over time.
6. How accurate were our original assumptions? Have we compared actual benefits, costs and risk outcomes with the forecasts used to justify the decision, and incorporated the lessons into future assessments?

These questions should be central to RCSA, risk appetite discussions, control design, project governance, change management and board decision-making.

Final reflections

Operational Risk Management should enable better decisions, not simply advocate more controls, lower risk appetite or greater caution. The real value of ORM lies in helping organisations understand the consequences of alternative decisions and make conscious, informed choices about the risks they take and the controls they maintain. This includes recognising that avoiding one risk may create another, that doing nothing is not risk-free, and that some controls cost more than the value they deliver.

It also means challenging the quality of forecasts, testing whether promised benefits and risk reductions have materialised, and learning when decisions produce unexpected outcomes. A mature ORM framework should therefore identify not only where controls need strengthening, but also where they can be simplified, improved or safely removed. The four perspectives explored in this article offer a useful foundation:

• Shedd reminds us of purpose: organisations must take risks to achieve their objectives.
• Sowell reminds us of trade-offs: every decision involves competing risks, costs and benefits.
• The observation attributed to Voltaire reminds us of uncertainty: decisions must be made without complete knowledge.
• Deutsch reminds us of learning: progress depends on creating knowledge, challenging assumptions and correcting errors.

Together, they capture the essence of effective risk management. The purpose of ORM is not to create the illusion of a risk-free organisation. It is to enable organisations to take appropriate risks, understand the trade-offs, manage uncertainty and learn from their decisions. And sometimes, the greatest value an ORM function can deliver is demonstrating that less control can mean better risk management. Good risk management is not just about making better predictions. It is about systematically learning when those predictions turn out to be wrong.

References and further reading

• Jimi Hinchliffe and Andrew Sheen, Integrated Operational Risk Management: Tools, Techniques and Meeting Regulatory Expectations (Wiley, 2025), p. 164.
• Thomas Sowell, The Vision of the Anointed: Self-Congratulation as a Basis for Social Policy (1995).
• John A. Shedd, Salt from My Attic (1928).
• “Uncertainty is an uncomfortable position. But certainty is an absurd one.” Commonly attributed to Voltaire; original source unverified.
• David Deutsch, Modern Wisdom, Episode 1164, interview with Chris Williamson — discussion of nuclear power and unintended consequences at approximately 35 minutes. Interview transcript.
• World Bank, The COVID-19 Pandemic: Shocks to Education and Policy Responses (2020).
• JADEtc Academy, Could Electricity Become AI's Biggest Constraint? Elon Musk's G20 Warning.