Perhaps nothing in business circles today generates more heated debate than risk and risk management—not only in financial institutions, but also in every industry, and from the lowest manager level to the boardroom.

We all know something went disastrously wrong in how risk has been managed, to the painful realization of directors, senior executives, and other employees, shareholders, bondholders, and now taxpayers. The debates rage from one end of the land to the other about what went wrong—and they often involve amazing complexity, dealing in sophisticated quantitative models, forecasts, and the like. And otherwise knowledgeable people talk at cross-purposes, using the term “risk” to mean very different things.

I’ve written extensively in this space about risk and risk management, including what went wrong with the financial system meltdown. And justified or not, I’d like to believe I’ve been making these inherent complexities easy to understand. But some months ago I came across the writings of Peter Bernstein, editor of an economics and portfolio strategy newsletter, who brought forth an insightful perspective and simplicity to the topic of risk.

The Four-Letter Word “Risk”

Given all the mismanagement we’ve seen, Bernstein understandably refers to risk as a “four letter word,” and draws from Elroy Dimson of the London Business School in defining risk (in the context of forecasts) to mean more things can happen than will happen.

Bernstein explains that we don’t know what will happen, although we can devise probabilities of possible outcomes. But importantly, we will never know in advance the true range of outcomes we may face. In life, questions are posed: How will we deal with outcomes different from what we expect? What are the consequences of being wrong in our expectations? Risk means the chance of being wrong, of seeing outcomes different from what we expected. And key to that are the consequences of being wrong.

I would add that almost anything forecasted in a business context is going to be wrong. We don’t know how much the forecast will be wrong, or in which direction. What’s critical to risk management, then, is recognizing the consequences of being wrong by a little or a lot, and making decisions to reduce those consequences to an acceptable level. The term “consequences” is analogous to “impact,” the commonly used word when talking about the likelihood of an adverse event or circumstance and its related impact on a business.

Making a Bet on God

For those of us who may still have difficulty grasping Bernstein’s notion of risk management, we can look at another analogy he provides, drawn from an example put forth by a 17th century French mathematician. The illustration centers on the idea of betting on whether or not God exists.

It goes like this. If we presume God does exist and we lead a good life, we might find in the end that we were wrong. In that case we may have sacrificed a little along the way, perhaps foregoing some so-called “fun.” We also probably gained comfort from our belief, and felt good about and gained respect for our behavior. On the other hand, if we presume God does not exist and lead a life of lust and sin, then we discover in the end that God indeed does exist—we learn too late that the downside could be huge.

In other words, betting that the consequence is there, and planning accordingly, is far wiser than betting that the consequence isn’t there and plunging ahead recklessly.

Perhaps among the most relevant lessons to be learned from the horrible failures is that risk management is not rocket science, and those who make it more complicated than it is are asking for trouble.

The simplicity here contrasts with value-at-risk models and their “fat tails” or “black swans,” which refer to what might happen in a relatively small percent of the time, based on past data fed into a model. Bernstein again brings the concept back to readily understood terms such as encountering rain after leaving home without an umbrella, where the consequences are minimal. On the other hand, betting the ranch on home prices only going up has huge consequences, as we have (sadly) seen in our financial system and economic plight.

When one ignores the black swans as being unrealistic (especially when depending only on recent years’ data), or believes that forces are only moving in one direction (housing prices only going up), we court disaster. Risk management must recognize and consider the range of possibilities and consequences. As such, Bernstein says, we need to concentrate “either on limiting the size of the bet, or on finding ways to hedge the bet so you are not wiped out if you take the wrong side—if home prices do start to go down, or even stop rising.”

Ignore Risk at Your Peril

A fundamental reality is that things with seemingly little chance of occurring do in fact happen. And they happen more often than we expect them to. How many times in the last few decades have we seen a 100-year storm? (Either the weather kind or business kind!) It seems to me that an event occurring several times in a few decades is more than once in 100 years. When we consider the savings-and-loan fiasco, the junk bond debacle, the dot-com bubble, several economic recessions, and now today’s financial system meltdown and credit markets seizure, we know this so-called “perfect storm” happens with relative frequency.

We’re also talking here about bringing old-fashioned common sense to the table. A producer of a public radio show tells how he asked an experienced business reporter: “Why are they lending money to people who can’t afford to pay it back?” The reporter patiently explained about collateralized debt obligations, yield and risk curves, and increasing amounts of international capital in need of a home. But the producer still “couldn’t understand how they could expect to be paid off when everyone I know was maxed out on their credit cards.”

The producer then found a man whose house was in foreclosure, did not have a full-time job or any assets to speak of—and yet had received a loan of $450,000. The producer asked this man whether he would have loaned a guy like himself the money. His response is telling: “I wouldn’t have loaned me the money. And nobody I know would have loaned me the money. I know guys who are criminals who wouldn’t loan me that, and they break kneecaps.”

Hindsight Is Great

We know the technical reasons behind the great financial system meltdown, as I’ve written over the last year or more in this space. And yes, hindsight is 20-20. But as also noted in my columns, a number of smart people saw that the wheels would come off, but the powers-that-be wouldn’t slow down the speeding train.

Perhaps among the most relevant lessons to be learned from the horrible failures is that risk management is not rocket science, and those who make it more complicated than it is are asking for trouble. And just because something is unlikely to happen doesn’t mean it can’t happen.

Yes, business must place bets and take chances to succeed. But the consequences of those bets need to be understood, and risks need to be managed. If you’re betting the ranch, then all parties—directors and shareholders included—should know that’s what’s happening. And when a company’s bets are to be in line with a more normal, agreed-upon risk appetite, then there needs to be sufficient oversight to be sure risk is appropriately managed to stay within that appetite. That includes oversight at the board of director as well as senior management levels, and government regulators included.