key: cord-294916-xc9ozxyn
authors: Oehmen, Josef; Locatelli, Giorgio; Wied, Morten; Willumsen, Pelle
title: Risk, uncertainty, ignorance and myopia: Their managerial implications for B2B firms
date: 2020-07-31
journal: Industrial Marketing Management
DOI: 10.1016/j.indmarman.2020.05.018
sha: 
doc_id: 294916
cord_uid: xc9ozxyn

Abstract Rare events are common: Even though any particular type of ‘rare event’ - a world war, global economic collapse, or pandemic for that matter - should only occur once every 100 years, there are enough of those types of ‘rare events’ that overall, they commonly occur about once every 10 years. As we are currently experiencing with the COVID-19 pandemic, we do not sufficiently leverage the rich toolset that risk management offers to prepare for and mitigate the resulting uncertainty. This article highlights four aspects of risk management, and their practical and theorical implications. They are: 1) Risk (in the narrower sense), where possible future outcomes can be captured through probability distributions. 2) A situation of uncertainty, where there is transparency regarding what is not known, but probability distributions are unknown, as well as causal relationships influencing the outcome in question. 3) A situation of ignorance, where there is no understanding that certain possible future developments are even relevant. And finally: 4) The emergence of organizational and inter-organizational myopia as an effect of risk, uncertainty and ignorance on collective human behaviour.

The outbreak of the current COVID-19 pandemic was not a practically unforeseeable 'Black Swan Event', as regularly claimed by media and online pundits (Bloomberg TV, 2020) . Not only is a general pandemic preparedness (typically for a much more severe pandemic influenza) part of standard government's emergency planning, but it has been communicated as a practical near-future certainty in expert forums and the general public alike (Gates, 2015) . Even a scenario worryingly close to what is currently unfolding (though with much higher mortality rates) was role-played by an international team of health experts in the fall of 2019 at the Center for Health Security at Johns Hopkins University. Their resulting recommendations (Center for Health Security, 2019) mirror precisely the shortcomings we are experiencing today. Sadly, their findings and those of earlier similar exercises collected dust in various drawers around the world.

Taking a step back, disruptive global events are not as rare as they may seem. The world is exposed to a significant amount of "1 in a 100 year" events, so that they occur with some regularity. They include for example : World War I (1914 ), Spanish Flu (1918 , The Great Depression (1929 ), World War II (1939 , The Cuban Missile Crisis (1962) , OPEC Oil Embargo (1973) , US-on-Soviet Union nuclear attack false alarm (1983) , Collapse of the Soviet Union and the Iron Curtain Several events, such as the Cuban Missile Crisis of 1962, the false alarm regarding a nuclear attack in 1983, or the global near-collapse of the financial system in 2007/2008, were near-misses that could have just as easily rewritten the social and economic history of the world. The collapse of the Soviet Union in 1989 did change history, and in hindsight we easily forget the tensions that existed when the cold war status-quo was changing to some unknown future state. More generally speaking, the management of risk is an acknowledged challenge in managing business partnerships (Zhang & Banerji, 2017) .

Organizations (governments, companies and even universities) have little influence on the occurrence of these "exogenous shocks" (Hartmann & Lussier, 2020) , nor can the occurrence of any one specific event be pinpointed to an exact point in time in the future. Nevertheless, there exists a rich toolbox of risk management practices to support decision-makers across organizations. As the economic impact of the current COVID-19 disruption demonstrates, these tools are not leveraged effectively.

One fundamental barrier to successful use of risk management practices is that risk and risk management is a highly diverse field, and for better or worse, under constant debate and development. Moreover, decision-makers do not think in terms of risk, mostly because they have not been educated in those terms. They think in terms of cost-benefit analysis, a mental framework that is appropriated for simple short-term decisions but can lead to "organizational myopia" to long term, more complex decisions.

This article briefly illuminates the broader field of risk management and highlights practical and theoretical research challenges. We believe that all of them are relevant for businesses today during the COVID-19 crisis. We can broadly discern four contexts where organizations and decision makers face risk.

Contexts 1-3 are characterized by decreasing level of knowledge regarding the future: 1) Risk (in the narrower sense), where possible future outcomes can be captured through probability distributions. A typical response is risk management (Section 2). 2) A situation of uncertainty, where there is transparency regarding what is not known, but probability distributions are unknown, as well as causal relationships influencing the outcome in question. Robust Decision Making is a possible response (Section 3). 3) A situation of ignorance, where there is no understanding that certain possible future developments are even relevant. We discuss resilience as an organizational response (Section 4).

The fourth managerial context emphasizes not just the level of available knowledge, but how organizations culturally react to the resulting uncertainty:

4) The emergence of 'organizational myopia' (including inter-organizational myopia) as an effect of risk, uncertainty and ignorance on collective human behaviour. As a possible response, we discuss organizational mindfulness (Section 5).

In this article, we consider situations of 'practical' risk, uncertainty, and ignorance, i.e. we do not discuss if certain information would have theoretically been knowable at a certain point in time, but if it was practically known by decision makers. In that sense, the current pandemic falls into the category of "ignorance" for many organizations, although technically, it was a well understood, described and quantified risk. Lastly, the discussion of organizational myopia illuminates the practical effects on the organizational level. Table 1 summarizes the key theoretical and practice challenges.

There are a multitude of competing definitions on what 'risk' is (Aven, 2012 (Aven, , 2016 . A definition following Knight (1921) understands risk as uncertainty that can be modelled and quantified monetarily: risk is uncertainty that can for example be expressed as a probability distribution. As such, risk can be effectively insured against, or be weight and traded off against other risks and opportunities. To what extent this category is truly relevant in managerial practice is debated (Aven, 2012 (Aven, , 2017 Ward & Chapman, 2003) , but it is firmly established in organizational practice. Examples include the already mentioned insurances, resource allocation, or the design and optimization of investment portfolios. The ISO 31000 standard (ISO, 2018) defines risk more broadly as the 'effect of uncertainties on objectives', generalizing from financial impacts to impacts on any type of stakeholder value (including, for example, well-being or reputation). This general definition and understanding of risk promotes professionalization of risk management practice (Olechowski, Oehmen, Seering, & Ben-Daya, 2016) and underpins many existing practitioner standards for risk management -from domains such as systems engineering (Incose, 2015) , to finance (Allen, 2012) , to supply chain management (de Oliveira, Marins, Rocha, & Salomon, 2017; Zsidisin & Ritchie, 2008) , to project management (PMI, 2019) and of course data analytics (Jaynes, Edwin, & Bretthorst, 2003) . Despite multiple established standards in the field, there remain considerable foundational challenges. Very simply, for example, consider situations with unclear or conflicting objectives-what are 'risks' under those circumstances (Aven, 2012) . It is an interesting paradox that risk management focusses on uncertainty and its potential impact, yet the prescriptions found in the risk management literature can be shrouded in uncertainty and hidden assumptions (Willumsen, Oehmen, Stingl, & Geraldi, 2019) . In practice, risk management ranges from gut-feeling-based risk matrices with illdefined (or undefined) evaluation scales for probability and impact (Cox Jr., 2009) , to highly sophisticated quantitative models (Allen, 2012; Jaynes et al., 2003) .

These foundational issues in risk management create challenges for practitioners. For example, risk management should be customized (ISO, 2018; Oehmen et al., 2014) as different risk management practices vary in their ability to create value in different contexts (Willumsen, Oehmen, Stingl, & Geraldi, 2019) . The clear implication for the current COVID-19 crisis (that arguably affects all companies), there will be no 'one size fits all' risk management solution. One such difference relates to the availability and quality of data, which heavy influences if a method is applicable (Tegeltija, 2018) . Hubbard, (2009) has shown that using inappropriate risk management methods can be worse than doing nothing, as it leads decision makers towards a false sense of certainty.

A common challenge is using expert judgement in the assessment of probability distributions of outcomes, or in simpler applications, in the estimation of probability-impact pairs for the occurrence of specific events. Expert judgement can provide valuable insight in situations where available data is lacking (Cooke, 1991; Renn, 1998; Zio, 2009 ). However, careful consideration of multiple factors such as level of expertise, confidence and subjective bias is needed (Cooke, 1991; Fortin & Gagnon, 2006) . Given the current scarcity of 'hard facts' during the COVID-19 pandemic, expert judgement plays a significant role in decision making.

The challenge of operationalizing risk management in practise extends to determining the maturity of such systems in their context (Chapman, 2019) . Having 'more' risk management does not necessarily improve the management of risk (Oehmen et al., 2014) . Rather, the contextual fit of risk management systems is of such importance that traditional process maturity scales falls short (Tegeltija, 2018) .

A number of challenges exist regarding risk management theory. As mentioned, the definition of risk itself is an ongoing debate, and no consensus has been reached. Similarly multiple conceptualizations and interpretations of uncertainty exist, as discussed in the following sections. The different conceptualizations of uncertainty require different approaches in terms of modelling and management, and research into these foundational challenges is ongoing (Aven, 2012 (Aven, , 2016 Tegeltija, 2018) . When studying the empirical research it becomes clear that the management of uncertainty and risk stretches beyond the risk management process in a narrow sense. For example, other processes in a company might serve to manage risk, such as stakeholder or knowledge management (Neves, da Silva, Salomon, da Silva, & Sotomonte, 2014; Xia, Zou, Griffin, Wang, & Zhong, 2018) , making it challenging to understand how risks are actually managed (Szczepański & Światowiec-Szczepańska, 2012) . There are reports of a discrepancy between theory and practice (Ahlemann et al., 2013; Kutsch & Hall, 2010) . According to Kutsch and Hall (2009) ; Kutsch, Browning, and Hall (2014) there is limited research about how risks are managed or not managed in practice, and why.

The strict probabilistic interpretation of uncertainty discussed above as 'risk' makes several axiomatic and practical assumptions that are easily violated in application. These include the fundamental assumption of measurability of uncertainty (Bernardo & Smith, 1994) , the identification and quantification of causal links influencing uncertainty (Renn, Klinke, & van Asselt, 2011) , the availability of data (including quantitative data, expert judgement and experience) to evaluate uncertainty (Klinke & Renn, 2002; Lough, Stone, & Tumer, 2009) , an infinite mental capacity to process information and draw factual conclusions (Simon, 1990) , and an absence of ambiguity, i.e. divergence in the interpretation of identical factual information by different stakeholders (Klinke & Renn, 2002) . This is an area of significant ongoing research and debate (Aven & Cox, 2015; Aven & Zio, 2011; Flage, Aven, Zio, & Baraldi, 2014; Zio, 2009) . For simplicities sake, we refer to 'uncertainty' as opposed to 'risk' for situations where we do not have a probabilistic quantification of the uncertainty, but we are aware that (not probabilistically quantified) uncertainty exists. This is a common challenge when dealing with novel situations such as the COVID-19 pandemic: We know that there are a lot of factors in play, and we are aware of some relationships and some of the data -but we also know that we do not fully understand their interact, or how reliable our data is, or how to model the future with some sufficient quality. Currently, significant resources are expended to better understand what impact what combination of non-pharmaceutical interventions has on reproduction numbers, or what the medium-and long-term economic effect of these actions is going to be for what part of the economy. This continues to the firm level, where we know that we are facing some supply chain disruptions and demand changes, but when, and where, and how bad, and with what exact consequences is difficult to pinpoint.

A host of methods and approaches exist to deal with this wide range of limitations: Bayesian Statistics builds a bridge between 'risk' and 'uncertainty' by explicitly modelling both aleatoric (i.e. stochastic) uncertainty, as well as epistemological uncertainty, i.e. uncertainty due to a lack of knowledge. Both are expressed in the language of probabilities (Bernardo & Smith, 1994) . The domain of Imprecise Probability (Walley, 1991) extends the treatment of epistemic uncertainty, e.g. Coherent Upper and Lower Boundaries (Colyvan, 2008; Kozin, 1996) that relaxes one of the central assumptions of Bayesian Statistics by not requiring a single additive probability measure. It has found technical applications in the field of Artificial Intelligence and safety risk assessment. The Dempster-Shafer Theory of Evidence (Beynon, Curry, & Morgan, 2000; Dempster, 1967) allows to also model ambiguity by accounting for the weight of evidence. Again, applications are mostly in technical domains such as facial recognition or medical diagnosis (Yen, 1989) .

There are specific risk communication approaches that extend classic probabilistic methods, e.g. the NUSAP Scheme (Funtowicz & Ravetz, 1990) . The NUSAP Scheme was originally developed to facilitate the communication of probabilistic models in climate science to a non-expert audience. It addresses the question of how to communicate the complexities that underly a risk or uncertainty assessment by not only communicating the (N)umber, (U)nit and (S)pread (i.e. the basic probabilistic information), but also qualitative information through the (A)ssessment, describing quality of the underlying the information (i.e. epistemic uncertainty), and the (P)edigree, i.e. an overall assessment of the quality of the applied method and result. While currently not in wide-spread use, descriptive schemes like NUSAP are very promising to better communicate the quality (and inherent uncertainty) of assessments. This richer communication helps resolve latent issues that decision makers face when they need to decide what information to trust or consider in a decision. This is a common occurrence in the current COVID-19 situation, as executives are evaluating projections of spread of infection, associated government action, market reactions, and supply chain impact.

Finally, there is a class of methods based on the concept of Exploratory Modelling, where computational experiments are used to develop plausible future scenarios, and evaluate current decision options against those scenarios. The core idea is not to identify the 'optimum' solution to address uncertainties, as that solution may be very sensitive to assumptions (that had to be made due to a lack of Table 1 Summary of theoretical and practice challenges in risk management.

Theoretical challenges Practice challenges

• Risk: Possible outcomes with known probabilities (Knight, 1921) • Risk management: Coordinated activities to direct and control an organization regarding its risks (ISO, 2018) • Conflicting definitions of 'risk' and 'risk management' (Aven, 2012 (Aven, , 2016 Aven & Renn, 2019) • Articulation of organizational value of risk management (Willumsen, Oehmen, Stingl, & Geraldi, 2019) • One-size-fits-all expectation of risk management standards vs. need for customization (Oehmen, Olechowski, Robert Kenley, & Ben-Daya, 2014) • Idealized formal risk management neglects actual risk management (including its informal aspects) (Ahlemann, El Arbi, Kaiser, & Heck, 2013; Elmar Kutsch & Hall, 2010) • Choice of appropriate risk management methods for given decision context and data quality (Tegeltija, 2018) 2. Management of uncertainty (Section 3)

• Uncertainty: Possible outcomes with unknown probabilities (Knight, 1921) • Robust Decision Making: Assessing performance across a broad range of possible futures to minimize regret (Walker, Haasnoot, & Kwakkel, 2013) • Delineation of uncertainty and risk (Aven, 2012; Flage, Aven, Zio, & Baraldi, 2014) • Development of some mathematically very advanced reasoning into actionable methods, while maintaining rigor (Tegeltija, 2018) • Incorporation and communication of uncertainty in decision making (Funtowicz & Ravetz, 1990) • Implementing and operationalizing novel uncertainty management methods (Tegeltija, 2018) 3. Management of ignorance (Section 4)

• Ignorance: Unknown outcomes with unknown probabilities (Michael Smithson, 1989) • Resilience: The ability to resist or recover from unexpected events without foresight (Holling, 1973) • Theoretically sound operationalization of resilience concepts into organizational practice (Wied, Koch-Ørvad, Welo, & Oehmen, 2020) • Reconciliation of expectation of productivity with need for resilience (R. L. Martin, 2019) • Articulation of specific and explicit resilience strategies for organizations (Wied et al., 2020) • Orchestrate cultural shift from 'predict and plan' to 'monitor and react' (Hall, Turner, & Kutsch, 2015; Rolstadås, Hetland, knowledge). Instead, they seek to 'minimize regret', i.e. ensure that a decision avoids unacceptable outcomes under all plausible future scenarios, thus limiting the worse case scenario. All acceptable options can then for example be evaluated regarding their cost. A prominent example of such a method is Robust Decision Making (RDM) (Dewar, Builder, Hix, & Levin, 1993; Lempert, 2002; Walker, Haasnoot, & Kwakkel, 2013) . RDM has been used to decide on climate change adaptation actions (Lempert, 1996) or economic policy (Seong, Popper, & Zheng, 2005) . The possible benefits of such a method for business decisions are obvious: Instead of attempting to 'maximize value' with little more than educated guesses, an approach of 'minimizing regret' emphasizes the survival of the organization under all plausible circumstances, while explicitly acknowledging the uncertainties surrounding the decision.

Approaches such Imprecise Probabilities or Exploratory Modelling require new quantitative modelling capabilities and corresponding maturity in the decision making processes. However, if organizations honestly want to address the novelty, uniqueness, and first-of-a-kind challenges that COVID-19 entails, they cannot rely on classic probabilistic approaches alone (Gidel, Gautier, & Duchamp, 2005) .

On the academic side, work remains to apply and validate these more advanced methods of uncertainty modelling in business practice (Tegeltija, 2018; Tegeltija, Oehmen, & Kozin, 2017) . At the same time, foundational discussions continue on the nature of risk and uncertainty, and how to coherently conceptualize them in the field of risk management (Flage, Aven, Zio, & Baraldi, 2014) .

We are ignorant about the future when we do not know possible future outcomes (including their probabilities of occurring). As Knight (1921) already pointed out, that is the common state of affairs in most real-world situations. Typically, the number of possible outcomes (and combinations of them) is vast and practically infeasible to enumerate, and there is no historical basis for assigning statistical probabilities to all of them, and have them sum neatly to 1. Under ignorance, Rolstadås et al. (2011) likened navigating the future to crossing an eight-lane city street packed with vehicles of all kinds, moving at varying speeds, and in both directions. Here, any detailed plan of crossing would likely be obsolete before making it across the first lane. Instead, all we can do is to broadly outline a general direction, try one lane at the time, and respond to whatever unfolds (see Wied et al. (2020) for an in-depth discussion of the relevant literature).

Resilience is an organization's ability to manage ignorance. Holling (1973) first used the term to describe the ability to resist or recover from unexpected events, without the necessity of foresight. From a resilience perspective, ignorance is not the problem. Rather, the problem is unrecognised, unpopular, or wilfully denied ignorance. This is when we think we know the future (or pretend to), but we really do not (Taleb, 2007) . When this happens, we irreversibly commit to overspecialized plans and businesses models (specialized for an expected future), and over-confidently head out into oncoming traffic. This may be a sentiment that managers can relate to in the current COVID-19 situation. In the words of Holling (1973) , specialization is an adaptive response to a stable environment, whereas resilience is an adaptive response to a dynamic environment.

While risk management, and to some lesser extent, management approaches focused on uncertainty, rely on a 'predict and plan' mindset (e.g. Van Poucke, Matthyssens, van Weele, & Van Bockhaven, 2019), resilience builds capabilities to 'monitor and react' (Hall et al., 2015) : This includes building capabilities in four areas: 1) Preparation, financially and operationally, for unexpected disruption (Sheffi, 2017) ; 2) Resistance, the immediate crisis management that moves the organization out of its denial and complacency, and minimizes the negative impact without delay (Henry & Ramirez-Marquez, 2016) ; 3) Recovery, when the organization works to regain pre-crisis performance by repairing damage, improvising, and making do; and 4) Learning, implementing new solutions refining them than possibly surpassing precrisis performance (Taleb, 2013) . Or to paraphrase the intrepid explorer Roald Amundsen: Preparation is called 'luck', whereas lack of necessary precautions is called 'bad luck'. During the COVID-19 pandemic, we have to give our organizations a chance to 'be lucky' during and after a disruption. As the COVID-19 situation evolves, disruptions will keep emerging across the value chain, and resilience will remain a core necessity.

Looking at instances of 'luck' during the COVID-19 epidemic, this is a virtual manifesto against over-specialization and towards local adaptation. In the first days of the crisis, long outmoded ventilators were brought out of storage (and dumpsters), and animal hospital ventilators were rapidly adapted for human patients. A range of medical professionals were brought in and retrained in their use (Hersher, 2020) . Whiskey manufacturers switched to distilling batches hand sanitizer (C. Levenson, 2020) . 3D printer hobbyists churned out face masks (Brooks, 2020) . Super markets and drug stores became door-todoor delivery services overnight despite the health risks (Randle, 2020) . Public and private spaces were re-organized for social distancing (Tavares & Stevens, 2020). Churches, schools, and concert halls became online-only entities within a few weeks (Freedman, 2020) . There is much to learn from these creative outbursts, outlining both practical and theoretical challenges for businesses.

In the past, crises were followed by complacency (Ayotte, Gerberding, & Morrison, 2019) . When normality returns, resilience thinking will, once again, be swimming against the steady current of specialization and optimization. At no point are uncertainty and ignorance harder to imagine than in predictable times (Taleb, 2005) . Already, detailed 'post-crisis' plans are potentially obscuring the view to a future that is, essentially, no less surprising than before (Weick & Sutcliffe, 2007) . Denial, nostalgia and arrogance of past successes quickly reassert themselves (Hamel & Välikangas, 2003) , now amplified by survivorship and hindsight bias. Preserving and harnessing the creative, flexible, imaginative, engaged, 'one-day-at-a-time' state of alertness (Hall et al., 2015) will be a major challenge for businesses. Preparing for the next surprise will involve remaining in the sweet spot between complacency and panic (Henderson, 2020) .

Theoretically, the challenge is to move beyond a probabilistic and 'event-specific' understanding of risk, and towards a paradigm of 'general preparedness' (Aven, 2017b) . In this respect, there is some way to go to reconcile Holling's attitude of Socratic humility about the future (Holling, 1973) with the necessity of specialization, optimization and regular risk management. It is challenging to appreciate the value of 'post surprise' strategies like multi-functionality, redundancy, reversibility, incremental learning, modifiability and opportunism (Wied et al., 2020) , before they are actually needed. Importantly, resilience thinking does not preclude sophisticated anticipatory planning, but encourages us to prepare for even our best-laid plans to be wrong.

Despite all guidelines, mathematical models and software, risk management remains a human-centric activity. It is people deciding if and which risk management perspective and process to adopt, which scenarios or inputs to analyses, and what to with the results (discussed for example by Cui, Su, Feng, & Hertz, 2019 in the context of servitization). These human-centric activities are subject to several limitations, that can be analysed at two different levels: individual and organizational.

At the individual level, humans dealing with risk, suffer from the socalled "cognitive bias". The term cognitive bias was popularized by the work of Tversky and Kahneman (1974) which identified cognitive biases as errors in thinking stemming from heuristics. These heuristics are principles which are used to reduce the complexity of decision making leading to errors in an individuals thoughts. Pohl (2004) imagines cognitive biases as illusions that can cause an individual's thoughts, memories or judgements to deviate from reality. Cognitive biases usually tend to affect complex decisions and individuals are not usually aware of the presence of such biases in their decision making. According to Reyna, Chick, Corbin, and Hsia (2014) experienced individuals were more likely to display cognitive biases in their decision making when compared to the group of inexperienced people. As the COVID-19 situation unfolds, we can individually reflect on our own thinking and decision making biases, particularly in the early phases of the pandemic.

Cognitive biases, such as optimism bias, have been popularized in project and risk management literature by Flyvbjerg's books and papers claiming that cognitive biases are key reasons why for example largescale projects are often delivered over budget and late (Flyvbjerg, 2006; Flyvbjerg, Garbuio, & Lovallo, 2009 ). However, the idea of cognitive biases in project and risk management is at least 20 years old. McCray et al. (2002) highlight the significant effect that cognitive biases may have on complex projects where project managers tend to rely on prior experience or rules of thumb (heuristics) that they have created over the years in order to deal with project complexity.

The number of cognitive biases described in the literature is in the order of 100. One bias that is relatively infrequently discussed, but very relevant for our discussion, is the Dunning-Kruger effect. The term was first coined in 1999 when David Dunning and Justin Kruger first observed the effects of incompetence on self-judgement (Kruger & Dunning, 1999) ; in addition to making wrong decisions, incompetent people are also unable to realize their incompetence. Kruger and Dunning (Kruger & Dunning, 1999) called this the "dual burden of incompetence". This poses a particular challenge in the COVID-19 pandemic: In order to recognize the competence of other people in a specific domain, an individual should possess a certain level of competence in that domain as well; since an incompetent person will not be able to judge their performance correctly, that person will tend to overestimate their ability, e.g. in performing an appropriate risk analysis.

Advancing to the organizational level, humans dealing with risk suffer from "Collective myopia", also called organizational and interorganizational myopia (Chikudate, 2002) . Organizational myopia received less attention and research than cognitive bias but is no less important. "Collective myopia is a […] condition where the sensemaking capabilities among the members in collectivities are limited to their contexts. Emerging orders or patterns are like the flocks of sheep that are nicely organized. Each sheep knows how to behave and watch out for each other in a collectivity. But none observes their collective behaviours as a whole.

[…] The sense-making of these members is, thus, confined to the limited context of their own concerns in certain organizations or communities." (Chikudate, 2015, p16) .

The concept of collective myopia has been associated with the studies of ethics in organizational practices (Chikudate, 2002) , where the ethical judgement of the individuals are suppressed by an overarching perspective from the organization. In this "Ethical Blindness" individuals, as part of an organization, might act unethically without being aware of it. They become ethically blind (Palazzo, Krings, & Hoffrage, 2012) . This blindness has implications for risk management and decision making, like in the emblematic cases of the Ford Pinto (Gioia, 1992) and Fukushima Daiichi (Chikudate, 2015) where misjudged risk analyses had dramatic consequence on people, business and the environment. It is starting to become evident in the context of COVID-19, when for example certain groups start discussing very matter-of-factly how we should deliberately sacrifice vulnerable populations for the greater good, completely oblivious of their ethical transgressions and proximity to eugenics (Jones, 2020) .

At individual level cognitive bias and, at an organizational level, collective myopia can at least in part explain how educated and intelligent people consistently failed to appreciate and take actions to mitigate a pandemic risk its implications. The risk management models reflected the bias and myopia of the people preparing them, and miserably failed.

Myopia, and ethical blindness, are major barriers in developing successful interorganisational relationships, as they push the organization to develop a tunnel vision. The organization loses its ability to develop empathetic relationship with its stakeholders, including understanding what represents "value" for them, greatly diminishing their ability to address the various forms of risk. The organization might even fail to recognize key stakeholders that can support the organization in achieving its objectives and responding to risk, uncertainty and ignorance.

A way for addressing organizational myopia is "organizational mindfulness" (Sutcliffe et al., 2016) . Organizations can address the issues organizational myopia by closely monitoring failures (own failures and failures from other organizations), paying attentions to frontline operations, resist the temptation to oversimplifying the interpretations of events and situation privileging expertise over hierarchy (Catino, 2013) .

The Case of the UK government failing to procure Personal Protective Equipment (PPE) for its healthcare system is an exemplar case of how myopia undermined the interorganisational relationships, and it is discussed in the following section.

On April 28, 2020, the BBC opened with a dramatic headline "The government failed to buy crucial protective equipment to cope with a pandemic" (BBC, 2020d). For the BBC, this news article was quite unique, as it showed two rare characteristics: (i) an almost alarmist tone, reminiscent of a tabloid, in stark contrast with the BBC's usually softer tone; and (ii) the headline being a direct attack on the UK government. However the situation was dramatic: "The consequence of not planning; not ordering kit; not having stockpiles is that we are sending into the front line doctors, nurses, other health workers and social care workers without the equipment to keep them safe". According to the Government minister Victoria Atkins, "Like every other country in the world, [the virus] is unprecedented and the requirements for [Personal protection equipment] PPE have risen exponentially and we are doing our absolute best to address those needs and will continue to do so throughout this crisis" (BBC, 2020d).

The NHS is the UK's national health care system. The NHS offers medical care across the UK to all those who reside there, including first aid, short and long-term hospital stay, and specialist services such as dental services. It came into operation on July 5, 1948. Most of the services are tax financed, and as such, free of direct cost for patients.

The issues related to the provision of PPE originated even before the COVID-19 was recognised by the World Health Organization (WHO). A BBC report "found that vital items were left out of the stockpile when it was set up in 2009 and that the government subsequently ignored a warning from its own advisers to buy missing equipment.

[…] The expert committee that advises the government on pandemics, the New and Emerging Respiratory Virus Threats Advisory Group (Nervtag), recommended the purchase of gowns last June. Gowns are currently one of the items in shortest supply in the UK and they are now difficult to source because of the global shortage of PPE. Doctors and nurses have complained that there are also shortages of the life-saving FFP3 respirator masks. Panorama has discovered that millions of FFP3 respirator masks are unaccounted for. There were 33 million on the original 2009 procurement list for the stockpile, but only 12 million have been handed out. The government refuses to explain where the other masks have gone." (BBC, 2020d) .

While many of these facts were knowable (or known to someone), the central decision makers were largely in positions of ignorance. What caused the later escalation of the situation is that the general level of resilience -a sufficient capability of preparation and ability to resist, recover and learn from an incident, in our case specifically escalation PPE demand -was very low. Even the easiest option, stockpiling of cheap but critical items such as PPE, had not been realized.

During the early phase of the outbreak, very little statistically relevant information was available that could have informed classic probabilistic risk assessments, but it was known that a novel virus was spreading. Decision makers were no longer operating under conditions of ignorance, but significant uncertainty: According to WHO (2020c), on the 31st of December 2019 Chinese authorities reported a group of cases of pneumonia in Wuhan. A new coronavirus was recognised. Shortly thereafter, on the 4th of January 2020, the WHO reported the news about a cluster of pneumonia cases with no deaths in Wuhan.

The following day the WHO distributed the first Disease Outbreak News about the virus. This type of announcement, intended for media, scientific and public health community, includes a risk assessment section, concluding that "there is limited information to determine the overall risk" (WHO, 2020a) -summarizing that decision makers are indeed operating under conditions of uncertainty, not risk.

We can observe several actions taken under these conditions to 'minimize regret', i.e. actions minimizing the impact of a worst-case scenario. For example, on the 10th of January, the WHO issued a comprehensive package of technical guidance online with advice to all countries on how to detect, test and manage potential cases, based on what was known about the virus at the time. This guidance was shared with WHO's regional emergency directors to be shared with WHO representatives in countries. It is reasonable to assume that by the 10th of January, UK authorities were informed about the new virus, but it is not obvious that aggressive actions were taken to strengthen national capabilities. By January 12, China had publicly shared the genetic sequence of COVID-19 to facilitate scientific endeavours for diagnosis, treatment and vaccination.

On the 22nd of January, the Department of Health and Social Care and Public Health England published the first government statement. After another 9 days (31st of January), there are the first two cases of COVID-19 confirmed in the UK. A few days later (3rd of February), the WHO releases the 28 page 'Strategic Preparedness and Response Plan' (WHO, 2020b) to support states with weaker health systems. It includes an updated risk assessment, now being based on over 10′000 confirmed cases globally, confirmed human-to-human transmission, and robust quarantine and lockdown measures being taken in China.

Arguably, the situation evolved into a scenario where larger amounts of data are becoming available, enabling probabilistic risk assessments. It is accompanied by increasingly aggressive EU-level activities to procure critical PPE. On the 31st of January Four UK countries (not including the UK) suggest a need for PPE "in case of an expanding situation in the EU". (The Guardian, 2020b) .

On the 28th of February The EU launches its first joint procurement of £1.2 m worth of gloves and gowns/overalls. The procurement fails due to a lack of suitable suppliers. It is relaunched on 15 March -the UK was not involved in either (The Guardian, 2020b) .

One very visible turning point in the engagement with risk-based models was the publication of the so-called 'Imperial Model' by a research group from Imperial College London on March 16 (Ferguson et al., 2020) . Based on some of the most detailed modelling to-date and the latest known characteristics of the COVID-19 spread, it projected mortality figures for the UK and the US, which triggered the first significant actions in both countries in the following days regarding nonpharmaceutical interventions.

As the COVID-19 situation evolved, instances of organizational myopia became more and more apparent: For example, by the 11 of February there were eight confirmed COVID-19 cases in the UK, but Steve Oldfield, chief commercial officer at the Department of Health and Social Care, reassured staff that the "NHS and wider health system are extremely well prepared for these types of outbreaks" (Financial Times, 2020) . Only two days later UK dentists started to discuss the potential lacking of PPE (Express, 2020) .

In another instance, on the 24th of February (two days after the first major lockdowns in Italy occurred), a meeting of officials, to which the UK was invited, hears an update from the European commission on the joint procurement of PPE. Commission officials call on countries to confirm "their exact needs latest today … to move forward with next steps". No representative from the UK attends the meeting (The Guardian, 2020b) . Two days later Emergency units in the UK start to be overcrowded and patients have to be looked after in hospital corridors (The Guardian, 2020a) .

On the 4th of March there is the 100 officially recognised victims in Italy, and the following day there is the first victim of coronavirus in the UK (BBC, 2020a). Over the next two weeks the number of victims in Italy increases to more than 3000 and the Italian healthcare system is, in the most affected zone, collapsing. However, still on the 18th of March (two days after the publication of the 'Imperial Model'), the UK Prime Minister Boris Johns declared "We have stockpiles of PPE equipment and we're proceeding in accordance with the best scientific advice." (BBC, 2020c). The UK is still largely operating 'business as usual' with children going to schools and pubs and restaurants opened (almost one month after the first lockdowns Italy).

On the 19th of March the UK eventually takes up an invitation to join the EU joint procurement agreement steering committee, which makes decisions on mass purchases. The UK does not join a procurement for laboratory supplies that is put out to tender on the same day (The Guardian, 2020b). The following day, in a unique historic escalation of the UK's response to the outbreak, the UK prime minister Boris Johnson orders all gym, restaurants, pubs, churches and other social venues across the UK to stay closed indefinitely (The Independent, 2020). On the 23rd of March, almost three months after the outbreak in China became public knowledge, the health secretary, Matt Hancock, confesses there have been "challenges" with suppling PPE after complaints by NHS staff (including doctors and nurse) from across the country. The UK army is drafted into the effort to support the distribution (The Guardian, 2020b).

While the presented case presents a rough progression from conditions of ignorance to those of uncertainty and risk, this cannot be generally assumed. As is the case in the example, this progression is also specific to each issue at hand. Furthermore, the role that organizational myopia plays as the behavioural reaction to risk, uncertainty and ignorance evolved as the situation evolved.

It is important to distinguish between ignorance and myopia, which are two distinct, yet complementary phenomena. At the beginning the government displayed prevalently ignorance. Before the crisis started there was already a shortage of PPE. The government ignored the warning coming from Nervtag, Bill Gate's now-famous TED Talk (Gates, 2015) and more generally the various expert assessments of possible future pandemics. At the time, the UK government was focused on the issues related to the exit of the UK from the European Union ('Brexit'). Although these insights were technically knowable by UK Department of Health and Social Care (and most likely known by some), they were not considered for or implemented in the design of the healthcare and broader response system. However, after the WHO alerts and the first deaths in Italy and Spain, the situation progresses from ignorance to uncertainty. The UK government 'knows' about COVID-19 but, for a long time, was refusing to acknowledge its relevance, that the system was poorly prepared, and the need for taking appropriate actions. Instead, it propagated an increasingly untenable narrative that the NHS was well prepared to face the pandemic, ignoring available facts. Myopia reduces the number of options assessed by decision makers making them rely on their own bounded rationality. The "big picture" is lost and future opportunities are missed (Czakon & Kawa, 2018) . In March, organizational myopia reaches a level where the government pretends to have PPE that does not exist. Still in May, the NHS is struggling to access basic PPE (BBC, 2020b).

Arguably, organizational myopia was a moderating factor that negatively influenced UK government capability to adequately address all three conditions -risk, uncertainty and ignorance. As a result, prudent preparation where not taken, the lack of those preparations was ignored, timely steps to 'minimize regret' were not taken, and ultimately, even the increasing amount of scientific evidence and more advanced models only led to tangible action after significant delay.

We can draw a number of managerial implications from the previous discussion (see Fig. 1 ):

First, it is important to note that the most widely used approach, risk management, is typically not geared towards providing meaningful responses to high-impact, low-probability events, such as the current COVID-19 pandemic. These events in the 'fat tail' of the probability distribution typically do not meet threshhold criteria for taking substantial action, as standard cost-benefit tradeoffs fail to appropriately capture low likelihood events, or events expected to occur in the 10+ year future. An obvious task is to revise risk management procedures to adequately prioritize mitigation actions for this type of event.

Second, we have to acknowledge that rare events are characterized -by their nature -by less available data. Our approaches to characterize those events must be chosen appropriately. If a quantitative risk assessment is not meaningful, organizations must employ methods that are appropriate for these situations, such as Robust Decision Making, or Resilience Thinking.

Third, related to the previous point, decision makers have to reflect on the level of (practically) available knowledge, and actively discuss their current decision making context. In situations of significant uncertainty, or where we can reasonably expect a large degree of ignorance regarding future devleopments, managers should again emphasize resilience (i.e. general preparedness for noticing, resisting, recovering, and learning from distruptions), and Robust Decision Making-type actions (e.g. minimizing regret under plausible future scenarios).

Fourth, the factual basis that is available to decision makers is only part of the equation. Equally, if not more, important are the cultural and behavioural actions at the individual and organizational level. These have to be understood and reflected in the way that decisions are made and communicated.

These implications are broadly supported by the ongoing discussions in the risk management domain, specifically regarding the need to tailor our responses to specific contexts (Tegeltija, 2018) , as well as the discussions surrounding the relationship and integration of various models of and responses to uncertainty (Aven, 2018) .

The UK National Risk Register of Civil Emergencies was last updated in 2017. In contains a detailed description of what would happen during a pandemic, the impact on the UK, and what actions would need to be taken. It was ranked as the highest risk in the catalogue (National Risk Register of Civil Emergencies, 2017), with a near-certain probability of occurrence during our lifetimes. Reports of that kind existed for practically all governments. The failure to take action to mitigate an obvious risk is not just the failure of our governments, it is also the failure of (most) major corporations, and us as individuals.

We are paying a very high price for having neglected risk management in all its facets, as briefly laid out in this article. Even articulating what we mean by 'risk management' is difficult. We suggest to use resilience -for example as 'resilient organizations' and 'resilient inter-organizational relationships' -as a shorthand to summarize the goal of the much needed transformation. If interpreted in a wider sense, the preparation phase inherent in resilience can accommodate all necessary risk and uncertainty management activities. Additionally, the capabilities to resist, recover, and learn provide a framework to discuss other desirable attributes, such as flexibility, adaptability, or robustness.

For over 200 years, we have embraced productivity as the guiding star of our societal development. It took us more than 50 years to start taking serious actions regarding sustainability. Now is the time to embrace the third column that modern societies rest on: resilience.

A process framework for theoretically grounded prescriptive research in the project management field

Financial risk management : A practitioner's guide to managing market and credit risk (2nd

Foundational issues in risk assessment and risk management

Risk assessment and risk management: Review of recent advances on their foundation

A conceptual foundation for assessing and managing risk, surprises and black swans. The Illusion of Risk Control

How some types of risk assessments can support resilience analysis and management

The call for a shift from risk to resilience: What does it mean? Risk Analysis

Some foundational issues related to risk governance and different types of risks

Some considerations on the treatment of uncertainties in risk assessment for practical decision making

Introduction to special virtual issue: Foundations of risk analysis. Risk analysis (pp. 1-2). Society for Risk Analysis

Ending the Cycle of Crisis and Complacency in U.S. Global Health Security. A Report of the CSIS Commission on Strengthening America's Health Security

Coronavirus: Man in 80s is second person to die of virus in UK

Coronavirus: Newly-promoted NHS consultant says "it's time to step up

Coronavirus: NHS staff "at risk" over lack of protective gear

Coronavirus: UK failed to stockpile crucial PPE

Bayesian theory

The Dempster-Shafer theory of evidence: An alternative approach to multicriteria decision modelling

Nassim Taleb says "white swan" coronavirus pandemic was preventable

Silverton-area man makes masks for health care workers with 3D printer

Organizational myopia: Problems of rationality and foresight in organizations

Event 201 -Public-private cooperation for pandemic preparedness and response -A call to action

Exploring the value of risk management for projects: Improving capability through the deployment of a maturity model

Collective myopia and disciplinary power behind the scenes of unethical practices: A diagnostic theory on Japanese organization

Collective myopia in Japanese organizations: A transcultural approach for identifying corporate meltdowns

Is probability the only coherent approach to uncertainty

Experts in uncertainty: Opinion and subjective probability in science

What's wrong with hazard-ranking systems? An expository note

Causal or effectual? Dynamics of decision making logics in servitization. Industrial Marketing Management

Network myopia: An empirical study of network perception. Industrial Marketing Management

Upper and lower probabilities induced by a multivalued mapping

Assumption-based planning: A planning tool for very uncertain times

Coronavirus face mask shortage: UK dentists issue desperate warning amid killer outbreak

Impact of non-pharmaceutical interventions (NPIs) to reduce COVID19 mortality and healthcare demand

How poor planning left the UK without enough PPE | Free to read

Concerns, challenges, and directions of development for the issue of representing uncertainty in risk assessment

From Nobel prize to project management: Getting risks right

Delusion and deception in large infrastructure projects: Two Models for Explaining and Preventing Executive Disaster

Interpreting major industrial landscapes: Social follow-up on meanings, the case of two aluminium smelters

Local churches adapt to COVID-19. Go online … or keep doors open?Times

Uncertainty and quality in science for policy. Uncertainty and quality in science for policyNetherlands

The next outbreak? We're not ready. TED conference TED2015

Decision-making framework methodology: An original approach to project risk management in new product design

Pinto fires and personal ethics: A script analysis of missed opportunities

Project resilence: The art of noticing, interpreting, preparing, containing and recovering

The quest for resilience

Managing the sales force through the unexpected exogenous COVID-19 crisis

Between complacency and panic

On the impacts of power outages during hurricane Sandy-A resilience-based analysis

Improvisation and retraining may be key to saving patients In New York's ICUs

Resilience and stability of ecological systems

The failure of risk management: Why it's broken and how to fix it

The guide to the systems engineering body of knowledge (SEBoK

Risk management -Principles and guidelines

Probability theory : The logic of science

Eugenics isn't going to get us out of this mess

A new approach to risk evaluation and management: Riskbased, precaution-based, and discourse-based strategies

Risk, uncertainty and profit. Risk, uncertainty and profitBoston, MA: Houghton Mifflin Company

Obtaining Reliability and Safety Assessments on the Basis of Non-Probabilistic Methods

Unskilled and unaware of it: How difficulties in recognizing one's own incompetence lead to inflated self-assessments

The rational choice of not applying project risk management in information technology projects

Bridging the risk gap: The failure of risk management in information systems projects

Deliberate ignorance in project risk management

When we don't know the costs or the benefits: Adaptive strategies for abating climate change

A new decision sciences for complex systems

Anheuser-Busch and Distilleries Race to Make Hand Sanitizer Amid Coronavirus Pandemic

The risk in early design method

Rethinking efficiency. The high price of efficiency

Project management under uncertainty: The impact of heuristics and biases

Risk management in software projects through knowledge management techniques: Cases in Brazilian incubated technology-based firms

Analysis of the effect of risk management practices on the performance of new product development programs

The professionalization of risk management: What role can the ISO 31000 risk management principles play?

The ISO 31000 standard in supply chain risk management

Ethical blindness

The standard for risk management in portfolios, programs, and projects

Cognitive illusions : A handbook on fallacies and biases in thinking, judgement and memory

I Feel Like a Hero": A Day in the Life of a Grocery Delivery Man

Three decades of risk research: Accomplishments and new challenges

Coping with complexity, uncertainty and ambiguity in risk governance: A synthesis

Developmental reversals in risky decision making

Risk navigation strategies for major capital projects: Beyond the myth of predictability

Strategic choices in science and technology: Korea in the era of a rising China

The power of resilience: How the best companies manage the unexpected

Bounded rationality. Utility and probability

Ignorance and uncertainty: Emerging paradigms

Errors, lies and misunderstandings: Systematic review on behavioural decision making in projects

Mindfulness in organizations: A crosslevel review

Risk management system in business relationships-Polish case studies. Industrial Marketing Management

Fooled by randomness : The hidden role of chance in life and in the markets

The black swan: Second edition: The impact of the highly improbable

Cities will endure, but urban design must adapt to coronavirus risks and fears

Assessing the capabilities of advanced risk quantification methods for engineering systems managementTechnical

Risk management challenges in large-scale energy PSS

Timeline of UK's coronavirus PPE shortage

Coronavirus: A timeline of how Britain went from 'low risk' to an unprecedented national shutdown

Judgement under uncertainty -heuristics and biases

The effects of purchasing proactivity on value creation and supply risk reduction in sourcing projects: Implications for marketers' capabilities. Industrial Marketing Management

Adapt or perish: A review of planning approaches for adaptation under deep uncertainty

Transforming project risk management into project uncertainty management

Managing the unexpected: Resilient performance in an age of uncertainty

Pneumonia of unknown cause -China

Strategic preparedness and response plan

WHO timeline -COVID-19

Managing exploratory projects: A repertoire of approaches and their shared underpinnings

Value creation through project risk management

Towards integrating construction risk management and stakeholder management: A systematic literature review and future research agendas

GERTIS: A Dempster-Shafer approach to diagnosing hierarchical hypotheses

Challenges of servitization: A systematic literature review. Industrial Marketing Management

Reliability engineering: Old problems and new challenges

Supply chain risk : A handbook of assessment, management, and performance