It was the summer of 1965. I was ten years old, and in the weeks before my father deployed to Vietnam for another tour of combat, my parents took my five siblings and me to Lookout Mountain, Tennessee, where my mother had been raised and family abounded. My soldier father was my hero, but on a warm evening at my aunt Margaret's lovely mountain home, she showed me a black-and-white photograph of a young-looking naval officer and told me a fascinating story about another member of my family. For a ten-year-old history buff, the story was a seductive mystery.
The officer was Commander Thomas Calloway Latimore, a 1914 graduate of the United States Naval Academy at Annapolis. After a twenty-
seven-year career of shipboard and shore assignments, including a tour in military intelligence and a brief stint as the governor of American Samoa, Latimore was given command of the USS Dobbin, a destroyer tender stationed at Pearl Harbor, in April 1941. The USS Dobbin supported the US Pacific Fleet that had been forward positioned from the West Coast to Hawaii by President Franklin D. Roosevelt to counter increasingly aggressive Japanese moves in the region.
By all accounts, Latimore was a quiet man and an avid hiker who liked to walk the hills overlooking the sprawling Hawaiian naval base. Once, he injured his arm while hiking, telling crew members that he had fallen. The injury required a cast, but after a time he appeared to fully recover.
In July 1941, Latimore went out again. Clad in a hat, a khaki uniform, and comfortable shoes, and carrying a walking stick, the commander left the trailhead alone, hiking into the Aiea Range above the base-and he disappeared forever. Late that day, his crew, concerned about his well-
being, unsuccessfully combed the hills before a wider effort involving local authorities joined the search, all with the same result. No sign or any clue of what had happened to Commander Latimore was ever found.
Like most stories, it got a bit better in the telling. I remember it described as having happened only days before the Japanese attack, so it was assumed that Latimore had unexpectedly run into Japanese agents collecting intelligence on the US fleet and they had kidnapped or killed him. No evidence supports that hypothesis, but it's too enticing to ignore.
A less romantic but far more likely risk came from the danger inherent in a fifty-one-year-old sailor hiking alone. The terrain above Pearl Harbor is not obviously treacherous, but Latimore had already been injured earlier doing the same thing. Risks are not always obvious, nor are they often legend-worthy. We may never know the truth of what happened, but in any event, Commander Thomas Calloway Latimore had vanished-his family and nation were left to wonder how things might have been different. And less than five months later, his disappearance became forever associated with the Japanese attack on Pearl Harbor. Some pondered whether it could have been part of a larger failure to effectively assess and respond to potential risks.
Though I was just ten years old that summer in 1965, I was already very familiar with the story of Japan's surprise attack on Pearl Harbor. Just before 8:00 a.m. on Sunday morning, December 7, 1941, six Imperial Navy carriers infiltrated the base along a northern route to a position 230 miles from Oahu before launching 353 bomber, fighter, and torpedo aircraft in two waves against a series of US naval targets on the most developed of Hawaii's islands.
By midmorning the United States counted 8 battleships severely damaged or destroyed, 11 other vessels bombed and strafed, 328 aircraft
damaged or destroyed-and 2,403 souls killed with more than 1,100 wounded. For days oil fires burned in the harbor and desperate taps could be heard from sailors caught in the bowels of capsized ships.
The effect was devastating. But should the attack have been a surprise?
Conflict between Japan and the United States had long been brewing. With the 1898 US annexation of Hawaii and occupation of the Philippines following the defeat of Spain, America became a true Pacific power, putting Japanese and US objectives increasingly at odds. Logically, the United States began to fortify its possessions in the region, and naval officers at Newport's Naval War College conducted regular war games to refine strategies for conflict with Japan.
After 1931, the friction between the two nations rose. Japan's increasingly militaristic government, its aggressive expansion in Manchuria and then China proper, and its symbolic alliance with Germany and Italy convinced American diplomats and the military that war was not only likely but inevitable.
In the months before December 7, American pushback targeted Japan's dependence on foreign resources to fuel its increasingly industrialized economy. The United States imposed embargoes on oil and scrap metal shipments, leaving the proud Japanese to face the prospect of humiliating retreat-or war. If unable to trade for these goods, surely Japan would take them by force. It would only be a question of when and how.
In July 1941, Japanese leaders began a series of meetings to set a strategic course. The game of chess became more complex when Nazi Germany, Japan's nominal Axis ally, invaded the Soviet Union and requested that Japan join the attack on Stalin's enormous communist state. The Japanese deferred but committed themselves to securing a political and economic order for Asia that would extend far beyond their home islands and subordinate hundreds of millions to Japanese rule.
The outcome of the meetings did not remain secret for long. US intelligence had broken the Japanese code used for diplomatic messages, and within weeks had intercepted a coded message from the Japanese Foreign Ministry to its embassies overseas, communicating to the Imperial Conference that their nation would not hesitate to use force to secure its strategic objectives.
These messages also included instructions for Japanese diplomats to report on American military facilities like Pearl Harbor, thereby giving the United States advance notice of potential targets. Simultaneously, the US military, government sources, allied countries, and the press continued to collect information about Japan's designs.
The Greatest Risk Is Us
Unless we believe the story of Japanese spies, Tom Latimore likely died from a mistake he made while hiking-a stumble, a misplaced step, perhaps dehydration. On an island devoid of likely predators, and crossing inanimate terrain, the likely determining variable, and responsible party, is Latimore himself.
The Japanese attack on December 7, while far more famous, shares DNA of sorts with my lost relative. Although Pearl Harbor has long been used as a synonym for treachery, the risks-of war with Japan, of a Japanese first strike, even of an attack on America's Pacific Fleet's primary base (although considered less likely than other targets such as the
Philippines)-were well known. Indeed, responsibility for much of Japan's success lay with the failure of American leaders to effectively assess and respond to the risk.
Why didn't the United States have the ability to better estimate Japanese strategic plans? Why was the attack on Pearl Harbor such a devastating surprise?
It is a familiar pattern. Fixated on external factors, individuals and organizations fail to tend to their Risk Immune System and become vulnerable even to perceivable risks.
Time and again we see that the greatest risk to us as individuals, and to our organizations, is us.
Like Latimore, whose personal miscalculation likely cost him his life, his nation ultimately posed the greatest danger to itself by failing to respond to a well-understood threat. Both Latimore and American officials had at their disposal the dials needed to control their own response to risk, and both failed to calibrate them. This is not uncommon. Unable or unwilling to calibrate for important factors like communication, structure, and bias, we remain vulnerable to threats.
That is why it is so important to change our approach from one that is focused on external factors to one that looks inward at the factors that determine our own response.
But before we go further, it is essential that we first consider the very concept of risk-it is less clear-cut than we pretend.
Threats-people or things that could potentially do us harm-are omnipresent. But it is our ability to prevent, avoid, or mitigate a threat that determines to what extent it constitutes a risk. For example, if I am in an armored vehicle, an individual with a handgun isn't a risk to me. But if I am unarmed on a crowded street, that armed person could constitute a tremendous risk.
In the unrealistically perfect world where no threats exist, the strength of my ability to deal with threats is irrelevant-I'm not at risk. Conversely, and equally unrealistically, in a threat-filled environment where my ability to deal with threats is absolute, I have no risk to worry about. To sum it up:
If there are no threats-our vulnerabilities don't matter.
If we have no vulnerabilities-threats don't matter.
For the mathematically inclined, it would be depicted as an equation:
Threat Vulnerability = Risk
Which means that if the value of either Threat or Vulnerability is zero, there is no Risk (Anything 0 = 0).
But I've never experienced either situation, and it's likely you haven't either-we live somewhere in the middle. We try to minimize the threats we are exposed to, but knowing that our efforts will be imperfect at best, we rely on our Risk Immune System to help Detect the risk, Assess it, and Respond to it appropriately.
Wait a minute. I've just drawn an analogy to our human immune system, a confusing approach if most of us have, at best, a hazy understanding of what it actually does-and how. Well, here it is in terms even an infantry soldier can understand.
The miracle of the immune system lies in its ability to rapidly and accurately identify friend (good cell), from foe (potentially harmful pathogen), mount an effective response to defend the body, and then remember what it learned, maintaining the ability to respond even more effectively should the threatening pathogen reappear.
Immunologists view our immune systems as bounded by the outside (skin) of our bodies. As individuals, most of us make reasonable efforts to augment and extend our natural defenses by avoiding or mitigating threats through good hygiene, diet, and exercise. Still, our immune systems do the lion's share in defending our health.
Organizations have, in fact, a very similar capability.
The analogy isn't perfect (few are), but what we call the Risk Immune System performs a similar function to identify, assess, and combat threats to our well-being. And it provides a helpful construct through which to understand how we can strengthen our ability to survive and prosper in a world of constant risk.
As we mentioned earlier, to be effective, Risk Immune Systems must perform four functions: Detect-Assess-Respond-Learn. In today's environment, driven by increasing speed and complexity, adeptly fielding a wider range of fast-moving threats is more challenging than ever. But while the threats we face are daunting, our condition need not be fatal. To be sure, there are external threats that constitute challenges individuals and organizations cannot dodge, but the capacity to respond effectively is typically within reach. With thoughtful attention to the health and effectiveness of our Risk Immune System-by paying particular attention to what we can control-we reshape our ability to deal with risk; hence this book.
I have identified ten dimensions of control present in every organization, typically at varying levels of effectiveness, that can be monitored and adjusted to maintain a healthy Risk Immune System.
Communication: How we exchange information with others
Narrative: How we tell others about who we are and what we do
Structure: How we design our organizations and processes
Technology: How we apply machinery, equipment, resources, and know-how
Diversity: How we leverage a range of perspectives and abilities
Bias: How the assumptions we have about the world influence us
Action: How we overcome inertia or resistance to drive our response
Timing: How when we act affects the effectiveness of our response
Adaptability: How we respond to changing risks and environments
Leadership: How we direct and inspire the overall Risk Immune
These Risk Control Factors are not a set of strengths to celebrate, nor are they vulnerabilities to be mitigated. Instead, think of the factors as a set of dials that we can adjust or calibrate to improve the operation of the Risk Immune System. Each factor needs to be healthy and functioning (and strengthened, if necessary) and then adjusted, or dialed, to achieve the appropriate response to each situation.
Complete malfunctioning of any Risk Control Factor can be problematic. It's more important, however, to consider each factor as part of an interconnected system, one that can be set and adjusted as appropriate. As we'll see throughout the book, in some instances one or more of the Risk Control Factors assume dominant importance (in how well or how poorly they function)-but by and large, the factors are interdimensional. Most outcomes are determined by a broad combination of the factors.
This can prove frustrating. We crave a "one big thing" answer to any success or failure. But most often the "one big thing" is our appreciation for the complexity of the system, and our ability to keep it healthy and properly functioning. We can blame outside threats all we want, but there is much we can do to prepare for them-often far more than we care to admit.
Though in practice we employ Risk Control Factors in combination, for the purpose of this book, they are organized by chapter. The stories used to illustrate each factor are meant to demonstrate some particular quality or emphasize its priority in decision-making, but careful readers will notice multiple Risk Control Factors at play. For example, an anecdote about communication may also speak to structure and technology. The system is interdimensional by design. So keep in mind that the
factors making up the Risk Immune System are interrelated parts of a whole, connected by communication and overseen by the tenth factor, leadership.
Another way to think of the Risk Immune System is like a series of interconnected dials, or gears, where the movement of one affects the shifting of all. Leadership is the wrench that orchestrates everything.
If several factors, or gears, fail, then the whole Risk Immune System breaks down.
The cost of failure in our body's immune system is well known-we become vulnerable to maladies we might normally ignore. In a sense, our Risk Immune System works the same way: a weakened ability to detect and respond to risks carries a punishing cost. The chapters in Part 2 explain each Risk Control Factor in detail and call out some common symptoms of failures for each, and the final part of this book provides some proven solutions.
Beginning in late 2019, the COVID-19 pandemic offered a stunningly clear demonstration of the importance of the effectiveness of these factors in maintaining a healthy Risk Immune System. Faced with a virus that represented a fairly consistent threat across the globe, the relative success and failure of individual nations in dealing with it has spanned a wide spectrum. Even allowing for differing governance, wealth, and health-care systems, the gaps between the most and least effective nations-
measured in lives-is noteworthy.