What if the Risk Manager is Malevolent?

Risk is a fundamental aspect of human endeavors, and risk managers serve an indispensable role within organizations and society. Risk managers engage in identification, assessment, communication, and control of numerous types of risks. These activities support decision-making about the relative benefits and risks of various courses of action in the pursuit of organizational or societal objectives. Risk managers, in their role as advisors on topics that potentially could result in negative outcomes, play an important part in risk-based decision-making. This perspective paper explores the situation in which the risk manager is not a neutral provider of risk-related information but rather is actively malevolent, seeking to cause losses and mayhem by intentionally weaponizing the risk management process itself. We discuss the general role of the risk manager as well as how malevolence can manifest itself within a risk management context. Two brief vignettes on flood risk management and financial portfolio management are given to illustrate the potential impacts of a malevolent risk manager. Finally, we offer some potential countermeasures, attempting to answer the question, "Who manages the risks of the risk managers?"