I have been struck by all of the Titanic centenary memorials and programmes, much like the ship itself, out of my compartmentalised risk management thinking. It is not man’s natural state to risk manage, but have we really progressed so little that scenes from the Costa Concordia in 2012 could be quite happily spliced into footage of the Titanic film relating to 1912? Would I, if they had had internal audit in 1910-14 have raised the question about lifeboats and an effective ‘plan B’ if I were White Star or Harland and Woolff’s auditors?

Well I could do the internal auditor’s ‘told you so dance’ (one of the few and secret pleasures an internal auditor can take when clients do not act on advice), but this is not helpful. I would far rather see companies, organisations and leaders take a more risk managed approach to life and their businesses.

In most risk modelling an element of cost benefit is used. The auditor-perfect world will never be built as it is not cost-effective or competitive to do so. Indeed one could, coldly, take a view that the White Star Line and Harland and Woolff have not been killed off by Titanic. The White Star line was finally taken down by the Great Depression and the moving on of air travel and other technology, not Titanic. Harland and Woolff remain to this day. So their risk management was effective.

So is Titanic a lesson in better risk management? By today’s standards probably not. It is also a lesson for all risk managers in the overstated risk of repetitional damage though. I think it is much more a lesson in moral and ethical standards. Should it be ethical to put individuals in so much danger? After all ice was a reasonable risk at the time, indeed Titanic was warned on April 14th of ice in its path, the message never got to the bridge. Could two men looking into the dark be a reasonable risk mitigation strategy?

I think risk management must have an ethical dimension. When we read that 264 men were injured and 8 died in the construction of Titanic, we rightly, in the West, argue that things have moved on in the last century. Yet have they? We hear about the 1,000s of Chinese workers killed in industrial accidents each year and Apple’s factory suicide nets. Bankers’ decisions to effectively decide they are too big to fail and to make (the right as it turns out) commercial decision to anticipate the taxpayer to bail them out, strike an amoral and perhaps not within the spirit of company law, approach to risk taking and management. Perhaps risk management driven by purely commercial, business, factors is wrong. Risk management is moral and not just business risk.

Thus internal audit should not just be looking at narrow, compartmentalised, business risk but should be considering the ‘rightness’ of risks taken. Most boards I have met in my career are populated by individuals who want to do good and the best for the organisation and the normally, moral objectives of the organisations they serve. Perhaps it is the role of internal audit to push this agenda more.

When you see, hear and read about the lives and communities still affected by one ship sinking 100 years ago, the imperative to get better at managing the community and moral obligations within a lower risk appetite rather than pure commercial considerations becomes apparent. Perhaps this is the true lesson of risk management from the RMS Titanic at the bottom of the Atlantic?