Cognitive Biases in Risk Assessment

Due diligence, compliance reviews and investigations today draw on more information than ever before: registry extracts, transaction data, media reports, sanctions lists. Yet every piece of that information has to be weighed, classified and interpreted by people. That is precisely where errors arise – not in the data, but in perception. Behavioural research calls these systematic errors in thinking cognitive biases. They are not a sign of incompetence. They affect experienced analysts as much as board members and lawyers, often more so, because experience encourages mental shortcuts.

Why risk assessment is particularly vulnerable

Risk assessment almost always takes place under conditions that favour bias: incomplete information, time pressure and an expectation that is already in the room. A client wants to close a transaction. A business partner appears reputable. A suspicion has already been voiced internally. In each of these cases, the analysis does not start from a neutral position but with a predetermined direction. On top of that, risks are rarely clear-cut. They show up in patterns, gaps and contradictions. Where clarity is missing, the brain fills the blanks with assumptions.

Five biases most common in practice

Confirmation bias

Anyone holding a hypothesis looks for evidence that supports it and overlooks evidence against it. In due diligence, a positive first impression leads to red flags being dismissed as exceptions. Conversely, an existing suspicion appears to be confirmed by every new piece of information.

Anchoring

The first figure, the first assessment or the first source shapes every judgement that follows. If a client signals low risk at the outset, the assessment often stays close to that anchor, even when later findings point to a different picture.

Availability heuristic

Risks that are prominent in the media or recently experienced are overestimated; less visible risks are underestimated. A sanctions case in the news draws attention, while complex ownership structures in third countries go unnoticed.

Halo effect

A single positive attribute outshines the overall picture. A renowned bank as a business partner, a prominent supervisory board member, a polished website: none of this says much about a company’s actual integrity, yet all of it significantly influences the assessment.

Overconfidence

Experienced decision-makers tend to overestimate the accuracy of their own judgements. The more routine a process becomes, the greater the risk that deviations go unnoticed.

A recent lesson: the Wirecard case

Wirecard shows how strongly biases can shape a judgement. In 2018, the payment processor joined the DAX, Germany’s blue-chip stock index. In June 2020, it filed for insolvency. Around EUR 1.9 billion reported on its balance sheet did not exist. The warning signs had been there for years: short-seller reports, investigations by the Financial Times, unusual business conducted through third-party partners in Asia. But the halo effect prevailed: a DAX listing, unqualified audit opinions from a Big Four firm, a reputation as Germany’s technology showcase. In 2019, Germany’s financial regulator even banned short-selling of the stock and filed a criminal complaint against journalists instead of scrutinising the company. The case illustrates what applies to every risk assessment: reputation is not proof. An audit opinion is not proof. Anyone who judges warning signs solely by the credibility of the messenger overlooks what the information itself is saying.

What helps against bias

Biases cannot be switched off. But method and process can contain them. Intelligence services have relied on structured analytic techniques for decades.

Test competing hypotheses. Instead of confirming a single assumption, several explanations are assessed in parallel. What matters is which information disproves a hypothesis, not which supports it.
Assess sources separately. The reliability of a source and the credibility of a piece of information are evaluated independently. This prevents a reputable sender from lending weight to weak information.
Run a pre-mortem. Before a decision is made, the team assumes it has turned out to be wrong and then looks specifically for the reasons. This perspective brings overlooked risks to light.
Institutionalise dissent. A person or team is explicitly tasked with challenging the prevailing assessment. Disagreement becomes a task rather than a disruption.
Document the assessment. Recording the basis on which a judgement was made allows it to be reviewed later. Documentation makes assumptions visible, and therefore open to challenge.

Conclusion: method over gut feeling

The greatest weakness in a risk assessment is rarely the data. It is the unnoticed direction a judgement has already taken before the analysis begins. Assessing risk reliably therefore requires more than access to information. It requires a process that systematically questions one’s own perception. Only when information is verified, connected and placed in the right context does the actual situation emerge.

True Realities begin where assumptions end.