Preparing for the Unpredictable
Few top corporate officials foresaw the advent of a pandemic, the onset of a war, and a crisis in the banking industry within five years. However, they have occurred, and each event revealed organizations that regarded risk management as little more than a compliance activity conducted yearly.
The traditional approach segregated risks into discrete groups such as financial, operational, legal, and reputational. Individuals responsible for managing the different risks communicated with executives independently. For example, when there was a supplier problem, it created a cash flow problem, a regulatory issue, and a public relations problem within a few days. Therefore, modern leadership examines relationships between risks rather than a list of risks.
Breaking the Silos
The journey of integration begins at the top. The Chief Risk Officer is today placed on a par with the CFO and CEO, while many are directly accountable to the chief executive officer. The board of directors forms a risk committee, and the directors themselves look at the same dashboards as the managers do. This allows the executives to have an integrated view of exposure and assess opportunities vis-a-vis risks before committing capital.
It is the culture rather than the structure that plays a pivotal role. The people who fear being punished will be hiding problems, and such problems can only grow. The firms that incentivize early warning signals, ensure whistle-blowing protection, and analyze narrowly avoided accidents will be able to spot problems earlier.
A Costly Lesson at Maersk
NotPetya ransomware attacked the Danish shipping company, A.P. Moller-Maersk, in June 2017. The malware interfered with the operations in the company’s container business and the company later put its costs from the event to be around $300 million. In an interview at the World Economic Forum in 2018, the Chairman of Maersk, Jim Hagemann Snabe, reported that the company was able to reinstall approximately 4,000 servers, 45,000 PCs, and 2,500 applications in just ten days.
Data and Technology
Data drives the field. Analysts input transaction histories, supply chain details, and news into algorithms that highlight anomalies in real time. Artificial intelligence checks for hidden risks in the terms and conditions of a contract, and scenario tools enable managers to gauge the impact of a port shutdown or currency fluctuation on bottom-line results. These systems enhance judgment but can never substitute for it.
Technology presents a risk. Outages, attacks, and faulty algorithms can do more damage to a company than conventional crises ever could. Companies routinely test their systems, maintain backups of important data outside the cloud, and rehearse the response process involving executives, not just IT people. Cyber resilience is now an integral business risk management process, not an IT challenge.
Emerging Threats
However, new risks continue to emerge. Climate events hamper production capabilities and logistics. Regulators require disclosures on sustainability and data privacy. Geopolitical risks alter business relations overnight, while activists question board decisions. Businesses, who look into the past year’s risks, will fail to see next year’s.
Firms, however, conduct horizon scanning. Small teams of employees scan the environment for weak signals from a local strike to an upcoming regulation and provide their reports to company executives on a monthly basis. Company executives can either hedge, diversify their suppliers, or accept the risks. Corporate risk management becomes valuable as it influences strategy making process.
Measuring What Matters
Many organizations continue to have problems quantifying their results. While heat maps and scoreboards in colors may seem appealing, they usually disguise any level of ambiguity. Good systems quantify exposure through dollars, determine limits for acceptable risks and monitor if managers adhere to those limits. By asking for these metrics, boards get better questions and honest answers.
Compensation issues need addressing too. As long as performance-based incentives are based solely on growth, managers will make decisions which are too risky for the organization. Modern compensation committees take into account risk-adjusted performance and regulatory compliance.
The Path Forward
Leaders who seek to make improvements may begin with four steps. The first is mapping potential risks that might impact the strategy, rather than compliance alone. Next is assigning ownership for each risk. This is followed by annual rehearsal of crisis responses. Finally, the results should be reported to the board in clear language. Corporate risk management works when leaders make it a regular practice.
The survivors will not have avoided all shocks. Instead, they will have seen them coming earlier, reacted quicker and learned more from them. Corporate risk management needs to be reimagined as the conversion of caution into advantage. The boards that do will be protecting shareholders, employees and customers.
