I recently attended a briefing on Risk Management organised by Criticaleye and led by Accenture. Participants included business leaders as well as several individuals who are effectively the Chief Risk Officers in their companies.  Effective risk management is not just a matter of compliance but done well is a source of competitive advantage. The world is not getting any easier to do business. All companies need to grow, therefore they need to innovate, and therefore they need to take risk. Accenture states that it is not possible to list the 'top ten‘' components of risk management because all businesses are different and need to evaluate risk in a specific way.  Indeed risk management can be an effective tool to drive the business agenda.

A good place to start is to look at current revenue and ask what you are doing to protect it.  Look back five years to assess the rate of change. It is a reasonable assumption that it will accelerate in the next five years. Then looking forward the critical time lines are to look at one year of programmed activity and three to five years of outline planning. The Board’s role is crucial in this and particularly the role of the Non-Executive Directors (NEDs). In assessing the profile of what makes a good NED it is a requirement first that they ask the right questions, not the obvious and easy ones. It is secondary that they have the appropriate skills, industry experience and business understanding.

60% of businesses now employ a designated Chief Risk Officer (CRO), while 95% have a dedicated senior executive though not all give them the title of CRO. In the recent past these executives have moved out from under the supervision of the CFO, but still tend to follow economic problems. There is risk in this approach and it is better that risk management is operational, fully embedded in remuneration schemes and so on.

In looking at risk management the tendency is to prepare a list of external dangers, many of which are outside the management’s control but in my experience, backed up by many in the group, bigger dangers can come from the inside. One CRO thought that this was led by director behaviour and he spent much of his time watching for the marketing director going off piste.  The board structure is again an important factor here as the biggest risk of all is inertia leading to inactivity.

A board should assess and articulate its level of risk appetite. In general this is now more active, measurable, demonstrable and used in the organisation. But the malaise in the western economy is largely a function of reduced risk appetite with boards sitting on cash concerned about macroeconomic trends and gross political mismanagement. A board should look at business continuity on a regular basis and keep up to date a matrix of its risk reward ratios. NEDs should check the company’s processes for managing operational risk while taking time out to assess strategic risk.

I observed that some risks are certain but the question is one of time. When I went to Chile in 1981 to found a marketing company for Mars Inc., its first marketing company in South America, the business was largely based on the Chilean government’s policy of fixing the exchange rate of the peso at 39 to the dollar. This allowed Chile to squeeze out inflation and force local manufacturers to raise standards to compete with international manufacturers like us. The policy worked well for a while and our business thrived but looking back it was inevitable that at some stage the pressures would become too great and Chile would be forced to devalue. This came without warning in June 1982 just weeks after the Chilean Finance Minister had told me that I should continue to borrow dollars. The exchange rate collapsed and moved quickly to 90 pesos to the dollar. Chile went into the seventh deepest depression in modern world history and as an importer I could not continue.

The risk of this happening was 100%. It was just a question of when. Similarly when the stock exchange boomed on the back of a technology bubble in the late 1990s it was certain that the bubble would burst. The dot.com businesses that made no money and just burnt cash would obviously go bust. The question was when. If you were a fund manager in that space it would be very difficult to hold your nerve and bet against the crowd because for a year or two you would fall well behind your benchmark and might lose your job. But in time you would be proved right.

Risks should be weighted. Geographies should be prioritised. Risk should be seen both as a matter of offence as well as defence to use the sporting metaphor. There are various models in calibrating risk. Black & Scholes won the Nobel Prize for Economics in 1997 for their mathematical model that sought to eliminate risk in derivatives trading but many banks and hedge funds following it then lost a fortune (1). Big Pharma use an options model because of the huge bets over long periods of time they have to make in developing the next block-buster drug. The Donald Rumsfeld conundrum of ‘knowns and unknowns’ is probably as good as any.

The banking crises have led to a volume of regulatory pressure that is taking away from effective risk management. Indeed, while not justifying the excessive bonus culture, banks are now concerned about the increased risk of employee fraud because these bonuses have been curtailed.  Another Nobel Prize winner in Economics is Daniel Kahneman whose book Thinking, Fast and Slow (2) summarises research that he has conducted over decades. He points out a dichotomy between two modes of thought: System 1 is fast, instinctive and emotional; System 2 is slower, more deliberative and more logical. Kahneman’s research has uncovered cognitive biases associated with each type of thinking suggesting that we place too much confidence in human judgement. Humans are more likely to avoid loss than to achieve a gain. You can see that by the way the banks are getting away with paying almost no interest at a time of 3% inflation and yet savers leave their money in the bank thus losing money in real terms.

The World Economic Forum pulls together data on risks in the Supply Chain. Events like floods in Thailand and tsunamis in Japan have shown global manufacturers that if everyone relies on the same fall back options there is not enough redundancy in the supply chain to maintain continuity of supply with devastating effects on business. There is now much greater focus on resilience in the supply chain. It is not economic to gold-plate this but good practice is to identify critical components and ensure sufficient back up options. The World Economic Forum has set up a Risk Response Network which meets quarterly and shares information regarding so-called ‘Super Risks’. At the time of the tsunami a particularly large crane was required to deal with the stricken nuclear reactor but none could be found. It turned out they were all in Dubai.

More sophisticated communications are being deployed in the supply chain. After decades of reducing inventory to reduce working capital and improve balance sheets the real cost of this is finally being understood. After decades of moving manufacturing offshore thus lengthening supply chains and opening them up to a cocktail of global risks including piracy, terrorism, economic dislocation and natural disasters the process of ‘onshoring’ has begun. The Deepwater Horizon oil spill, considered the largest in history, had many unforeseen consequences. For example, beer distributors could not get their beer through Louisiana ports thus losing sales. 

Associated with this is the reputation risk of supply chain transparency. After Greenpeace identified toxins in the Zara supply chain the clothes retailer received 450,000 hits on its website in nine days and was forced into submitting to Greenpeace demands. This leads to the identification of a new level of risk. The power of the internet combined with social media allows corporate failings to be magnified. When Starbucks was put in the public stocks for the perfectly legal but morally suspect avoidance of paying UK tax it would appear that UK customers voted with their feet, at least to some extent, and locally domiciled rival Costa put out an upbeat trading statement. Tesco are still getting over the discovery of horsemeat DNA in its ‘Basic’ Lasagne. The Chairman of a major department store chain was quoted as saying "A bad season in Ladies' Wear can destroy a CEO. A loss of trust can destroy a business.”

In conclusion some questions to ponder:

1. How will your business evolve as Digital truly becomes an enabler?
2. How are you going to cope with Big Data?
3. When will the risk crystallise?

And finally, not a question but a warning, all actions and inactions have risk.

(1)   Strictly speaking Scholes had died by this time so was  ineligible for the prize which was awarded to Black, but Scholes’ work was credited.
(2) Thinking, Fast and Slow Daniel Kahneman, Macmillan, 2011

Copyright David C Pearson 2013 All rights reserved