Manage Risk — Make Money

Download PDF Version

Historically, risk management has been all about minimizing losses; however today’s leading companies are seeing effective risk management as a strategy for sustaining profitable growth and hence an integral part of their corporate performance management (CPM) process. So what are the implications for your performance management practices?

Uncertainty, volatility, and unpredictability have come to characterize the environment in which all organizations now operate. As we have seen in earlier papers in this series many managers understand the futility of trying to plan out future performance in great detail; changes occur with such frequency and velocity that static annual plans simply cannot hope to plot a course that remains valid for more than a few weeks. But what is the alternative? Many managers are turning to risk-based planning techniques as they seek to adapt to ever more volatile and uncertain markets.

The first step is to recognize that simply ignoring risk does not make it go away. In fact, the elimination of risk is not the objective. Risk-taking is fundamental to a company’s ability to create value. Investments in new products, research into new technologies, acquisitions and divestitures, or the redesign of core business processes all incur risk; those organizations that can manage these risks for profit emerge as leaders. Consider Best Buy’s rise to dominance in the historically fragmented field of consumer electronics retailing, Nike’s evolution into a global sports brand, and American Express’ ability to grow share in the intensely competitive credit card business. Each of these companies took calculated, data driven decisions to embrace risk as a means for securing a vital advantage in the marketplace. Together with other leaders these organizations are seeking to derive greater insight into both the positive and the negative impact of risk on future performance.

Companies should look to their Corporate Performance Management (CPM) systems as vehicles for identifying, monitoring, and managing risks as part of an integrated performance management process. Increasingly, success is being defined by those organizations that can anticipate and react best to changes in the marketplace, therefore those that can harness the relevant data and derive insight that supports timely decision making will have a distinct advantage. Two forces are combining to accelerate the adoption of more dynamic, risk aware performance management practices. First the ripple effect of unpredictable one-time events is becoming greatly magnified as the global economy becomes more tightly integrated. Second the continuing pace of technological change is accelerating the rate at which new trends become material (Exhibit 1).

No More Excuses

Managers have historically used the negative impact of one-time events that are outside of their control as excuses for shortfalls in performance, and that trend continues to this day. Numerous companies cited the impact of 9/11, Hurricane Katrina, or the Asian tsunami as explanations of poor results; however we are seeing a significant change in how these excuses are being viewed by investors and other stakeholders. Instead of giving management a free pass for the impact of such events, many observers are looking at how an organization responds to such challenges. Those that handle adversity the best can command a premium relative to their excuse-giving peers. An excellent example of this was the stellar performance of Southwest Airlines in the months after 9/11, in stark contrast to peers such as United, US Airways, Northwest, and Delta, which all filed for Chapter 11 bankruptcy protection. The degree of interdependence among companies, markets, and economies, combined with the increasing speed of communications, is accelerating the pace at which trends move from emerging and interesting to established and dominant. For managers trying to preserve leadership positions in fast-changing markets or establish leadership positions in new markets, the need for adaptability, speed, and not a little luck is clear. Of the over 7,400 companies that have gone public since 1980, 25 percent have gone out of business—and no, they were not all dot-coms.

Threat of Irrelevance

Perhaps the biggest risk organizations face, and also one of the least understood, is the threat of becoming irrelevant to one’s customers. From the days of the oft-cited buggy whip manufacturers whose whole business became irrelevant upon the introduction of the automobile, companies have been exposed to the risk that customers simply no longer want, need, or value their goods and services. The economic landscape is littered with the relics of once-mighty companies that lost a vital connection with their customers. Building intelligence into an organization’s performance management processes to assess the continued relevance of products and services is crucial if an organization is to identify and respond to the threat adequately. Measuring the risk of irrelevance first demands that an organization understands its attraction to customers. For example, how relevant would H & R Block be if the United States introduced a flat tax with no deductions; Exxon Mobil if non–oil-powered vehicles and sources of electricity predominate; Starbucks if caffeine were found to cancerous; or Netflix if (when?) broadband video on demand becomes ubiquitous? After all, it is not that long ago that Wang, Woolworth, AT&T (the old one, not the reincarnation), Pan Am, the American textile industry, the British mining industry, and network television dominated their respective markets. Exhibit 2 highlights just some of the drivers of change that can heighten the risk irrelevance.

What is Effective Risk Management?

Historically risk has been defined narrowly as the measurement and management of financial risk. Market price, interest rate, credit, and exchange rate risks dominated management’s attention and are well understood, if not always managed effectively. Such a narrow view is no longer sufficient. The impact of specific risk factors, from the stability of global supply chains to the threat of attack from special interest groups, represents just some of the increasing portfolio of potential risks that can impact performance.

Integrating an effective risk management capability into the performance management process requires that an organization is able to:

• Identify the risks to which the organization is exposed
• Quantify the materiality and probability of occurrence
• Determine the need for mitigating strategies to be developed
• Develop appropriate mitigation plans
• Drive timely decision making
• Monitor execution and results

A systematic approach starts with the routine review of many factors that are not typically addressed by traditional planning, budgeting, and reporting processes, such as: the quality of the corporate governance, employee management, and customer management processes; the company’s use of technology and its business interruption plans; the deployment of best practices; the sensitivity of the company’s products to technological obsolescence; the adequacy of contingency plans against possible pandemics (e.g. SARS, avian flu); and the degree to which the company is subject to attack from special interest groups.

A Framework for Measurement and Management

It is no coincidence that many of the companies that have established leadership positions in their markets are also those that have most effectively harnessed the power of technology to turn operational information into insight. Wal-Mart tracks the flow of products through its stores to ensure that shelves are never empty; Toyota dynamically adjusts its production schedule based on the flow of orders for different vehicles.

Risk measurement must to be objective, fact-based, and consistent to ensure comparability and credibility. The aim is to identify and quantify major trends and assess the degree of exposure. These insights are typically assembled by planning, finance or, if the company has established one, the risk management team. In many companies the emerging role of chief risk officer (CRO) is charged with developing a comprehensive understanding of the overall risk profile. The CRO serves as the eyes of the corporation, externally as well as internally, scanning the outside world and the organization for threats and opportunities.

The start point for developing an effective risk management framework is to understand the level of business risk—and hence future financial risk—to which an organization is exposed. An organization must fully leverage many of the tools it has become accustomed to using in recent years, such as contingency planning, market and competitive intelligence, scenario planning and data mining—but with a new focus and discipline. Many components of this approach exist today. The challenge is that much of the information is assembled in an ad hoc manner, and there is no unifying process to provide a complete organizational risk profile. Moving from an ad hoc and largely subjective process to a systematic, fact-based measurement system is the goal. Exhibit 3 identifies some of the factors that should be considered in developing an organization’s risk profile.

New technologies that enable the aggregation and organization of data are at the core of an effective process. Companies must look beyond the data in their enterprise resource planning (ERP) or general ledger systems, key insights about markets, customers and competitors need to be aggregated together with rich internal intelligence in order to make balanced judgments about risk.

Having assembled a sound base of data, business risk measures can be built into the target-setting process that guides planning; however, companies should continuously evaluate the relevance of each measure over time, as the indicators themselves are subject to the same forces that increase or diminish the importance of the factors they measure. Not that long ago, phone companies touted the quality and availability of their dial tone as a competitive feature; banks, their ATM network coverage; and car makers offered antilock brakes and side airbags as options. Now all are competitive necessities and have little value as measures of differentiated service.

The Payoff

The value of building a systematic data collection and analysis framework for monitoring organizational risk goes beyond the one time assessment of risk. Over time a set of risk factors will emerge that requires ongoing monitoring. These leading indicators can be programmed into the organization’s performance management system to provide early warning as a prompt for management action.

Understanding an organization’s risk profile allows stakeholders to better answer key questions such as:

• Does the company’s chosen business model and execution capability support the financial results and targets?
• How well positioned is the company to respond to emerging trends—both opportunities and threats?
• Does an organization’s strategy effectively recognize the varying types of risk it will encounter, and is management taking adequate steps to ensure that the appropriate skills are available?
• Does management make effective and timely decisions based on the insights gleaned from its risk management processes?
• Board members also benefit from an increased understanding of an organization’s risk profile. In addition to exercising fiscal stewardship over the companies on whose boards they serve, directors must also seek assurance that the organizations’ management processes are effective in capitalizing on new opportunities, while assuring an acceptable level of risk and control.

Ultimately the payoff from a risk aware set of performance management practices is the ability to seize opportunities and mitigate threats with speed and confidence; consistent execution drives growth in both the quality and predictability of earnings and in the creation of shareholder value.

About The Author
David Axson is an author and consultant. A former co-founder of The Hackett Group and Head of Corporate Planning at Bank of America he is a highly regarded public speaker. His most recent book is Best Practices in Planning and Performance Management (Wiley 2007).

Back to Top