Are Hot-Risks Simply Red Herrings?
Adding Clarity to the Debate on Risk
By
Hugh Goldie
Associate, The Exchange Group
Is everything we call a risk, actually a risk? Is everything we chase in the name of risk management worth chasing? The answer depends on whether your board is content to simply talk about risk or whether it wants to actively manage its bets.
Talk about risk became popular following the demise of Enron. It became big news following the collapse of Lehman Bros. and the emergence of our present recession. Recent talk about risk has initiated an alternative approach to risk and risk management that is simple and easily understood. In reality, it is misleading and dangerous.
Prior to its emergence as big news, “risk management” was a generic concept that lacked much appeal beyond a few professionals. It was hard to visualize and difficult to communicate. The standard definition of “risk” says it all:
A risk is an event or situation that could impact (compromise or enhance) our ability to achieve an objective.[i]
The 2008 bank failures in the U.S. and elsewhere piqued public interest about risk and the failures of risk management. Those who thrive on hot topics and headlines latched onto the use of “hot-risk” labels to stoke the discussion. As a result, “hot-risks” are news. Terms like reputation risk, compensation risk and the catastrophic Black Swan event[ii] create pictures of dangerous situations that are easily understood by the public and require little explanation.
Risk labels have been a boon for the general media, financial commentators and some consultants. The more risks they can identify, the more they have to talk about. Now, it seems that everything we do has a risk label attached to it. In a paper about pension plan management, the authors identified 54 different types of risk.
But risk labels have three serious downsides. Misdirecting risk management efforts is one. Risk labels direct our focus to the “back end” of the problem rather than the “front end”. Reputation risk is a good example. While the label “reputation risk” seems logical, threats to reputation are not a risk. They are a secondary impact, activated only when a risk event or situation has occurred. It is more prudent, and far less costly, to avoid the risk situations or events that could cause threats to reputation.
Yes, preparations to manage possible threats to reputation are important. The makers of Tylenol, the producers of Maple Leaf foods and TV host David Letterman demonstrated that good management can minimize their impact. In the Maple Leaf case, it is known that listeria bacteria consumed in processed meat can cause illness or death - and threaten the meat processor’s reputation. The real culprit, the real risk to be managed, is the possibility of bacteria collecting in the processing equipment.
Commoditization of risk is a second downside. When everything is a risk, then nothing is a risk. Risks become freestanding entities and risk checklists abound. When boards are constantly called upon to deal with a litany of risks like IT risk, reputation risk, litigation risk or fraud risk, they lose their sensitivity to risk. Boards intuitively know that everything is not a “red light” issue.
But boards are subject to fear. The commentary around hot-risk topics creates fear, the third downside. It discourages the prudent risk taking that is at the very centre of innovation, change and healthy growth. Peter L. Bernstein, the recently deceased guru of risk management,[iii] emphasized that “Risk doesn’t mean danger. It simply means not knowing for certain what the future holds.” Events we encounter as we execute our plan could cause the outcome of our bet to be better than we expected, or to be worse.
Richard L. Thompson, Chair of Lennox International, comments that, “The secret of success lies not in avoiding risk but in managing risk; avoiding ‘bet-the-company’ types of uncertainties, developing contingency plans for identified risks in the event they materialize and closely monitoring progress in order to respond quickly if the ‘bet’ is threatened.” [iv]
Start at the Front End
Bernstein zeroed-in on the critical starting point for risk management. Risk does not come into play until, “... we place a bet on an outcome that will result from a decision we have made.” In deciding to make our bet, we initiate a process to achieve that outcome. We cannot be certain about our success in predicting our future because the activities we use to arrive at our decisions and execute our plans are imperfect.
These imperfections were first catalogued by Frank H Knight as follows:[v]
1. We cannot accurately judge the totality of our present situation;
2. We cannot assess how the future will unfold with any degree of dependability;
3. We cannot accurately predict the consequences of our own actions;
4. We rarely execute our plan in the precise form in which it was made; and
5. We cannot accurately know or predict the actions of others who could impact our plan.
To that list we add an observation from recent research by Kahneman & Tversky:[vi]
6. We cannot be sure that we will recognize, or take advantage of, the upside opportunities that will occur as we execute our plan because we are hard-wired to be more concerned about imagined loss than potential gain.
Knight segmented generic risk into two categories, “measurable risk” and “uncertainty”. He saw “measurable risk” as being quantifiable using probability theory and available data. For example, computer models are built to quantify, hedge, and predict the future values of pension plans and investment portfolios. He saw “uncertainty” as being unquantifiable, resulting from unique situations for which no data are available for analysis.
The Generic Risks are Few
The fundamental downside risks are few, not many. They apply to all bets.
1. Failure to be detailed and disciplined in the examination of the cause and affect relationships that form our current reality and trigger our decision to proceed. Some of those relationships are specific to our business. Many are generic, common to business in general. As a bonus, when we understand our current reality at its most fundamental level, our options for future action are also clarified.
2. Failure to create a detailed execution plan that includes the inevitable downside risks and upside opportunities, to guide our decision-making.
3. Sloppy execution of the plan by individuals who are unfamiliar with its details or insufficiently committed to its objectives.
4. Failure to monitor progress against the plan. “Don’t expect what you don’t inspect.”
5. Failure to act quickly when the objective is threatened.
The Board’s Bets
Boards do not develop plans or execute them. But when directors approve their CEO’s plans, they place a bet. Boards make the most critical bets of all. They bet on a CEO, they bet on a strategic plan, they bet on a management team, they bet on an executive compensation scheme, they bet on a group of board colleagues and they bet on management’s financial statements, to cite some of the key bets. Using Knight’s definitions, these are all uncertainties that prudence demands be managed. That implies gathering information to demonstrate whether:
· The management team is committed to the project, has taken a disciplined and detailed look at the current reality surrounding its proposal and has developed a reasonable approach to strategic deployment.
· The execution strategy and plans consider upside opportunities as well as the downside risks and have the capacity to respond to both.
· The execution team is familiar with the plan and committed to its objectives.
· Progress against the plan will be monitored and routinely reported to the board.
· If the project goes off the rails, management has the capacity to respond appropriately.
Boards Manage “Uncertainty”; Management Manages “Measurable Risk”;
Many argue that boards do not manage risk; rather, they oversee management’s risk-management activity. That argument is correct, given the understanding that the board develops its own processes that are appropriate for managing uncertainty. These processes are known; CEO evaluation, compensation reviews, board evaluations are some that boards use. These processes and the boards that use them must adapt to managing uncertainty if they are to adequately respond to widespread demands for improved management of their bets.
An earlier article in Director [vii] referred to one process for managing uncertainty, namely three steps for engaging management and the board in strategy development. The three steps, Educate, Engage, and Refresh, provide the board with a vehicle to gather the required information and remain informed of both progress and problems with the strategic plan.
Managing uncertainty is a forward-looking, intuitive process done by a human brain on the basis of an individual’s knowledge, imagination, capacity for solving complex problems, tolerance for ambiguity, ability to see the bigger picture and ability to learn from previous experiences. Managing uncertainty requires objective thinking with an open mind in order to see possible trends, patterns and relationships which may not be readily apparent in any documentation. These are the attributes of skilled directors, not computers. They are the reason why a skilled, experienced and balanced board is critically important.
Mr. Goldie can be reached at (204) 947-7129 or hugh.goldie@exg.ca .
[i] Conference Board Report, R1398-07-WG, Emerging Governance Problems in Enterprise Risk Management. This report uses the following definition for risk taken from COSO, “The possibility that an event will occur and adversely affect the achievement of objectives.” We find this definition too narrow and believe that Peter Bernstein would have agreed since it did not consider upside opportunity.
[ii] Taleb, Nassim Nicholas (2007). The Black Swan: The Impact of the Highly Improbable. New York: Random House
[iii] Peter L Bernstein, Against the Gods, John Wiley and Sons, Inc. 1996
[iv] Personal communication, 2009.
[v] Frank H. Knight, Risk, Uncertainty and Profit, Hart, Schaffner and Marx; Houghton Mifflin Co., 1921
[vi] Kahneman, Daniel and Amos Tversky, 1979, “Prospect Theory: An Analysis of Decision Under Risk.” Econometrica, vol. 47, No. 2, pp 263-291
[vii] “Learning from the crisis: How the board’s role in strategy fulfills a risk management responsibility”, Goldie, Smith, and Stephenson, Director, 2009
