A new framework for managing risk

By Professor Robert Kaplan

Despite all the rhetoric and money invested in it, risk management is too often treated as a compliance issue that can be solved by drawing up lots of rules and making sure that all employees follow them.  Many such rules, of course, are sensible and do reduce some risks that could severely damage a company. But rules-based risk management will not diminish either the likelihood, or the impact, of a disaster, just as it did not prevent the failure of many financial institutions during the 2007-2008 credit crisis.

So which risks can be managed through a rules-based model and which require alternative approaches?

The first step in creating an effective risk-management system is to understand the qualitative distinctions among the types of risks that organisations face. According to our research, risks fall into one of three categories: preventable risks, strategy risks and external risks.

Preventable risks

Preventable risks are internal risks which are controllable and ought to be eliminated or avoided. Examples include employees’ or managers’ unauthorised, illegal, unethical, incorrect or inappropriate actions and the risks from breakdowns in routine operational process. While companies should have a zone of tolerance for defects or errors that would not cause severe damage and for which achieving complete avoidance would be too costly, in general, companies should seek to eliminate these risks as they get no strategic benefit from taking them on.

This risk category is best managed through active prevention: monitoring operational processes, guiding people’s behaviours and decisions toward desired norms, clear statements of codes of conduct, internal control systems, and a strong, independent internal audit department.

Strategy risks

A company voluntarily accepts some risk in order to generate superior returns from its strategy. A strategy with high expected returns generally requires the company to take on significant risks, and managing those risks is a key driver in capturing the potential gains.

Strategy risks cannot be managed through a rules-based control model. Instead, a risk-management system must be designed to reduce the probability that the assumed risks actually materialise and to improve the company’s ability to manage or contain the risks events should they occur. There are three distinct approaches to managing strategy risks: independent experts, facilitators, and embedded experts.

These risk-management approaches enable companies to take on higher-risk, higher-reward ventures than their competitors with less effective risk management.

External risks

Some risks arise from events outside the company and are beyond its influence or control. Sources of these risks include natural and political disasters and major macroeconomic shifts.

As external risks cannot be prevented, their management must focus on identification and mitigation. There are various tools which can be used by companies to identify their external risks, including stress tests, scenario planning and war-gaming.

Stress-testing helps companies to assess major changes in one or two specific variables whose effects would be major and immediate, although the exact timing is not forecastable.

Scenario planning is suited for long-range analysis – typically five to ten years out. Scenario analysis is a systematic process for defining the plausible boundaries of future states of the world. Participants examine political, economic, technological, social, regulatory and environmental forces, and select a number of drivers – typically four – that would have the biggest impact on the company.

War-gaming assesses a firm’s vulnerability to disruptive technologies or changes in competitors’ strategies. In a war-game, the company assigns three or four teams the task of devising plausible near-term strategies or actions that existing or potential competitors might adopt during the next one or two years – a shorter time horizon than that of scenario analysis.

While companies have no influence over the likelihood of risk events identified through these methods, managers can take specific actions to mitigate their impact. Since moral hazard does not arise for non-preventable events, companies can use insurance or hedging to mitigate some risks, or make investments now to avoid higher costs later.

Organisational biases

Identifying and managing strategy and external risks requires an approach based on open and explicit risk discussions. That, however, is easier said than done. Extensive behavioural and organisational research has shown that individuals have strong cognitive biases that discourage them from thinking about and discussing risk until it is too late.

Individually, people overestimate their ability to influence events and tend to be over-confident about the accuracy of their forecasts and risk assessments. As organisational biases also inhibit our ability to discuss risk and failure, these collective inclinations explain why so many companies overlook or misread ambiguous threats.

Risk management is non-intuitive; it runs counter to many individual and organisational biases. Active and cost-effective risk management requires managers to think systematically about the multiple categories of risks they face so that they can institute appropriate processes for each. These processes will neutralise their managerial bias of seeing the world as they would like it to be, rather than as it actually is or could possibly become.

Professor Robert Kaplan: Marvin Bower Professor of Leadership Development Emeritus at the Harvard Business School.

7 GREAT Reasons to Balance your Balanced Scorecard

Descartes said “I think therefore I am”.  De Bono says “I do therefore I matter”.   Whether we call it strategy execution or service delivery the fact remains that here in South Africa we rank high on the thinking stakes, and low on the implementation scales.

What is it about execution that ails us so much? Moreover, what can we do about it?  One solution is the introduction of a Balanced Scorecard. Yet a Scorecard of any fashion needs to work for you, and be relevant to your business to achieve the results you desire.  It is more than an academic exercise, but rather needs to provide leaders and managers with a snapshot of the business, one that enables better risk management and improved decision making.

According to Dr. Bob Frost, a Performance Measurement expert, there are 7 GOOD REASONS WHY YOU NEED TO USE A SCORECARD EFFECTIVELY:

  1. Scorecards drive better performance.  According to Frost, “feedback enhances performance”. Being able to review your progress towards a goal, drives people (teams and groups) to higher levels of performance.
  1. Scorecards translate your strategy. Translating the big picture strategy into tangible concreate steps and metrics is key for any strategy implimentaton.  Your scorecard needs to enable people to move, change direction and implement your thinking faster than your competition. 
  1. Scorecards help ensure you have the right measures.  “Effective performance scorecards are, by nature, consciously and purposefully constructed. In building one, you develop a logical structure that helps everyone know what should be measured, what belongs on the scorecard and what does not belong.”  What gets measured gets done, and its critical that you measure the right things as metrics alone are not enough.  WHAT is measured must also be at forefront of your scorecard thinking.
  1. Scorecards encourage balanced performance.  “The proper scorecard design keeps the right balance of operational and strategic factors on your radar screen.”  Balancing business as usual with strategic activity will ensure that you have the right balance of focus for success.  An over emphasis on any one strategy may result in a loss of opportunity somewhere else. Your Scorecard activities need to remain in balance, ensuring that all the key elements of success are considered when planning the detailed activities. 
  1. Scorecards point out what’s missing.  “The scorecard will help you see if any key factors are missing—the gaps stand out.”  If you don’t have a sound model on which to base your thinking, then it’s highly possible that something will get missed out.  Introducing the Balanced Scorecard should go beyond the obvious measures and also seek to highlight the gaps, what’s missing and what needs to be done to fill those gaps.    
  1. Scorecards encourage GREAT management.  Great management is about monitoring performance.  Leadership takes risks, management mitigates them.  For sound corporate management to be in place, a thorough monitoring system needs to be introduced.  The Balanced Scorecard is a way of providing management with the appropriate information to enable them to make decisions and manage risk more effectively.
  1. Scorecards communicate – they tell the story.  A view favoured by investors and analysts, a full scorecard tell a full story.  According to Frost the scorecard enables you to “present a compelling picture of performance that is undistorted by focus on an individual issue.”  This ensures that reports do not allow us to be easily ‘distracted’ by one problem and potentially lose sight of the others that require attention.

Organisations, governments, NGO’s and institutions around the world have successfully introduced the Balanced Scorecard to assist them in delivery results to shareholders and stakeholders, ultimately demonstrating how strategic thinking gets translated into business results.  Developed by Harvard Professor, Robert Kaplan and Dr. Dave Norton, the Balanced Scorecard is widely considered as the definitive model for translating strategy into action. 

Prof. Robert Kaplan will be presenting LIVE in South Africa on 17 September 2015, delivering his world renowned lecture on Strategy Execution.  Hosted by Business Results Group, this one-day event promises to provide you with the tools, strategies and techniques to ensure that you continue to get the most out of YOUR Balanced Scorecard.  Book Now //www.brg.co.za/speakers/prof-robert-kaplan/


Are You Suffering From Initiative Overload?

Most likely, yes! Companies here in South Africa and around the world are routinely spending hundreds of millions (insert your currency) on initiatives that are seldom integrated and strip away valuable time and focus from your existing resources. Not only that, but the result and impact of those initiatives are often hard to quantify. What is the real value delivered?

Special projects and initiatives often put additional strain on company resources and take valuable time away from day-to-day operations. Ask any manager or leader in a business what wastes their time and you’ll be sure to get three common answers;

  1. too many initiatives and
  2. too many meetings (most of them of course about the initiatives) and
  3. slow decision making. According to Harvard Professor Robert Kaplan, companies introduce an “abundance of projects [that] compete for limited resources including: Human Capital, IT and Financial”.

Sorry guys, but you appear to be the main culprits and while your projects may provide useful support services to the group, the value of those projects remains hard to quantify in other parts of the business.

Why? According to Kaplan there is “no integrated view across business units”, what Tom Peters would call “a lack of cross functional integration”. Divisions and departments act in isolation of each other seldom coming together to prioritize their projects and activities with their peers. The net result is commonly called a “silo organisation” a way of operating divisions within the business compete with each other internally rather externally, in the market. Who wins? Generally the competition, who, to be fair, are possibly struggling with similar challenges. In short, the fight is happening on the wrong side of the fence.

The systemic consequence (a clever way of saying the knock on effect) of silo thinking impacts employee morale and organisation performance. Companies end up fat, with too many heads pulling in different directions, or internally political, with leaders and teams fighting for attention, resource and budget. Put that kind of thinking into the workforce and the net result is a plethora of headaches for which no pill can easily cure. Layer into this the challenges that come with a matrix structure, and then the real complaints come: we are pulled in too many directions, we don’t have the time, we’re in too many meetings, the goal is not clear, we don’t have the skills.

Kaplan goes on to add that there is often “[no clear] distinction between strategic and operational project efforts”. Poor prioritization and lack of integration appear to be the basis for a slew of unorganized and, at times, chaotic activity. This renders senior decision makers with an inadequate view of the real performance of the business, and leaves the implementation teams (managers, supervisors and employees) grinding hard at things without really understanding their value or impact.

Understanding how to prioritize initiatives and projects is just one of the insights Professor Kaplan will be sharing at this year’s BRG Conference on Strategy Execution co-hosted by GIBS and sponsored by STRATX. If resource optimization and project prioritization fits into your scorecard, then this is a day not to be missed. Learn how the father of the Balanced Scorecard and Activity Based Cost Accounting can shed new light on initiative management in your business.

For more information visit //www.brg.co.za/speakers/prof-robert-kaplan/ or call BRG on 0861 B GREAT

**On the 17th September 2015, Harvard Business School, Professor Kaplan, Internationally acclaimed Lifetime Contributor to the Management and Accounting Profession will present a full day programme at The BRG Progress Conference on Executing Strategy taking place at Theatre on the Track, Kyalami Johannesburg. This year’s programme will feature Leadership, Risk, Finance, People and Project priorities.


HBR.org – Managing Risks: A New Framework

By Robert S Kaplan & Annette Mikes, Harvard Business Review, June 2012

In this article, we present a new categorization of risk that allows executives to tell which risks can be managed through a rules-based model and which require alternative approaches. We examine the individual and organizational challenges inherent in generating open, constructive discussions about managing the risks related to strategic choices and argue that companies need to anchor these discussions in their strategy formulation and implementation processes. We conclude by looking at how organizations can identify and prepare for nonpreventable risks that arise externally to their strategy and operations.

Click here to read the full article.