how risky is your company? - university of...

How Risky Is Your Company?

by Robert Simons

Reprint 99311

MAY– JUNE 1999

Reprint Number

kathleen m. eisenhardt and shona l. brown

robert simons

jay w. lorsch andrakesh khurana

JON R . KATZENBACH AND JASON A . SANTAMARIA

ROSABETH MOSS KANTER

JEFFREY PFEFFER ANDROBERT I . SUTTON

AMORY B. LOVINS, L . HUNTER LOVINS, AND PAUL HAWKEN

JACQUELINE VISCHER

DAVID DUNNE AND

CHAKRAVARTHI NARASIMHAN

DANNY ERTEL

donald f. hastings

nicholas g. carr

PATCHING: RESTITCHING BUSINESS PORTFOLIOS 99303IN DYNAMIC MARKETS

HOW RISKY IS YOUR COMPANY? 99311

CHANGING LEADERS: THE BOARD’S ROLE IN CEO SUCCESSION 99308A ROUNDTABLE WITH PHILIP CALDWELL, GEORGE D. KENNEDY,G. G. MICHELSON, HENRY WENDT, AND ALFRED M. ZEIEN

FIRING UP THE FRONT LINE 99307

FROM SPARE CHANGE TO REAL CHANGE: THE SOCIAL 99306SECTOR AS BETA SITE FOR BUSINESS INNOVATION

THE SMART-TALK TRAP 99310

A ROAD MAP FOR NATURAL CAPITALISM 99309

HBR CASE STUDYWILL THIS OPEN SPACE WORK? 99312

thinking about…THE NEW APPEAL OF PRIVATE LABELS 99302

IDEAS AT WORKTURNING NEGOTIATION INTO A CORPORATE CAPABILITY 99304

first personLINCOLN ELECTRIC’S HARSH LESSONS FROM 99305INTERNATIONAL EXPANSION

books in reviewBEING VIRTUAL: CHARACTER AND THE NEW ECONOMY 99301

n good times, it’s easy to forget about risk.Optimism abounds when markets are growing andrevenue and profits are up. The business is hiring new

people, increasing the scale of operations, and searching outnew and exciting opportunities for growth. Indeed, in suchboom periods, the future looks so bright – to paraphrase thepop song –you have to wear sunglasses.

Yet it’s in good times that managers need to be mostwatchful for signs of impending danger. Such is the paradoxof success: it has an uncanny way of setting a company upfor trouble, if not outright attack. And not only from outsidesources, such as competitors or regulators, but, just as impor-tant, from within the organization itself.

Consider how an aggressive, can-do culture often ariseswhen a company’s sales and profits soar. Such a culture usuallyaccounts for bold initiatives and satisfied clients, but it alsocan end up silencing any messenger carrying bad news about

Robert Simons is the Charles M. Williams Professor of Business Ad-ministration and a director of research at Harvard Business Schoolin Boston, Massachusetts. He is the author of Levers of Control:How Managers Use Innovative Control Systems to Drive StrategicRenewal (Harvard Business School Press, 1995) and PerformanceMeasurement and Control Systems for Implementing Strategy(Prentice-Hall, 1999).

I

harvard business review May–June 1999 Copyright © 1999 by the President and Fellows of Harvard College. All rights reserved.

How

Is YourCo

mp

an

y?

Risky

Success brings profits, growth, and

unbounded optimism. But it also has

a way of blinding executives to the

many organizational dangers that

creep in at the same time. How much

internal risk is hiding within your

company? Use the risk exposure

calculator to find out.

a company’s practices. Success can also require anorganization to invest in new computer systems tocarry the load of increased orders. That growth isreason to celebrate, except that the all-too-commonfailure to integrate new technology is a disasterwaiting to happen.

Success, in other words, should make executivesnervous. Better yet, it should galvanize them toidentify their level of internal risk exposure. Not allrisk is bad, of course, and in fact, most organizationsmust take risks in order to make progress. (In somefast-moving industries, such as software and finan-cial services, it is necessary to take on quite a bit ofrisk just to stay even.) But managers – especiallythose of successful enterprises – must always be on the lookout for the risk lurking in their organi-zations. The question is: how can they pinpoint the areas of risk exposure?

Over the past several years, I have developed atool called the risk exposure calculator. The calcu-lator shows the pressure points present in every or-ganization that lead to increased risk, such as thespeed of operational expansion and the level of in-ternal competition. Depending on a company’s cir-cumstances and management style, the amount ofpressure on each point can be low or high. A uni-formly low score on these pressure points, it shouldbe noted again, isn’t necessarily a virtue. Rememberthat nothing ventured is nothing gained. But toohigh a score on too many pressure points can be astrong signal that a company is exposed to dangerouslevels of risk. Remedial action may be necessary –and fast.

The risk exposure calculator is not a precise toollike an electronic spreadsheet or a discounted cash-flow analysis; its results are directional. It allows ex-ecutives to determine if a company’s risk level is inthe safety, caution, or danger zone. Once executivescalibrate and understand a company’s risk level,they can align it with the organization’s strategy.

The calculator has been tested by managers fromhundreds of different companies attending HarvardBusiness School’s executive education programswhere I teach. Because the calculator shows thecombined effect of risk exposure throughout a com-pany, the typical reaction to the total score is sur-prise, followed by nagging discomfort. It is not as ifthese executives don’t know that their organiza-tions carry risk. The CEO of a manufacturing com-pany might, for example, be fully cognizant that anew factory has been put on-line too quickly. Thatsingle pressure has been worrisome, but not enoughto keep him up at night. Using the risk calculator,however, the same CEO might discover that there isenough pressure on other critical pressure points

that his company’s overall risk exposure has risento dangerous levels.

The risk exposure calculator also gives executivesthe opportunity to conduct two illuminating exer-cises. First, managers can ask people at different lev-els and in different functions within a company touse the calculator – and then compare scores. In myexperience, that process shows that people at thevery top of the company are less aware of risk expo-sure than those closer to the ground. Similarly, theexercise often reveals that people in one division orbusiness unit rate the company’s exposure to riskmuch higher than the rest of the organization. Insuch cases, it is time for senior executives to find outwhat one business unit knows that no one else does.

Second, managers can calculate their company’scurrent risk exposure and then calculate what itwould have been 24 months ago. Comparing thosescores reveals an organization’s internal risk-expo-sure trajectory. One executive who did so found thather organization had somehow managed to soarfrom the safety to the danger zone. She acted swiftlyto alert her senior team, and steps were taken tobring risk back under control.

In dynamic markets, taking risks is an integralpart of any successful strategy. But understandingthe conditions that create unhealthy levels of riskcan go a long way toward preventing failure. It iscritical, then, for senior executives to keep track ofeach pressure point. Later, we’ll take a look at thesteps managers can take to control those pressures,but first, let’s examine the calculator in detail.

The Risk Exposure Calculator,Key by KeyThe risk exposure calculator is divided into threetypes of internal pressures – those due to growth, toculture, and to information management. For eachof those pressures, success can increase the level ofrisk. People subject to them make mistakes in theirjobs, inadvertently or not. They skip important stepsin a quality-checking process, for instance, or allownew customer service associates to answer phoneswithout adequate training. Another common out-come of internal pressures is that people fail toshare important information, especially with theirbosses. Either they don’t have the inclination, orthey don’t want to pay the price. And finally, in-creased pressure can cause inefficiencies or break-downs, or both, as systems and people become over-loaded and undermanaged.

Let’s start with the pressure points related togrowth, where the exposure to risk begins in manysuccessful companies.

86 harvard business review May–June 1999

how risky i s your company?

even if their actions overstep ethical bounds or con-travene company policy. They may, for example,accept customers with poor credit ratings or cutquality to accelerate operations. And if pushed hardenough, employees can sometimes misrepresenttheir true performance to cover up any shortfallsagainst expectations.

Examples of such behavior are, sad to say, plenti-ful. Consider what happened in 1997 at the member-ship club CUC International. The company, whichoffered its customers discounts on home appliances,travel, dining, and auto parts, was run by managersintent on aggressive revenue and earnings growth.And indeed, the company consistently hit thosegoals – to the stock market’s delight. But shortly after CUC merged with a franchising giant HFS(which franchises Ramada hotels, Coldwell Bankerreal estate, and Avis rental cars, among others) to

Pressure Points Due to Growth. Fast-growingbusinesses are often intense and exciting environ-ments. A burgeoning company attracts the interestof employees and the capital markets alike. In pur-suing strategies that emphasize growth, executivesoften set ambitious sales and profit goals. Thosewho deliver are rewarded for their work; those whofail to meet expectations do not share in the bounty.No wonder, then, that growth can lead to the firstpressure point: pressures for performance.

If managed properly, pressure to achieve chal-lenging goals can stimulate innovation, entrepre-neurial creativity, and superior financial perfor-mance. However, such pressure can also bringunintended risk. Subordinates may fear that failingto meet performance expectations will jeopardizetheir status or compensation. Accordingly, theymay feel intense pressure to succeed at all costs,

harvard business review May–June 1999 87


Growth

The risk exposure calculator is a mechanism used to gauge a company’s likelihood of being surprised by errors or breakdowns that could threaten the company’s franchise or strategy.

Using the calculator is straightforward. For each key, rate the level of pressure in your company, scoring one as low and five as high. At the end, total your scores and interpret the results as shown to the right.

Culture

Information Management

rewards for entrepreneurial risk taking

1 2 3 4 5score

executive resistance to bad news

1 2 3 4 5score

level of internal competition

1 2 3 4 5score

+ + =score

transaction complexity and velocity

1 2 3 4 5score

gaps in diagnostic performance measures

1 2 3 4 5score

degree of decentralized decision making

1 2 3 4 5score

+ + =score

total score =

The Risk Exposure Calculator

rate of expansion

1 2 3 4 5score

pressures for performance

1 2 3 4 5score

inexperience of key employees

1 2 3 4 5score

+ + =score

9 to 20: The Safety Zone

Companies that carry this low levelof risk are probably safe fromunexpected errors or events thatcould threaten the health of thebusiness. However, managers of suchcompanies should question whethertheir risk exposure score is too low.Innovative, successful companiesinvariably create risk pressure. If yourbusiness scores in the safety zone,perhaps it’s time to take somecalculated gambles.

21 to 34: The Caution Zone

Most companies will find that theyfall in this middle zone. But evenhere, managers should be alert forhigh scores in any two of the threerisk dimensions. For example, if yourbusiness scores high on bothgrowth and culture, but the totalscore falls below 35, there is stillreason for concern.

35 to 45: The Danger Zone

If you find that your total score is 35 or above, alarm bells should beringing and fast action shouldfollow. Use the levers of control:belief systems, boundary systems,diagnostic control systems,and interactive control systems–coupled with traditional internalcontrols– to protect your businessfrom disaster.

create Cendant, it was revealed that CUC’s remark-able results were fake. Employees in 22 businessunits had falsified accounting records and bookedmore than $500 million in phony pretax profits.When confronted by investigators, the people whologged the fictitious entries said they felt pressuredby their bosses to meet Wall Street’s expectations.

How can managers measure their score on thispoint? They can ask themselves if aggressive stretchgoals are set from the top down with little or no in-put by subordinates. If the answer is yes, then thispoint merits a high score. So does an environmentin which performance-variable pay represents alarge percentage of total compensation. High scoresare also called for when managers give star perform-ers special attention and recognition. And finally,pressure on this point is invariably high when thecapital markets hold high expectations for financialresults and traders bid up the stock to prove it.

The second growth-related pressure point is therate of expansion in operations. Again, this is a goodnews–bad news story. New production facilities, dis-tribution channels, and product lines are only nec-essary when business is booming. However, with-out careful planning and allocation of resources,the infrastructure to support rapid expansion mayquickly become overloaded, resulting in sacrificesin quality. In other words, when calculating thepressure on this point, managers should ask them-

selves, Are operations expanding faster than our capacity to invest in more people and technology?

The answer, clearly, was no at American Express,when in 1987 top management decided to aggres-sively expand the scope of the company’s franchise.In addition to the well-known American Expresscard, which requires customers to pay outstandingbalances in full each month, a new Optima cardwas launched that encouraged customers to rollover unpaid balances and pay finance charges. Thenew business was ramped up quickly to accommo-date the increased volume. But with little previousexperience in consumer credit markets, Optimamanagers badly misjudged delinquency rates on thenew cards. The result: write-offs in excess of $150million and a quarterly loss for the prestigiousTravel Related Services division.

A high level of inexperience among employeesand staff creates the third growth-related pressurepoint. When large numbers of people come on boardquickly, managers sometimes waive backgroundchecks or lower performance standards and educa-tional qualifications. As a result, new employeesoften lack adequate skills and training or don’t fullyunderstand their jobs. The fallout of such circum-stances is well known: an array of small and largemistakes, from sales clerks who misinform impor-tant clients to factory workers who mishandle dan-gerous equipment. From unhappy customers to en-dangered staff, the risks posed by inexperiencedpeople can be unnerving. When calculating thepressure on this point, then, managers might askthemselves, What percentage of our jobs are filledwith newcomers – people, say, with less than 12months experience with the company? Other tell-tale signs that pressure is climbing include in-creased customer complaints about service, andemployees who make too many “stupid” mistakes.Those problems may seem like simple irritants tosenior managers of a growing business, but they areimportant alarm bells.

Inexperience brings with it an additional risk, especially in unstructured, high-innovation busi-nesses. It takes a lot of time for new people to learn,let alone internalize, a company’s values. Oftenthey simply don’t know what constitutes accept-

able behavior – or put another way, whatkind of behavior is completely out ofbounds. Consider what happened in thelate 1980s and early 1990s when Nord-strom, the fashion retailer, sharply in-creased the number of its stores acrossthe United States and hired scores of newmanagers to staff them. Even thoughNordstrom had always prided itself on

being fair – some would say generous – toward itsemployees, a few overzealous managers intimi-dated subordinates into underreporting work hoursin an attempt to meet sales-per-hour quotas. Thismiscreant behavior resulted in a series of lawsuitsand government actions that absorbed manage-ment’s attention and damaged Nordstrom’s other-wise fine reputation.

Pressure Points Due to Culture. No businessescan survive over the long term – let alone prosper –without the entrepreneurial risk taking that drivesinnovation and creativity. But success can em-bolden risk takers too much; money is loose, confi-dence high. For some, the urge to gamble with thecompany’s assets and reputation – all in the nameof greater gains – becomes irresistible. And so veryoften people in successful enterprises invest in



Success can embolden risktakers too much; moneyis loose, confidence is high.

excessively risky deals, forge alliances with peopleor businesses that may not have the ability to honortheir contracts, or make promises to customers thatare impossible to fulfill. Again, rewarding entrepre-neurial initiative is generally the right thing to do.But as the rewards for entrepreneurial behavior rise,so too does risk exposure.

Consider what happened at Bankers Trust Com-pany, a traditional commercial bank during muchof its history. In the early 1990s, senior manage-ment transformed the business into an aggressiveinvestment bank that issued innovative financialinstruments. Bankers and traders were rewarded forcreating and pushing new products as fast as theycould. By 1993, based on the success of such entre-preneurial behavior, the company was earning morethan $1 billion on revenue of $4.7 billion. In 1995,however, Bankers Trust was sued by several clients,including Procter & Gamble, for misrepresentingthe risks associated with these new financial prod-ucts. The result was over $250 million in fines andcustomer-reimbursement costs and the ouster ofBankers Trust’s CEO and other top executives.

How can managers calculate a score for this pres-sure point? One way is to determine what percent-age of the business is based on new products andservices that have been generated by creative, risk-taking employees. The higher the number, thehigher the score. Another cause for a high score onthis point is an environment in which people are allowed – even urged – to operate like the LoneRanger, and only return to base when they havecaptured the “spoils.” And finally, an increasingfrequency in failed new products or services or un-successful deals is a sign that exposure to risk ismounting.

Another cultural pressure point has to do with in-formation –particularly as it flows upward. To theirperil, executives running successful organizationsoften develop a resistance to bad news. They wantto be surrounded by people who share their pride inthe business and exude confidence about reachingdemanding performance goals. People who speak of obstacles, problems, or impending dangers arederided as annoying naysayers and accused of notbeing team players. Yet it is often these individuals –many of whom communicate daily with frontlineemployees, customers, and suppliers – who are bestable to see risk creeping in. In cultures where thephilosophy is “the boss knows best,” many learnnot to speak out about such risk.

The result? In the worst case, top-level managersare the last to know about critical changes in thecompetitive environment. At Kmart, for example,managers were reportedly reluctant to tell the leader-

ship team about problems in the business, even asWal-Mart was quickly overtaking them. While up-start competitor Sam Walton was known for prod-ding his subordinates to deliver bad news quicklyso that they could figure out how to improve,Kmart’s CEO Joseph Antonini had a reputation forsurrounding himself with people who would notchallenge his views. Eventually, in 1995, the share-holders and the board forced him out. Similar storiesabout senior managers at the “old” IBM and GeneralMotors have been told to explain the companies’spectacular declines from industry preeminence.(New top management, of course, has now reversedtheir fortunes.)

To calculate the score on this pressure point,managers must ask themselves some difficult ques-tions: How much bad news do I actually hear? HaveI surrounded myself with “yes men”? The answerto those questions will help determine their score.

The last explosive ingredient in the mix of cul-tural pressure points is internal competition. Inmany organizations, managers believe that they arein a horse race with their peers for promotions andrewards. And often they are right. Senior executivesfrequently set up such contests to stimulate excep-tional effort. However, when employees perceiveadvancement and promotion as a zero-sum game,internal competition can have unintended side effects. The most common result is a decrease in information sharing. After all, if you know some-thing important about customers or processes thatyour rival doesn’t, why give away your advantage?

To compound the problem, employees feeling the pressures of internal competition may gamblewith business assets, potential credit losses, and thecompany’s reputation in their attempts to enhanceshort-term performance. In such instances, risksand rewards are not evenly distributed. If the gamblesucceeds, there is an upside for both the employeeand the company. But if the gamble fails, the em-ployee may – at worst – lose his or her job. The orga-nization can also be left with catastrophic losses.That’s exactly what happened at Barings Bank in1995. Nick Leeson executed transactions that atfirst appeared to create exceptional levels of profit.To win respect and rewards, he was in fact gamblingcompany assets in an attempt to cover ever-mount-ing losses. When the dust settled, Leeson was in cus-tody on fraud charges. His actions destroyed a 200-year-old institution.

To calculate their score on the internal competi-tion pressure point, managers might simply askthemselves, Do we manage and motivate by horseraces here? They could also consider how perfor-mance reviews are conducted at their company. Are



employees ranked and compared with one another,or are they evaluated on their own merits? If the answer is the former, then the score should be high.Managers might also think about what happenswhen star performers are promoted. Do other peopleget fired –or quickly leave –at the same time? Com-panies with such up-or-out environments have highlevels of internal competition and should receive a high score on this point.

Pressure Points Due to Information Management.The final set of pressures in the risk exposure calcu-lator relates to the flow of information within acompany. In short, when systems to manage infor-mation are inadequate, havoc ensues – and risk ex-posure mounts.

Success in the marketplace is often accompaniedby increasingly sophisticated products, by innova-tions in the way that customers are served, and bycreativity in bundling new products or services. Allthese changes can increase the complexity of trans-actions. When that happens, fewer people fully un-derstand the nature of the risks that these transac-tions create and how to control them. For example,cross-border agreements in international operations,creative financing of customers’ purchases, andelaborate consortium arrangements can all producehighly complex contracts. If only a handful of ex-perts in the organization truly grasp the resultingobligations and contingent cash flows, the riskshidden on the balance sheet can become a mystery tothe senior managers who need to understand themmost. In calculating the pressure on this point, then,ask yourself if you truly understand the complexand sometimes arcane language of the deal-makingexperts in your company. If the answer is no, scoreyour risk exposure accordingly.

The increase in complexity due to highly lever-aged derivative financial products – that is, finan-cial instruments whose value fluctuates based onchanges in the values of other underlying assets –has caused more than one well-managed companyto sustain substantial losses. A perfect example isMetallgesellschaft Refining & Marketing (MGRM),an American subsidiary of the large German in-dustrial corporation Metallgesellschaft. In the early1990s, MGRM began selling long-term fixed-pricefuel oil contracts. At the same time, as a hedgeagainst price volatility, MGRM bought short-termoil futures on the New York Mercantile Exchange.When oil prices began their precipitous decline in1993, the business was forced to pay more than $50million per month to cover margin calls. Managersof the parent company became alarmed and, against the advice of MGRM executives, liquidatedthe futures positions at a significant loss. The par-

ent board blamed subsidiary managers for lax op-erational control; subordinate managers claimedthat the parent did not fully understand the natureof the futures positions and had overestimated thepotential risks. Who was right? Because of the com-plexity of the transactions, it is hard to say, but losses on the liquidated positions exceeded $1 bil-lion and brought Metallgesellschaft to the edge ofbankruptcy.

Success can also mean an increase in the volumeand velocity of transactions, which often overloadsinformation systems. The dangers here are obvious.Managers have less opportunity to scrutinize trans-actions to ensure that they adhere to preapprovedpolicies. Overloaded or inadequate computer sys-tems may not be able to capture the information essential to support growth. That’s what happenedat People Express – the now defunct low-cost, no-frills airline. As the business took off, it quicklyreached a point where its rudimentary informationsystems lacked the ability to accurately analyze


Pounding the CalculatorKeys at One CompanyTo demonstrate how the risk exposure calculatorworks, let’s show how it might have revealed the riskbrewing at Kidder Peabody before its disastrous fall in1994, when over $350 million of false profits wereuncovered and its parent, General Electric, decided todispose of Kidder Peabody’s assets.

In hindsight, it is easy to see that many of the pres-sure points on the risk exposure calculator were atdangerously high levels. Indeed, the company’s scorewould have been close to straight fives in all categoriesfor a total of 45 –at the very top of the danger zone.

First, consider the growth dimension. Even beforeGeneral Electric purchased Kidder Peabody, pressurefor performance at the company was extremelyhigh – not unlike the pressure at other Wall Streetfirms. From all accounts, the acquisition heightenedthe demand for results. The rate of expansion waslikewise intense. After all, GE Capital was pouringmoney into Kidder so that the business could expandaggressively. At the same time, the number of inexpe-rienced people at Kidder was mounting. GE managerssent in to oversee the company after the acquisition –while expert at running an industrial company – didnot fully understand the operations or the nature offinancial service products. Moreover, Joseph Jett, thetrader hired for the fixed-income desk, was young andhad no training or experience in buying and sellingspecialized types of bonds. Pushing this score up even


further was the fact that there were few shared valuesbetween managers at GE, a carefully managed industri-al company, and those at Kidder, a freewheeling finan-cial trading business.

As for culture, GE’s and Kidder’s senior managers hadcertainly created an environment that rewarded entre-preneurial risk taking. Those who could find ways toexploit market imperfections or who could create newfinancial products were well compensated. Thus, Jett,who was ultimately discovered to be booking false prof-its, had previously been feted by top management asKidder’s “man of the year.” His 1994 annual bonus was$9 million. Notwithstanding his outward success,however, several people close to his operation ques-tioned the nature of the profits that he was generating.But there was such executive resistance to bad news –especially given the rewards and accolades that werebeing showered on the trader – that those with suspi-cions were quickly quieted. There was also intense in-ternal competition as traders and managers vied forpromotion, recognition, and large bonuses.

Finally, consider the quality of information manage-ment at Kidder. Transaction complexity and velocitywere both increasing rapidly as Jett placed orders to buyand sell billions of dollars worth of bonds. Illogical ex-planations for complicated trades were not questionedby managers who later claimed ignorance of the realnature of these transactions. Diagnostic performance

measures were faulty and incomplete. Jett had stumbledon a glitch in the firm’s computer program that allowedhim to record huge unrealizable profits. Diagnostic early-warning systems that should have alerted senior man-agers to the dangers of these outstanding positions wereeither nonexistent or ignored. Because of a lack of sys-tematic early-warning systems, senior managers at Kid-der and GE were never provided with the critical signalsthat would have alerted them to serious problems.

Finally, Kidder scores high on decentralized decisionmaking. Not only is GE a highly decentralized organi-zation, but Kidder, too, allowed major decisions to bemade by employees at the trading desks without directmanagement oversight. When Jett’s supervisor wasasked why he didn’t watch his people closely, he saidthat it was not part of his job and that he relied onothers to alert him if anything was amiss.

Who was to blame for Kidder’s ignorance of its enor-mous risk exposure? Jett claimed that he was notculpable because he had never hidden his actions fromsuperiors. In turn, his bosses claimed that they werenot responsible because they had relied on the com-pany’s diagnostic control systems and internal auditorsto alert them if anything was wrong. In hindsight,blame must be placed on the shoulders of those man-agers who failed to appreciate the risk pressures due togrowth, culture, and information management thatwere mounting within the company.

available seat miles so that managers could set theright prices to maximize profit. Six years after itssuccessful launch, the company went bankrupt.More recently, America Online suffered the conse-quences of inadequate information-processing ca-pacity in the face of increased transaction volume:service shutdowns and blackouts reverberatedthroughout its system just as many new customerswere trying to come on board.

To determine the score on this point, managersshould do a rough calculation in their heads. Whatwere the complexity, volume, and velocity of infor-mation a year ago? Have they risen, and by howmuch? The answers to those questions are not pre-cise, but they can give a strong indication of whetherthe score should be high or low.

Success also puts pressure on the internal report-ing systems that measure critical performance vari-ables, such as return on capital employed, same-store sales, order backlogs, and product or servicequality. In bad times, managers usually pore over

such facts and figures as they try to divine thesource of their problems. In good times, however,managers will frequently let this process slide.There are two reasons. First, rapid growth often renders these systems outdated and inadequate tothe new demands of the business. And second, it’shuman nature. If everything is going well and prof-its are high, there’s little reason to plow throughmounds of data in order to find anomalies or waysof making small improvements.

How can a manager calculate a score on this pres-sure point? One signal that a high score is called foris, simply, a feeling of frustration – a sense that it’shard to get the right data at the right time. Whenthere are gaps in diagnostic performance measures,managers end up getting the information they needby making phone calls and walking around. Inshort, they spend a lot of time doing the work acomputer system should be doing.

Another way to calculate the score on this pointis to ask, How often do I fight fires? If the answer is



often, then it’s likely that your information systemsare not providing the right information in a timelyfashion. And finally, give yourself a high score if thelast time you looked at data on performance wasmore than a month ago, or if you’re unlikely tocomplain if monthly performance reports are lateor missing. This invariably means that you are notusing diagnostic controls effectively.

The final information-management pressurepoint in the risk exposure calculator is decentral-ized decision making. When companies expandquickly, local managers are often given a great dealof autonomy to make decisions. Indeed, top-levelcorporate managers are typically involved only inmatters of resource allocation, goal setting, and per-formance reviews. Of course, decentralization yieldsmany advantages. It enables local business units torespond quickly to market demands, allows morecreativity and innovation, and it can enhance themotivation and career satisfaction of managers.

But again, these positive effects also have theirdownsides. First, local managers acting without alarger sense of their organization’s corporate strategymay unknowingly take on too much risk. Second,decentralized organizations do not have well-definedinformation channels for sharing information eithersideways or upward. If senior executives are nothearing important information until it’s too late,then they need to give themselves a high score onthis pressure point. (To see how the risk exposurecalculator is actually applied, see the insert “Pound-ing the Calculator Keys at One Company.”)

Now that we’ve identified all the pressure pointsthat contribute to risk exposure, let’s take a look at what managers can do after they’ve calculatedtheir score.

Five Questions About RiskMost managers understand the relationship be-tween risk and reward. But a second relationship isequally important: the relationship between riskand awareness. Taking risks is not in itself a prob-lem – but ignorance of the potential consequencesis an entirely different matter. Even for the mosttechnical categories of external risk – sovereignrisk, counterparty risk, credit risk, market risk – ifmanagers are aware of their nature and magnitude,they can take appropriate steps to avoid the hiddendangers.

The same is true of internal risk exposure. Oncemanagers know where it exists in the organization,and at what levels, they can act. In many cases,however, that’s easier said than done. Over the years,I have spoken with many managers who work for

companies that fall into the calculator’s dangerzone. They often say that they have done every-thing possible within their organizations to controlrisk. “What actions are left?” they ask.

The answers can be found in a series of questions.These questions correlate with the four “levers ofcontrol” that I developed from intensive researchover a ten-year period. (For a model of the levers of control, see the exhibit “The Levers of Control.”)The levers, simply stated, are the mechanismsmanagers can adjust to control risk as a companypursues its strategy. There is one question for eachof the four levers: belief systems, boundary sys-tems, diagnostic control systems, and interactivecontrol systems. Working together, these four leversgive managers the tools to balance profit, growth,and control. Each of them must be carefully alignedwith a business’s strategy. A fifth and final questionrelates to what are commonly known as internalcontrols – the checks and balances designed to safe-guard assets and ensure reliable information. Inter-nal controls do not vary with strategy; they are,however, an essential foundation for controllingrisk in all organizations.

The managers of many successful companieshave implemented the levers-of-control model andin doing so have found a way to drive maximumperformance while ensuring adequate safeguardsagainst risk. The following questions are designedto help you do the same.

Question #1: Have senior managers communi-cated the core values of the business in a way thatpeople understand and embrace? Many of the criti-cal pressure points in the risk calculator measurethe likelihood that employees are misconstruing theintentions of senior managers or are taking on un-acceptable levels of risk for personal gain. Beliefsystems – communicated through mission state-ments, credos, and statements of values – can go along way toward creating a culture that rewards in-tegrity and makes clear the types of choices thatshould be made when confronted with temptationor unfamiliar situations. Effective belief systemsare an essential safeguard in rapidly growing, high-pressure businesses.

But to effectively communicate core values andbeliefs, managers must do more than go throughthe motions of writing a mission statement. Theymust reinforce their stated beliefs through visibleactions. That is, they must demonstrate that a mis-sion statement or credo is more than a plaque forthe wall – they must prove it is a living document.At Johnson & Johnson, top managers periodicallymeet with all business unit managers to debate and reaffirm the importance of their long-standing



credo. Indeed, members of the company’s seniorteam will even meet with small groups of employ-ees and vet the credo word-by-word. Such extraor-dinary practices demand a great investment oftime, but they are worth it for the enormous claritythey bring to questions of policy and practices andfor the clear understanding they convey about whatis right and wrong.

Question #2: Have managers in your organiza-tion clearly identified the specific actions and be-haviors that are off-limits? Every business faces thepossibility that some employees may step outsidethe bounds of normally accepted business prac-tices. They may promise customers too much, forinstance, or accept a client who has a poor record ofpaying his bills. Some missteps, however, are moreserious than others – they may actually harm thefranchise of the business. Therefore, for any givenbusiness strategy, managers must determine whatbehaviors or actions could damage the business’s

artwork by douglas jones 93


reputation and declare those actions categoricallyoff-limits.

Consultants and auditors, for example, dependon their reputation for trustworthiness as an essen-tial asset for effective competition. Ask yourselfhow long McKinsey & Company could stay in busi-ness if clients suspected that client data were beingleaked to competitors. Because of such clear fran-chise risks, McKinsey and firms like it have explic-it codes of conduct that forbid any behavior thatcould be perceived as compromising the confiden-tiality of client data. At PricewaterhouseCoopers,the accounting firm responsible for tallying thevotes for the Academy Awards, boundaries for busi-ness conduct are made clear to anyone associatedwith the awards: Tell anyone other than your super-visor about the outcome of the votes, and you’ll befired. Establishing unambiguous boundaries is aquick but effective way of reining in risk and pro-tecting a firm’s most valuable asset.

To control the internal risk that accompanies strategy, managershave levers of control at their disposal. Ask yourself thefollowing questions to see if those levers are being pulled inyour organization. The question at the very bottom relates to

what are commonly known as internal controls – the checks andbalances that safeguard assets and ensure reliable information.Internal controls do not vary with strategy; they are, however, anessential foundation for controlling risk in all organizations.

The Levers of Control

Belief SystemsHave senior managerscommunicated the corevalues of the business ina way that people under-stand and embrace?

Boundary SystemsHave managers in yourorganization clearlyidentified the specificactions and behaviorsthat are off-limits?

Diagnostic ControlSystemsAre diagnostic controlsystems adequate atmonitoring criticalperformance variables?

Interactive ControlSystemsAre your control systemsinteractive and designedto stimulate learning?

Internal Controls Are you paying enough for traditional internal controls?

Question #3: Are diagnostic control systems ade-quate at monitoring critical performance variables?Because success makes it so easy to neglect or dis-miss diagnostic control systems, managers have tobe sure to invest in these systems in boom timesand ensure that everyone is focusing on the rightcritical performance variables. Sometimes existingsystems and measures are adequate. In other cases,success calls for new variables. Managers need todetermine which performance variables mattermost in present circumstances and then designways to ensure that key managers are regularly in-formed of those figures. Managers may choose tofocus diagnostic measures on operations (such asquality and throughput), on critical balance sheetassets (such as credit loss exposure), or on the com-petitive environment (such as customer complaintsor bids lost to competition). Watching the rightnumbers can be an important way to find out if thefuture doesn’t look so bright.

Question #4: Are your control systems interac-tive and designed to stimulate learning? Managerscan stay abreast of many critical performance vari-ables by relying on exception-based diagnostic re-ports, but such documents represent a one-wayflow of information. An additional and importantway to monitor risk exposure is through certaininteractive control systems – that is, systems thatforce managers to engage in conversations aboutstrategic uncertainties. If used properly, the debatethat these control systems trigger can raise im-portant questions about customers, technology,competitors, regulation, markets – anything thatmight change a company’s way of doing business.Any number of systems can be used interactively:profit plans, performance scorecards, technology-monitoring systems, or brand revenue systems.The only requirement is that interactive meetingsfor discussing the data become routine enoughthat they don’t fall by the wayside. Used as mecha-nisms to gather information, interactive controlsystems open information channels from the bot-tom of the organization to the top, an essential wayto combat risk.

Again, Johnson & Johnson provides an illustrationof a company that uses an effective risk-controllingdevice. Its managers use their profit-planning andlong-range-planning system in a highly interactiveway to continually assess opportunities and threats.As they constantly revise projections, managersare forced to confront three questions: What haschanged? Why? and What are we going to do aboutit? Through such an interactive process, Johnson &Johnson’s managers have successfully navigatedthe shoals of the changing health care industry and

have managed to stay, year after year, on the short-list of America’s most admired companies.

Question #5: Are you paying enough for tradi-tional internal controls? In this age of balancedscorecards and enterprisewide information sys-tems, many organizations have relegated internalcontrols to the dustbin. I’m referring here to time-tested practices such as segregating duties, limitingaccess to critical information, and adequately staff-ing key control and risk management positions,such as controllers and internal auditors.

Why have some companies let those controls go?One of the main reasons is the wave of reengineer-ing and downsizing that has occurred over the pastdecade. On the one hand, these initiatives have suc-cessfully refocused and streamlined businesses,making them healthier and more competitive. Onthe other hand, they have also removed much of theredundancy and middle management oversightthat were the traditional backbone of internal con-trol systems.

There is no fixed amount or percentage that acompany should be paying for the checks andbalances that are the mainstay of internal controls.But there is one rule of thumb. As a companygrows, the money invested in such systems shouldbe growing commensurately. It may feel wastefulat the time – especially since success makes riskseem so remote – but it is money well spent. That’sa fact, unfortunately, that many managers don’tlearn until it’s too late.

A Calculator and a Magnifying Glass Attaining success is the reason that many peopleenter business in the first place. It feels great. Andperhaps that’s why once you achieve it, the lastthing you want to hear is: Watch out – risk looms!But executives running successful enterprises can’tlet the brightness of the day – or the future – blindthem. They need to shed their sunglasses and find a magnifying glass to search their organizations for the risks that may be multiplying within. A pairof binoculars might be called for as well. Some-times risk creeps into the organization at quite adistance from the top.

The risk exposure calculator won’t, in and of itself,decrease an organization’s risk. But it will suggestwhere risk is growing and how fast. With that in-sight, managers can take the steps they need to pro-tect their success. Not all risk is bad. It’s up to you,then, to decide if your business’s level of risk callsfor mere watchfulness or for strong action.

Reprint 99311 To place an order, call 1-800-988-0886.



how risky is your company? - university of...

Documents