In the wake of the biggest economic meltdown since the Great Depression, some management teams have developed an especially low tolerance for risk. Yet uncertainty should not mean paralysis. In fact, it's time for the strong to reawaken their appetites for risk. That is, if they have a workable process in place—one that centers on transparency and debate, is reflected in corporate culture, and emphasizes oversight, accountability, and responsibility.
Make no mistake: Most companies have traditionally had some sort of risk process addressed in risk departments, risk assessments, risk management, and the like. So why did things go so wrong that we wound up in the 2008 financial crisis?
Complacency, economic insecurity, keeping up with the Joneses, reluctance to "rock the boat," and even fear of reprisals encouraged people to turn a blind eye toward risk, instead of waving a red flag. Surely many people on Wall Street and Main Street knew before the financial crisis that taking out a $400,000 loan on $40,000 of income—with no money down, little documentation, and with payments that could be skipped—was wrong. The prevailing thinking was: "If Institution X is doing it, why shouldn't we?" During the financial crisis, prior easy-credit policies contributed to the failure of such companies as Washington Mutual and IndyMac, which were sold by federal regulators.
If corporate culture is perceived as punitive toward those who raise awareness of escalating risks, then any risk process is useless. People will turn their backs on a problem, hoping it goes away. Culture must allow for intellectual honesty around existing and potential risks without people facing "kill the messenger" repercussions. JPMorgan Chase (JPM) Chief Executive Officer Jamie Dimon, for example, is known for promoting openness and accountability in his organization, which allows risks to be uncovered and problems to be dealt with before they escalate.
Leaders Must Welcome Risk
To get the most value out of risks taken, companies need to engage in intelligent conversations around risk, setting the tone from the top. As Anne Mulcahy, the former CEO of Xerox (XRX), has noted: "Taking risks is something that a leader has to do in order to really perform and keep the company moving forward." The debate needs to occur at every level, especially among senior leaders. For chief executives and boards of directors, the risk debate must accompany all major decisions and allocation of resources.
Yet even at the board level, culture plays an important part in framing transparency around risk. As Michael Thaman, chairman and CEO of Owens Corning (OC), has observed: "The best way to insure against risk is to make sure that the DNA of your company is right. Ultimately, that shapes the way you operate." Directors need to have substantive, candid conversations. They have to talk about the elephant in the room rather than pretend it doesn't exist.
The risk debate also needs to be robust and fact-based, not just a perfunctory exercise. Our research indicates that among the 100 largest companies in the U.S., almost 50 percent are moving the risk-management discussion from the audit committee to the entire board.
When the debate is real, it results in what I call a risk-intelligent culture. This allows leaders to understand the perils and opportunities around risk and make informed decisions accordingly. Leaders' attitudes toward identifying and mitigating risks set the standards for others in the organization.
In a risk-intelligent culture, people are able to discern between causes and symptoms. In the midst of a crisis, symptoms get all the attention. The underlying causes, however, are what really matter. Put another way, a five-alarm fire is really a symptom. The faulty wiring and the code violations are the problems that should have been identified and addressed in the first place.
Did BP Discourage Tough Questions?
In order to get to those causes, difficult questions must be asked, such as we have seen in media reports regarding the investigation into BP (BP) and its handling of the oil well catastrophe in the Gulf of Mexico. Questions include: Was there a disconnect between what leadership said (i.e., "safety is paramount") and the implied message ("cutting costs is the real priority")? Did the company's culture inadvertently discourage people from acknowledging problems when they were relatively minor and easily addressed?
The more risk-conscious an organization is, the more intelligent its risk-taking becomes. The goal is not to do away with risk, but to embrace it. In every industry, innovation and expansion require taking on some degree of risk. For example, a mining company and a pharmaceutical company both rely on discoveries to fuel growth, so they must each proceed with a high degree of risk. Staying with the status quo is not an option.
Some successful companies even set aside risk capital that they deploy specifically for the purpose of taking risks. In their cultures, the far bigger threat is that risks will not be taken. Not every venture or attempt will succeed. Failure is tolerated—while playing it too safe is not.
Whatever the industry or business they are engaged in, companies need to take on some level of risk. Otherwise, they put themselves in an even-more-perilous position—that of taking no risk. A company that takes no risks can't make any money; it will shortchange its future. As Daniel Vasella, chairman of Swiss pharmaceutical company Novartis (NVS) told us: "Just staying inert in a moving world is crazy."
Risk is really about taking the opportunity to grow, expand, and compete more effectively. After all: no risk, no reward.