“Roads to ruin” – a study of major risk events

Risk is at the heart of strategy, and boards and specialist risk functions must work more closely together to avoid or mitigate the catastrophic consequences of events. That was the conclusion of Roads to ruin, a study of major risk events: their origins, impact and implications.

The study was commissioned by Airmic, the association for people with a responsibility for risk management and insurance for their organisation, and was conducted by Cass Business School.

The study investigated the origins and impact of a number of major corporate crises in the ten years from 1999 to 2009. They involved substantial, well?known organisations such as Coca-Cola, Firestone, Shell, BP, Airbus, Société Générale, Cadbury Schweppes, Northern Rock, AIG, Independent Insurance, Enron, Arthur Andersen, Railtrack, the UK Passport Agency and also some smaller firms.

Several of those organisations did not survive, and most of the rest suffered severe damage.

The aim of the research was to:

• trace the deeper causes of the crises
• assess the post-event resilience of the companies involved
• consider the implications for the risk management of companies in general.

The report featured 18 detailed case studies that analysed the impact of critical events – both on the enterprises most directly affected and, in many cases, on other associated firms. There are references to around 40 organisations in total.

The case studies provide a rich source of lessons about risk, risk analysis and risk management, in the context of critical events of many different types. These events ranged from fires, explosions and product-related and supply chain crises to fraud and IT failures. The report details more than 100 specific lessons about risk that emerge from the case studies.

Much broader lessons have also been distilled from the case studies. Several of the firms studied were destroyed by the crises that struck them. While others survived, they often did so with their reputations in tatters, and faced an uphill task to rebuild their businesses.

The firms most badly affected had underlying weaknesses that made them especially prone both to crises and to the escalation of a crisis into a disaster. These weaknesses were found to arise from seven key risk areas that are potentially inherent in all organisations and that can pose an existential threat to any firm, however substantial, that fails to recognise and manage them.

These risk areas are beyond the scope of insurance and mainly beyond the reach of traditional risk analysis and management techniques as they have evolved so far. The report recommends that they should be drawn into the risk management process. They are as follows:

1. Board skill and NED control risks – limitations on board competence and the ability of the non-executive directors (NEDs) effectively to monitor and, if necessary, control the executives.
2. Board risk blindness – the failure of boards to engage with important risks, including risks to reputation and “licence to operate”, to the same degree that they engage with reward and opportunity.
3. Poor leadership on ethos and culture.
4. Defective communication – risks arising from the defective flow of important information within the organisation, including to board-equivalent levels.
5. Risks arising from excessive complexity.
6. Risks arising from inappropriate incentives – whether explicit or implicit.
7. Risk “glass ceilings” – arising from the inability of risk management and internal audit teams to report on risks originating from higher levels of their organisation’s hierarchy.

The report concludes that to deal with these risks a number of developments are necessary:

• The scope, purpose and practicalities of risk management will need to be rethought from board level downwards in order to capture these and other risks that are not identified by current techniques.
• The education of risk professionals will need to be extended so that they feel competent to identify and analyse risks emerging from their organisation’s ethos, culture and strategy, and from their leaders’ activities and behaviour.
• The role and status of risk professionals will need to change so that they can confidently report all that they find on these subjects to board level.

However, these risks will remain unmanaged unless boards – and particularly chairmen and NEDs – recognise the need to deal with them. Boards will also need risk professionals with enhanced vision and enhanced competencies to help them do so.

For advice on placing risk at the heart of your business strategy, contact me by email or call me on +44 (0)20 7099 2621.

Terry Irwin is a management consultant with international experience in strategy development, business turnarounds, venture capital, M&As and project management. He is a founder director of TCii Strategic and Management Consultants and has helped a broad portfolio of international clients to achieve profitable, sustainable business growth.

The above article is from TCii's library of best business practice snapshots.