How Risky is your Company?

Today I picked a special article on corporate risks. “How Risky is your Company?” by Robert Simons of the Harvard Business School. Its a more business oriented view on how companies should handle risks, internally. But since internal risk management can be seen as a part of supply chain risk management, I also include it here.

Risk exposure

This article is about how risky one company is. About the internal risk. And by these risks, the author does not so much refer to the production processes, but the softer risks of managing a company.

The key contribution of Simons is the Risk Exposure Calculator. Of course not all risks are unintended. Most people would argue that risk is part of doing business, so a good risk calculator would only include the unwanted and unrecognized risks.

It is also not the goal to find one specific number to pinpoint the risks of a company, but to give hints for improvement.

Risk Exposure Calculator

The key elements of Simons calculator are three internal pressures: due to growth, culture and information management. A version of the calculator can be found in figure 1.

Figure 1: Tool to Calculate the Risk Exposure of a Company (Simons, 1999)

There are three pressure points in each category:

Growth

• Pressure for performance
  Setting challenging goals can have stimulating effects on employees, but also increase risks when employees try everything to achieve those goals: “They may, for example, accept customers with poor credit ratings or cut quality to accelerate operations.”

• Rate of expansion in operation
  If companies are expanding at a faster rate than the knowledge of their employees, it can also lead to additional risks: “Managers should ask themselves: Are operations expanding faster than our capacity to invest in more people and technology?”

• Inexperience of key employees
  This can also be a problem in times of growth, when key managers are employed without sufficient training.

Culture

• Entrepreneurial risk taking
  Risk taking is part of daily business and also a reason why a profit can be reaped from those deals. But of course, the more risk a company takes the more it has to take care of.

• Bad news
  This point measures how information, especially the bad news, travel upwards to the management. So the questions to ask here are: “How much bad news do I actually hear? Have I surrounded myself with ‘yes men’?”

• Internal competition
  For some conglomerates this last cultural pressure point is just the way of making business. But internal competition can also have negative effects like decreased information sharing within the whole company, and thus increasing risks.

Information Management

• Transaction complexity and velocity
  “To determine the score on this point, managers should do a rough calculation in their heads. What were the complexity, volume, and velocity of information a year ago? Have they risen, and by how much?”

• Diagnostic performance measures
  Simons argues that performance measures are often neglected in times of growth. This point should have a high score, if there is: “a feeling of frustration – a sense that it’s hard to get the right data at the right time. When there are gaps in diagnostic performance measures, managers end up getting the information they need by making phone calls and walking around. In short, they spend a lot of time doing the work a computer system should be doing.”

• Decentralized decision making
  The last point here is decentralized decision making, which can be used to improve motivation and performance. But also local managers often do not fully follow the guidelines set by the company and also information flow might be disturbed.

Overall the risk index can be calculated by adding up the individual scores. But the insights you gain are by answering the questions and not by the resulting number alone.

Controlling internal risks

Simons suggests ways to manage the above mentioned risk by focussing on five questions (figure 2).

Figure 1: Ways to improve Control and Reduce Risks within a Company (Simons, 1999)

Conclusion

This article after all was more inward facing than I thought, but nonetheless operational risks are an important part of every-day business and of course strategic management. Operational risks as described here probably became a little outdated due to some unpopular initiatives as the Sarbanes-Oxley Act (USA) or BilMoG (Germany), but there is a lot of potential for improvement and Simons describes several good cases supporting his points.

The major conclusion from his research is the contradiction between risks in times of high growth. All the risks Simons presented are usually growing during the “good times” when the business is growing. And many cases show that those risks can be the reason why those companies went out of business after the growth period was over.

This research can give you clues where improvements are necessary and also shows levers to improve control within the company again.