Ensuring respect for risk

Most executives understand the need for controls that alert them to trends and behaviors they should monitor, the better to mobilize in response to an evolving risk situation. And while managers are unlikely to approve of skirting the very guidelines and controls they have put in place, some unintentionally promote situations and behaviors that undermine them. For example, while too few controls can obviously leave companies in the dark as a situation builds, too many can be even more problematic. Managers in such cases mistake more controls for tighter management of risk, though they may be inadvertently encouraging undesired behaviors. In one large hospital system, managers had implemented so many guidelines and controls for ward procedures that the staff saw them as impractical. As a result, they routinely circumvented them, and the culture became increasingly dismissive of all guidelines—not just the less practical ones—to the detriment of patients.

Even companies with the right number of controls in place encounter difficulty if managers do not monitor related trends and behaviors. Companies often unconsciously celebrate a “beat the system” mind-set, rewarding people who create new businesses, launch projects, or obtain approvals for things others cannot—even if it means working around control functions in order to get credit lines or capital allocations, for example.

In the best of cases, respect for rules can be a powerful source of competitive advantage. A global investment company had a comprehensive due-diligence process and sign-off requirements for investments. Once these requirements were fulfilled, however, the board was prepared to make large, early investments in asset classes or companies with the collective support of the senior-executive team, which was ultimately accountable for performance. Company-wide confidence in proceeding resulted from an exhaustive risk debate that reduced fear of failure and encouraged greater boldness relative to competitors. Confidence also stemmed from an appropriately gauged set of risk controls and an understanding that if these controls were followed, failure would not be regarded as a matter of poor decision making.