Modern Corporate Risk Management

A Blueprint for Positive Change and Effectiveness

Glenn Koller

• Publisher: J. Ross Publishing
• Year: 2007
• Print ISBN: 9781932159523
• eBook ISBN: 9781604276466
• Edition: 1
• Topic: Business
• Subtopic: Business Strategy
• Index: Business

21st century companies are constantly evaluating and re-evaluating the risk inherent to their businesses. Many firms have instituted risk management programs to plan for and better protect key investments and risk-related change management initiatives to execute change in the organization. This implementation, however, can be difficult due to its complexity and because many areas of the firm can be resistant to change. Modern Corporate Risk Management offers forward-thinking, practical solutions to the technical, organizational, cultural, and political problems related to corporate portfolio risk management, including how to realize the related changes needed in most corporations to become effective. Written in an easy-to-understand format by an expert who has worked in a broad spectrum of businesses and industries, this book explores using probabilistic techniques for budget/portfolio processes and estimating project value, implementing external verification and "assembly line" processes, promoting holistic thinking, and encouraging cross-silo interactions. This valuable reference is for anyone who has responsibility for managing enterprise or project management risk.

DEFINE THE CONCEPTS AND TERMS

It is generally good form to explain the concepts and define terms right up front. This chapter, and most of this book for that matter, addresses the inner workings of corporations, projects, and their associated problems with regard to risk. Therefore, I thought it prudent to get some fundamental definitions and conveyance of concepts behind us. To that end, the next few pages address some of the major terms and concepts that you will need to comprehend.

Because this is a business book, the fundamentally technical issues are given a relatively light treatment; concepts are explained, but the really juicy technical aspects are eschewed. A guy like me, who is a technical sort at heart, usually finds it frustrating, if not downright difficult, to avoid launching into diatribes focused on considerations that more business-oriented folks would find less than interesting.

Therefore, in the text that follows, I generally direct you to other texts in which myself and other authors have addressed the technical aspects of the terms and concepts presented here. In one of my previous books, Risk Assessment and Decision Making in Business and Industry: A Practical Guide, 2nd Edition (see Selected Readings at the end of this chapter), I explore and explain much of the technical nature of these terms and concepts. The reader is specifically directed to that text for more complete coverage.

Now, if I were the quintessential businessperson reading this chapter, I likely would not want to read any more text relating to technical and/or conceptual information than necessary. With that in mind, I recommend that if you are less technically inclined, you press on in this chapter until you have read the “What Is a Project” and “What Are Risk and Uncertainty” sections. Upon finishing those sections, you might want to skip to Chapter 2 and read on until, in later chapters and sections of this book, you are directed back to Chapter 1 to read about a concept. This way, the context in which the concept exists will have been explained and the description of the concept will make much more sense.

WHAT IS A PROJECT?

So when I write about projects, just what do I mean? Any number of dictionary definitions for “project” include the following attributes. A project is

• Planned
• Large and/or important
• Long term

I agree with all of these characteristics, but for the context of this book, I would add these attributes:

• Budgeted
• Time constrained

Certainly a project should be planned. Most projects in modern corporations proceed through some sort of stage-gate process that typically includes steps that address assessing, selecting, defining, “building,” and executing the project. Of course, planning should be holistic and include areas such as security and logistics, as well as commercial, financial, technical, legal, environmental, cultural, organizational, political, and other aspects.

By virtue of being identified as a specific project (with a name, dedicated staff, etc.), these undertakings usually are either large undertakings relative to the size of the business, important in that they might have significant financial, reputation/other impact, or both. Many corporations choose to employ their entire suite of project management processes only on “major projects.” Typically, a major project is defined as one that meets or exceeds a defined threshold—usually a monetary value or capital-spend metric.

Most projects are long-term relative to other business undertakings but not necessarily so. For example, the planning phase for a one-night corporate event might take months, but the event itself (i.e., the project) is almost instantaneous. In a case such as this, the planning for the project becomes the project. However, it is more the case that all of the stage-gate project preparation activities and execution of the project itself are long-term relative to other everyday activities in a business.

It is typical that a project has an associated dedicated budget. Line items in the budget address costs associated with specific project tasks. Just how probabilistic budgeting can be used to great advantage in projects and portfolios is discussed in detail later in this book.

Most projects are time-constrained. This is different and distinct from the “long-term” item above. It is not unusual for a project to be outlined on a Gantt chart on which are described the various critical project steps and their absolute and relative timings. Each phase or step on the chart can be time-constrained, and the “sum” of all steps shown delineates the total project time.

WHAT ARE RISK AND UNCERTAINTY?

These concepts and definitions regarding risk and uncertainty were first put forth by my earlier work, Risk Assessment and Decision Making in Business and Industry: A Practical Guide, 2nd Edition.¹ “Risk” has been defined in many texts and by a host of people in various disciplines. An individual’s perception of risk depends mainly on the contextual setting in which that person finds him- or herself.

For example, denizens of a corporate finance group or trading department typically think risk is great! In fact, they seek it out. Why? Because higher risk means higher rewards. Without getting into discussions of distribution tails and other such perceived caches of reward, folks who make their living in the aforementioned disciplines know perfectly well that they would like to take on as much risk as they can handle (hedging and all sorts of other tactics are used to help allay the negative side of risk, but exploration of those concepts is not pertinent to this discussion). Certificate of deposit (CD) interest rates at your local bank work this way. If you allow them to tie up your money for a relatively short time (i.e., low risk for you), then the interest rate you receive is relatively low. Conversely, longer-term CDs yield higher interest rates because you are allowing them to have your money for an extended period (i.e., higher risk for you).

So, these finance and trading people run around seeking risk—although not more risk than they think they can handle. However, it is their job to maximize return on investment and, therefore, to seek to maximize the manageable risk. Their attitude is that a maximum amount of manageable risk is a good thing.

Contrast that with the people who inhabit the health and safety section or security department of a typical corporation. Their main job is to identify and eradicate even the smallest pertinent risks. To their way of thinking, risk is a bad thing and the world would be a perfect place if all risk were eliminated.

These are just two examples of myriad ways people perceive risk. As if that weren’t bad enough, it turns out that people express their perception of risk using a wide range of metrics and formats. Consider the weather forecaster on TV. Typically, this person expresses the risk of foul weather using percentages (“Yes, folks, I’m going to say that there’s about a 60 percent chance of tornadoes tomorrow.”) or maps on which various colors might indicate the relative severity of winds or other indicators of inclement weather.

Even though it makes me break out in hives every time I run across this, some people are prone to equate risk with probability. It is not unusual to hear: “Yup, the risk of this not working out is better than 50 percent.” Over the years, I have worked much with law departments, helping them evaluate cases, contracts, and the like. While it is true that if you have come to the typical law department to have something calculated, then you have made a grievous error, it is also true that, in my experience, attorneys are among the best practitioners at explaining in textual form any perceived and pertinent risks. Engineers tend toward quantitative expressions of risk such as cumulative frequency plots, while people in quasi-quantitative areas of endeavor tend toward semiquantitative expressions such as red/yellow/green (high/medium/low) “traffic light” displays, Boston squares, and the like. Just some of the formats and metrics typically utilized to express risk are as follows (some already mentioned):

• Percentages
• Colored displays
• Textual descriptions
• “Traffic light” displays
• Meters (like a speedometer in a car)
• Bar charts
• Boston squares
• Probability versus impact charts
• Cumulative frequency curves (see the Monte Carlo section of this chapter)
• Risk registers
• Tornado diagrams

and many other means and mechanisms.

In a walk across any corporation you will quickly discover a population harboring a wide variety of views on risk and that uses a cornucopia of mechanisms and metrics to express its perception of risk. As will be demonstrated in later chapters, the value of any project can only be properly assessed when the impacts of all risks have been considered and applied. A holistic accounting of risks has to be taken. That is, for any given project, risks from

• Law
• Finance
• Commercial
• Security
• Logistics
• Engineering
• Science
• Health and safety
• Human resources
• Planning
• Environmental

and other areas must be identified and integrated so that the full and combined consequences of all risks properly impact the perceived project value.

Well, that’s easy to say but not so easy to do. So, how do you even begin such an undertaking? It starts with language. Later in this book, I address in more detail the importance of generating a common and agreed-upon set of terms and definitions that will facilitate communication between the various factions and fractions of an organization. There are some caveats to this, however.

First, if a person in a given discipline has long viewed and defined risk in a particular way, I have discovered that it is folly to attempt to get those folks to change their ways and adopt a “common method.” I am of German descent. Upon a visit to Germany some years ago, I discovered that there were many dialects that compose the “German” language. This is typical of many languages. I also discovered that newspapers and other forms of communication in the area I visited usually employed “High German,” which was a “dialect” that most Germans could understand and shared as a common means of communication. I decided later in life that this model was just what risk communication within an organization needed.

In any organization, then, it is my advice to “let sleeping dogs lie,” so to speak. For example, if the finance department views and uses risk in a way that is radically different from the view and use in the health and safety department, then so be it—leave them alone (don’t try to change their dialect). However, what we can do is create a set of terms and definitions that we will all use when we communicate with one another (but not, probably, within our given discipline) and to management—the High German model. This advice regarding language will be, essentially, repeated in a subsequent section of this book, and it bears repeating because it is fundamental and important.

So, with regard to risk and uncertainty, I determined that there were actually four terms that needed to be universally addressed and understood:

• Risk
• Uncertainty
• Probability
• Impact (or consequence)

Many risk practitioners whom I have met tend, in my opinion, to “mix and match” the concepts of risk, uncertainty, and probability. I view these items as four distinct entities. Let’s start with risk.

If I were to ask you, “What are the...

Table of contents

• Cover
• Title
• Copyright
• Dedication
• Table of Contents
• Preface
• About the Author
• Acknowledgments
• Web Added Value™
• Introduction
• Chapter 1 Define the Concepts and Terms
• Chapter 2 Some of The Fundamental Problems
• Chapter 3 The Problems and Symptoms
• Chapter 4 Solutions to the Problems: Assessment of the Situation
• Chapter 5 Solutions to the Problems: Changing the Organization the Cast of Major Characters
• Chapter 6 Solutions to the Problems: Changing the Processes
• Chapter 7 Solutions to the Problems: The Aftermath