Managing Risk: An Enterprise-wide Approach.

• Author: Barton, Thomas L.

Managing risk on an integrated and enterprise-wide basis is a vital issue confronting executives. The CFO is a key decision maker in crafting the company's strategy.

Twenty-first century businesses worldwide operate in an environment where forces such as globalization, technology, the Internet, deregulation, restructurings and changing consumer expectations -- are creating much uncertainty and prodigious risks. Consider, for example, that no force is having as great an impact on business today as the Internet. And as the Internet evolves, companies in all industries are rethinking the basics: business models, core strategies and target customer bases.

These new developments create new issues related to risk and risk management. Managing risk on an integrated and enterprise-wide basis is a vital issue confronting executives, with the CFO a key decision-maker in crafting the company s strategy. "I think the point to risk management is not to try and operate your business in a risk-free environment. It's to tip the scale to your advantage. So it becomes strategic rather than just defensive," observed Peter Cox, chief financial officer of United Grain Growers Ltd. (of Canada). To some extent, no matter what its products or services, every organization is in the business of risk management.

Most executives would likely agree that risk management is part of their job, and there is probably agreement that risks are increasing rather than decreasing. But ask executives to elaborate on risk management and you'll no doubt get a variety of answers: "It's about preventing disasters," or, "It's something the insurance or finance people handle."

Is it just business management?

What does "risk management" mean to management in today's companies? Financial Executives Research Foundation recently published a book summarizing research on the subject gleaned from five companies in diverse industries. The book, Making Enterprise Risk Management Pay Off, reports on how the five are implementing enterprise-wide risk management. The companies studied were: Chase Manhattan Corp. (now J. P. Morgan Chase & Co.), E.I. du Pont de Nemours and Co., Microsoft Corp., United Grain Growers, Ltd. and Unocal Corp.

One key finding is that risk management is not just about finance, insurance or disasters. It's about running the business effectively and understanding, at the core, the fundamental risks facing the business. Tim Ling, president and chief operating officer of Unocal (and the company's former CFO), emphasized, "I think you will see almost all companies over the next few years moving in the same direction [as we are], really trying to integrate the notion of risk management with the notion of just business management. To me, running a business is all about managing risk."

Successful companies, almost by definition, have managed risks well, but practicing "risk management" has typically been informal and implicit. Some companies may have survived without ever knowing their real portfolios of risks. Taking an implicit approach to risk management can be risky itself, as it's caused some major surprises to companies unaware of the explicit risks. Examples include major debacles such as product recalls or fraudulent securities trading, major shifts in markets that management missed or saw too late, and increasingly complex environmental or business changes not recognized by management. Successful risk management...