TAILORING BESPOKE BEST PRACTICES: HOW COMPANIES CAN AVOID THE PITFALLS OF A ONE-SIZE-FITS-ALL APPROACH TO RISK MANAGEMENT.

• Author: Widmer, Lori

Best practices are often born out of failure.

The deadly Tylenol poisoning spree in 1982, for example, became the model of crisis management. Parent company Johnson & Johnson acted quickly to pull product off shelves, publicly warned consumers not to use their product, and set up a toll-free hotline for consumers to call with their concerns. The company was hailed for a swift response that put the emphasis on consumer safety over profits, creating a model that many companies still emulate today.

Yet some best practices can actually hamper a company's ability to succeed. As markets, economies and consumer needs change, companies may find themselves unable to take risks or move forward, hamstrung by, of all things, best practices.

THE TROUBLE WITH THE BEST

Broadly, best practices refer to the processes, frameworks and guidelines established by an authority, such as an external regulator or internal management, that dictate a recommended course of action. These practices are often the "industry-standard" method of achieving a desired result, whether that is a financial outcome, compliance benchmark, security or ethical standard, or some other goal.

While best practices can be helpful for establishing efficient business processes, Dr. Jing Ai believes part of the trouble lies in how they are characterized within an organization. A professor of finance at the University of Hawaii's Shidler College of Business, Ai says that simply following best practices without question does not necessarily lead a company toward the right risk management strategies.

"Under different circumstances, one can either fall short of adequately managing their risks or waste resources by engaging in unnecessary risk management activities by blindly following these 'best practices,'" she said.

In the case of risk management, the assessment of risk and the review of potential mitigation strategies are often complex, requiring a high level of knowledge about the company and how it is equipped to respond to potential risks. Developing a risk management strategy involves many unique factors and a good deal of decision-maker input, and best practices may not fit into the equation.

That may be because many companies assume that all best practices are universally compatible. "It's a one-size-fits-all mentality," said Bob Sibik, senior vice president of Fusion Risk Management. "It presumes that everyone wants to--or should--perform risk management the same way."

This way of thinking does not take into account the company's unique identity. Sibik believes a better approach is to...