1. A company has proper risk controls in place and is successful/profitable
2. A company does not have proper risk controls in place and is successful/profitable
3. A company has proper risk controls in place and is unsuccessful/unprofitable
4. A company does not have proper risk controls in place and is unsuccessful/unprofitable

The Success Paradox

The term “Success Paradox” has been used to refer, among other things, to individuals that are economically successful not being as happy as those less economically well-off, to the increased vulnerability of developed countries to diseases such as measles, and to the concept that an enterprise, such as a poverty NGO, can put itself out of business if it is successful.

All these references are useful, but our use of the term is specifically in reference to situations where a risk is present and successful mitigation of that risk, in hindsight, reduces the risk’s perceived importance. One great example is the Y2K problem. Since there were no major catastrophes related to Y2K, there is a tendency for people to assume it was not really a problem in the first place! However, the fact that no catastrophes occurred might also be attributable to the excellent risk mitigation efforts of thousands of companies and individuals working diligently to fix the exposure.  In essence, effective ERM can cause a business to run very smoothly, which actually lessens the perceived value of the ERM implementation.

The Four Quadrants

In the first quadrant, effective ERM leads to enterprise success.  This quadrant describes a company that is maximizing long-term profitability.  If management understands the role that effective risk controls played in the success, they will appreciate its importance.  However, it is often the case that the perceived importance of the risk controls will be diminished, just as Y2K controls were downplayed after a relatively uneventful Jan 1, 2000.  This is the Success Paradox.

The second quadrant, however, is slightly different in that it deals with chance/luck. It is analogous to Russian Roulette.  In this situation, a Russian Roulette play might assume there is no danger to the game because no damage occurred from his “turn”. In a sense, he is still successful/profitable, but that does not mean his actions were risk free, or that he made the right decision to play. He just got lucky, which is the operative word; he could very well have died.

The third quadrant, is one we rarely encounter.  With effective risk controls in place, companies rarely are unsuccessful.  They may go out of business, but this is usually due to, among other reasons, wanting to exit the industry or simply shutting down due to retirement.

The fourth quadrant is one in which poor risk management controls and operations lead to business failure.

Prevalence

Because effective risk controls do not exist in most businesses, quadrants one and three are the most rare.  Companies in quadrant one are usually at the top of their industry.  They have spent a good deal of time implementing effective risk controls and have excellent long-term strength and security to show for it.  They rarely experience business failure, more commonly just closing up shop in an orderly business when they decide to exit a business.

The second quadrant is the most prevalent in the business world, and especially in the construction industry.  Most companies skate by with ineffective risk controls in place; they may stay in business but do not maximize long-term profitability and remain susceptible to numerous risk exposures.  Unfortunately, many of them are not so lucky and find themselves in the fourth quadrant.  That is why tens of thousands of contractors go out of business each year; poor risk controls leading to undue exposure to risk.  Millions more simply get “lucky” and remain to battle the risk gods another year.

Our goal with MyRiskControl.com is to make quadrant one the most prevalent in the construction industry.  How do we do that?  By making ERM simple, affordable, accessible and easily manageable.  In essence, by bringing ERM to the masses and an extremely cost effective manner.  Speaking of costs, we’re often asked what the typical ROI is for implementing an ERM program.  Unfortunately, this isn’t an easy question so it will be the subject of a future post.

“Against the background of an ever tougher risk environment and growing demands from investors, regulators and rating agencies, PricewaterhouseCoopers says that many insurers and other financial services organisations are asking questions about the effectiveness of enterprise risk management and its ability to deliver a return on investment or meet the expectations of stakeholders.”

The article is worth reading.  One of the key points made is:

“…the study found that enterprise risk management is, in many cases, neither relevant to nor clearly understood by business teams. It is not fully embedded into strategic decisions and its integration into day-to-day decision making and frontline risk taking within many insurance companies remains limited, potentially undermining its ability to deal with a more complex risk environment and more exacting stakeholder expectations”

This article mainly addresses ERM within financial institutions.  These companies have a very real need for ERM, especially with a broad range of exposures to interest rates, natural disasters, and general economic turmoil.

That said, the takeaways apply to all business enterprises.  In essence, ERM adoption can be held back due to it’s complexity and the inability of current practitioners to properly teach the marketplace about its proper use.  Many look to Enterprise Risk Management as a holy grail that will lead to zero losses, and soaring profits.  Unfortunately, this ideal can be quite damaging, especially for those expecting quick results and not fully realizing the amount of work and effort that is actually necessary to make real, lasting change.

Since the topic of Enterprise Risk Management can be quite overwhelming, it’s important that practitioners work to translate it’s implementation into actionable items that can be performed by individuals with no prior experience.   By doing so, everyone in an enterprise can be involved and take ownership in the process, helping create a risk management culture, rather than a dictatorial risk management approach that almost always fails.