Few corporations set out to make risk. But that's what happens every time a decision is made.
Appoint a CEO and a risk is made. Approve the strategy and a risk is made. Acquire abusiness and a risk is made. It's hard to imagine any meaningful board decision that doesn't simultaneously create the hope of strength, resilience and endurance and the fear of weakness, vulnerability and insolvency.
Risks are best made and then managed.
Despite this, the focus of the governance community continues to be on managing the risk rather than the causes of the risk.
Risk now occupies the center of governance frameworks. According to Deloitte:
Risk intelligence is at the center of an effective framework for corporate governance - and it lays the foundations for everything the board and management do to properly govern the corporation.
What follows is a logical system of defining risk, setting risk appetite, formulating risk tolerances, adopting standards, delegating responsibilities, establishing risk committees, implementing risk programs and embracing the boards role of chief monitor of the corporation's strategic, operational, financial and compliance risks.
And, its hard to argue with this logic. But is it a false opposite? The argument seems to be that to solve the problem of excessive risk we need more risk management. But what if excessive risk was not the cause but the symptom. What if the real problem is underwhelming commercial acumen? Would the solution be the same?
Risk management is the second best solution. The best solution is to ensure the risks we fear don't find their way in.
If it's our decisions that make the risk, commercial intelligence should be at the core of the corporation.
To rephrase Deloitte (with apologies):
Commercial intelligence is at the center of an effective framework for directing - it lays the foundations for everything that board and management do to properly direct the corporation into strength, resilience and endurance.
Commercial intelligence is old fashioned good judgement - the ability to weigh up the competing forces of risk and reward and to use a variety of techniques to bring them into the best possible balance. Commercial acumen is what identifies the value and simultaneously creates the risk. With good acumen you get commercial risk. With bad acumen you get false opportunities and excessive risk.
So how do you use commercial intelligence to make the best commercial risk and avoid false opportunities?
Start by managing promises. Corporations are mostly promises and the people who keep them. Every thing a corporation owns can be traced back, in one shape or another, to those two things. And, every thing a corporation will be can be traced forward to promises and people. And the most effective way to lose all that value is by making bad risks by making a bad promise.
Even reputation risk can be managed by promises. One measure of brand is the difference between promises made and promises kept. The gap is your brand delta. The bigger the gap the bigger the risk to your reputation.
Next time you are called on to make a promise for your corporation, mind the gap, and ask whether these questions might help you to make the best risk.
- Do we intend to keep our word?
- Can we make the promise?
- Why exchange promises?
- What value is received?
- What value is given?
- What are the assumptions behind the promise?
- What constraints does the promise put on future choices?
- What's the risk of a failed promise?
- What's the risk of a failed promise leading to weakness, vulnerability and/or insolvency?
- Is the risk "baked" into the promise?
- has the risk been "priced"
- has the the risk be shared appropriately
- has the risk be mitigated
- has the risk be traded to a third party
- is the remaining risk worth it.