https://www.bcg.com/publications/2017/finance-function-excellence-corporate-development-art-risk-management Skip to Main [ ] Log in Log error View Profile Edit Profile Manage Subscriptions My Saved Content Logout [ ] * Our Services + Industries Industries Learn how we draw on industry expertise to make companies more competitive. o Aerospace and Defense Aerospace and Defense aerospace-and-defense Aerospace and Defense Our aerospace and defense experts help industry players navigate their day-to-day operations and identify ways they can innovate for the future. Visit Page o Automotive Industry Automotive Industry [] Automotive Industry Breakthroughs in automotive technologies and emerging business models are changing the world. We help the leading game changers stay ahead of the curve. Visit Page o Consumer Products Industry Consumer Products Industry [] Consumer Products Industry Brands around the world must master digital to survive. We have the expertise and capabilities to power consumer-centric innovation grounded in data, analytics, and AI. Visit Page --------------------------------------------------------- Within Consumer Products Industry # Fast-Moving Consumer Goods o Education Education Female teacher in classroom Education We partner with effective organizations and educators to improve student outcomes and learning models--from K-12 through higher education--locally, nationally, and globally. Visit Page --------------------------------------------------------- Within Education # Higher Education # K-12 Education o Energy Energy Energy Hero Energy BCG's energy consultants work with business leaders, governments, and ecosystems to create energy solutions for a net-zero pathway and beyond - that are practical, equitable, and just. Visit Page --------------------------------------------------------- Within Energy # Energy Transition # Power and Utilities # Renewables and Low-Carbon Solutions # Upstream Operations o Financial Institutions Financial Institutions Financial Institutions New Hero Financial Institutions BCG helps global and regional financial institutions build for the future using digital innovations and an ESG focus to drive fundamental change and deliver on evolving customer demands. Visit Page --------------------------------------------------------- Within Financial Institutions # Asset Management # Banking # Fintech # Payments and Transaction Banking # Wealth Management o Health Care Industry Health Care Industry [] Health Care Industry We work with organizations around the globe to transform health care operating models enabling them to deliver medical breakthroughs, innovative cures, and transformative patient experiences. Visit Page --------------------------------------------------------- Within Health Care Industry # Biopharma # Global Health # Health Care Payers, Providers, Systems & Services # Medical Devices and Technology # Oncology Solutions # Value-Based Health Care o Industrial Goods Industrial Goods [] Industrial Goods Our experts provide industrial goods clients with the skills they need to adapt to change and rethink their business models in their rapidly evolving industries. Visit Page --------------------------------------------------------- Within Industrial Goods # Agribusiness Industry # Building Materials Industry # Chemical Industry # Forest Products, Paper, and Packaging # Machinery and Industrial Automation # Metals and Mining Industry o Insurance Industry Insurance Industry [] Insurance Industry Customers increasingly expect more from insurers. BCG helps companies rise to the challenge and equips them to lead in the digital future. Visit Page --------------------------------------------------------- Within Insurance Industry # Bancassurance # Insurtech # Life Insurance # Property and Casualty Insurance # Reinsurance o Principal Investors and Private Equity Principal Investors and Private Equity [] Principal Investors and Private Equity The rapid growth of private capital brings unprecedented opportunities to unlock value while making a positive difference in the world. BCG advises leading investors on how to stay ahead. Visit Page --------------------------------------------------------- Within Principal Investors and Private Equity # Fund Strategy and Operations # Portfolio Acceleration # Sustainability in Private Equity # Tech Capital o Public Sector Public Sector [] Public Sector BCG's Public Sector practice joins forces with global organizations and governments to transform how they operate so they can better meet increasingly challenging and complex societal problems. Visit Page --------------------------------------------------------- Within Public Sector # Defense and Security # Digital Government # Economic Development # Mobility # Space Sector o Retail Industry Retail Industry [] Retail Industry We help the world's leading retailers compete in the digital era by developing and delivering cutting-edge tech strategies and identifying new sources of growth. Visit Page --------------------------------------------------------- Within Retail Industry # Fashion Industry # Luxury Goods o Technology, Media, and Telecommunications Technology, Media, and Telecommunications technology-media-telecommunications-square Technology, Media, and Telecommunications BCG collaborates with technology, media, and telecommunications companies to solve problems and pursue new strategies as they continue to shape the future. Visit Page --------------------------------------------------------- Within Technology, Media, and Telecommunications # 5G Technology # Future of Television # Growth Tech # Media and Entertainment Industry # Semiconductors # Technology Industry # Telecommunications Industry o Transportation and Logistics Transportation and Logistics [] Transportation and Logistics We empower clients to boldly reinvent themselves and embrace digital innovation so they can better serve their customers amid today's volatility. Visit Page --------------------------------------------------------- Within Transportation and Logistics # Logistics # Postal and Parcel Industry # Rail Industry # Shipping Industry and Marine Ports o Travel and Tourism Travel and Tourism travel-and-tourism-square Travel and Tourism The industry has suffered an unprecedented shock. BCG collaborates with travel and tourism providers as they navigate this turbulence and build resilience for the future. Visit Page --------------------------------------------------------- Within Travel and Tourism # Airline Industry o Urban Planning Urban Planning [] Urban Planning BCG's urban planning consulting experts help cities drive growth, improve mobility, and enhance livability as urban populations are expected to surge by 2050. Visit Page --------------------------------------------------------- Within Urban Planning # Infrastructure # Real Estate + Capabilities Capabilities See how we help our clients expand their capabilities on multiple existing--and emerging--fronts. o Artificial Intelligence Artificial Intelligence AI V2 Hero Video Artificial Intelligence Scaling artificial intelligence can create a massive competitive advantage. Learn how our AI-driven initiatives have helped clients extract value. Visit Page --------------------------------------------------------- Within Artificial Intelligence # AI Agents # Generative AI # Responsible AI o Business and Organizational Purpose Business and Organizational Purpose [] Business and Organizational Purpose Excavating purpose is among the rewarding journeys companies can take. BCG BrightHouse helps organizations embrace purpose to achieve higher returns, employee engagement, and customer satisfaction. Visit Page o Business Resilience Business Resilience The CEO's Dilemma Business Resilience Leaders face an uncertain landscape. The impact of each decision feels impossible to predict, which is why they need strategies that are proactive, resilient, and competitive. No matter their starting point, BCG can help. Visit Page o Business Transformation Business Transformation business-tranformation-hero-2023.png Business Transformation Even today's leading companies could benefit from an always-on transformation capability--the kind that engenders resilience and leads to long-term value creation. BCG knows what it takes to build this muscle. Visit Page --------------------------------------------------------- Within Business Transformation # Business Restructuring and Turnaround # Performance and Value Acceleration Transformation o Climate Change and Sustainability Climate Change and Sustainability Climate and Sustainability Overview Ambient Hero Climate Change and Sustainability The time for global climate action is now. BCG helps clients accelerate their climate and sustainability journey and seize new opportunities to build competitive advantage. Visit Page --------------------------------------------------------- Within Climate Change and Sustainability # Climate Risk, Adaptation, and Resilience # Decarbonization # Green Growth Accelerator # Nature-Based Solutions # Sustainability Strategy and Transformation # Sustainable Finance and Investing # Sustainable Operations o Corporate Finance and Strategy Corporate Finance and Strategy [] Corporate Finance and Strategy The rules of business and for maintaining competitive advantage are changing. We help companies reimagine strategy and value creation in a fast-paced world. Visit Page --------------------------------------------------------- Within Corporate Finance and Strategy # Business Strategy # Corporate Strategy # Family Business # Finance Function Excellence # Strategic Planning # Value Creation Strategy o Cost Management Cost Management Cost-ambient-hero-still.png Cost Management BCG's cost advantage approach resets costs within a framework that is customized, precise, and thorough. Visit Page --------------------------------------------------------- Within Cost Management # Zero-Based Budgeting o Customer Insights Customer Insights [] Customer Insights Having rich customer insights allows companies to solve pressing business problems and capture growth opportunities. BCG's Center for Customer Insight arms companies with the tools they need to unlock this advantage. Visit Page --------------------------------------------------------- Within Customer Insights # Customer Data in Emerging Markets # Customer Data in Global Markets # Customer Demand # Customer Experience # Customer Journey o Digital, Technology, and Data Digital, Technology, and Data [] Digital, Technology, and Data BCG identifies and delivers high-impact programs to build companies of the future that will outperform the competition in the future. Visit Page --------------------------------------------------------- Within Digital, Technology, and Data # Agile at Scale # Augmented and Virtual Reality # Blockchain # Build-Operate-Transfer # Cloud Computing # Cybersecurity and Digital Risk # Data and Analytics # Data and Digital Platform # Deep Tech # DevOps # Digital Ecosystems # Digital Maturity # Digital Strategy # Digital Transformation # Emerging Technologies # Internet of Things # Metaverse Services # Quantum Computing # Synthetic Biology # Tech Function o Innovation Strategy and Delivery Innovation Strategy and Delivery [] Innovation Strategy and Delivery Innovation is extremely difficult--but also necessary. We collaborate closely with organizations on holistic innovation journeys to help them secure long-term competitive advantage. Visit Page --------------------------------------------------------- Within Innovation Strategy and Delivery # Business Model Innovation # Corporate Venturing # Product Innovation and Engineering o International Business International Business [] International Business We stand side by side with our clients, offering expertise and strategy as they look to expand the boundaries of their businesses in an uncertain and sometimes tumultuous world. Visit Page --------------------------------------------------------- Within International Business # Foreign Direct Investment # Go-to-Market Strategy for Emerging Markets # International Trade o Manufacturing Manufacturing [] Manufacturing We ask three guiding questions: when, where, and how will you manufacture in an era of emerging technologies and economic uncertainty? We're committed to helping our clients arrive at answers that are right for them. Visit Page --------------------------------------------------------- Within Manufacturing # Industry 4.0 o Marketing and Sales Marketing and Sales Person in a red shirt holding a blue cellphone and yellow card Marketing and Sales Customer centricity is key and made possible through analytics, agile processes, and a test-and-learn culture. BCG partners with marketing and sales organizations to make it happen. Visit Page --------------------------------------------------------- Within Marketing and Sales # Digital Marketing # Digital Sales # E-Commerce # Marketing Function Excellence # Personalization # Sales Channel Strategy # Salesforce Value Accelerator o M&A, Transactions, and PMI M&A, Transactions, and PMI [] M&A, Transactions, and PMI BCG provides the strategic decision-making capabilities and proactive portfolio management companies need to create value from M&A, transactions, and PMI. Visit Page --------------------------------------------------------- Within M&A, Transactions, and PMI # Carve-Out # Divestitures # Due Diligence # IPO # Joint Ventures # Mergers and Acquisitions # Post-Merger Integration # Strategic Alliances # Vendor Due Diligence o Operations Operations operations-rectangle Operations We help clients unlock value from every aspect of their operations, maximizing efficiency and effectiveness in procurement, service operations, supply chains, and beyond. Visit Page --------------------------------------------------------- Within Operations # Capital Projects Excellence # Digital Support Functions and Shared Services # Operational Excellence # Procurement # Service Operations # Supply Chain Management o Organization Strategy Organization Strategy [] Organization Strategy Organization is at the core of nearly everything we do at BCG. We believe that when clients have the right organization design, the possibilities are endless. Visit Page --------------------------------------------------------- Within Organization Strategy # Behavior Change # Culture and Change Management # Organization Design # Platform Operating Model # Smart Simplicity o People Strategy People Strategy [] People Strategy Any company's most important asset is its people. Our experts in leadership, culture, talent, reskilling, and HR help businesses respond to current and future challenges. Visit Page --------------------------------------------------------- Within People Strategy # Digital HR # Executive Coaching # Future of Work # Leadership Development # Talent and Skills o Pricing and Revenue Management Pricing and Revenue Management [] Pricing and Revenue Management We bring expertise and data-driven strategies to help clients unleash the power of effective pricing--and unlock its potential to increase the bottom line. Visit Page --------------------------------------------------------- Within Pricing and Revenue Management # B2B Pricing # B2C Pricing # Revenue Growth Management o Risk Management and Compliance Risk Management and Compliance Image of geometric shapes in green Risk Management and Compliance BCG's Risk and Compliance consulting supports their client's growth ambition with strategic, transformational, and technical functional offerings in Finance. Visit Page --------------------------------------------------------- Within Risk Management and Compliance # Balance Sheet Management # Commodity Risk Management # Compliance and Crisis Management # Credit Risk Management # Operational Risk and Resilience # Risk Advanced Analytics and Technology o Social Impact Social Impact Close-up image of a green leaf with a water droplet on it Social Impact By focusing on tangible ways to generate positive social impact (related to climate change, global education, racial equity, and more) we help organizations tackle some of the most pressing issues facing our world today. Visit Page --------------------------------------------------------- Within Social Impact # Food Systems and Food Security # Humanitarian Response # International Development + BCG X BCG X bcg bcgx banner.png BCG X BCG X disrupts the present and creates the future by building new products, services, and businesses in partnership with the world's largest organizations. Visit Page ------------------------------------------------------------- Within BCG X o The Multiplier Blog by BCG X o BCG X Product Library o Mark Your Moment * Our Insights Our Insights + Featured Insights Featured Insights [] Featured Insights Explore a cross-section of the latest insights and perspectives from BCG experts. Visit Page ------------------------------------------------------------- Within Featured Insights o Artificial Intelligence o BCG Executive Perspectives o Cost Management o Climate Change and Sustainability + The CEO Agenda The CEO Agenda THE-CEO-AGENDA-static.jpg The CEO Agenda A forward-thinking CEO agenda has never been more crucial. Our insights give you greater clarity on what lies ahead, helping you lead with confidence. Visit Page + BCG Henderson Institute BCG Henderson Institute BHi-banner-2800x963.jpg BCG Henderson Institute At the BCG Henderson Institute (BHI), we believe that leadership starts in the mind and that ideas precede action. We bring the ideas and inspiration that will help forward-looking leaders shape their next game. Visit Page + My Subscriptions My Subscriptions [] My Subscriptions Subscribe to our newsletters and e-alerts to stay connected with the latest insights, data, ideas, and perspectives from BCG. Visit Page * * BCG Alumni BCG Alumni [] BCG Alumni Access BCG's alumni network for former and current BCGers. Visit Page * Our Company + About BCG About [] About As a top consulting firm, BCG helps clients with total transformation--driving complex change, enabling organizations to grow, and driving bottom-line impact. Visit Page ------------------------------------------------------------- Within About o Our Commitments o Our History + Client Impact Client Impact [] Client Impact When strategy meets execution, extraordinary outcomes follow. See how leading companies around the world partnered with BCG to solve complex challenges, increase value, and change their trajectory. Browse the videos and stories that bring client impact to life. Visit Page + People People o Leadership Leadership [] Leadership Meet BCG's executive, functional, and regional leadership teams. Visit Page o People and Culture People and Culture People and Culture Hero People and Culture To unlock the potential of those who advance the world, we stay true to our company purpose, our values, and each other. Central to this pursuit is our ability to attract and retain the best talent from all backgrounds. Visit Page --------------------------------------------------------- Within People and Culture # Awards and Honors # Alumni # Careers + Offices Offices [] Offices With offices in more than 100 cities in over 50 countries, we have a truly global perspective. Visit Page + Corporate Newsroom Corporate Newsroom BCG Corporate Newsroom Corporate Newsroom Visit our media center for resources, press releases, trending topics, contacts, and more. Visit Page ------------------------------------------------------------- Within Corporate Newsroom o Media Contacts * Join Us Beyond Is Where We Begin. [] Beyond Is Where We Begin. When you start with Beyond there's no limit to how far we can advance the world. Explore Careers ----------------------------------------------------------------- Within Careers + Search Jobs + Early Careers + Culture, Values, and Inclusion + Experienced Professionals + Locations + Events Finance Function Excellence The Art of Risk Management By Ulrich Pidun, Marc Rodt, Alexander Roos, Sebastian Stange, and James Tucker Article April 30, 2017 Save It For Later Saved To My Saved Content Download Article Share Link copied The Art of Risk Management, which discusses the ten principles that should govern an approach to risk management, is part of a publication series by BCG on CFO excellence. The Art of Performance Management looks at the critical components of a best-in-class performance management system and operating model. The Art of Planning examines the ten principles driving best practices in corporate planning. In the aftermath of the global financial crisis, companies worldwide have become more focused on risk management. What was once a concern primarily of senior executives in the financial services sector has now become a top-management priority in nearly every industry. In a global survey of close to 1,500 C-suite executives conducted in the summer of 2011 by Harvard Business Review Analytic Services, more than two-thirds of respondents said that risk management had become somewhat or significantly more important over the previous three years. And in a March 2012 survey of finance executives by CFO magazine, 72 percent of respondents said their companies had increased the amount of time and resources devoted to risk management over the previous two years, with 23 percent calling the increase "significant." Risk management is essential in today's volatile economy. And yet many of the very financial firms that took such dangerous risks before the financial crisis had some of the most sophisticated risk-management operations around. What's more, some of the very few financial companies that had been praised for their deft risk management before the financial crisis have since gone on to make major errors. One dramatic example is JPMorgan Chase, which suffered a trading loss of $2 billion in 2012 due to trades that its CEO Jamie Dimon has termed "flawed, complex, poorly reviewed, poorly executed, and poorly monitored." We worry that in their headlong embrace of formal systems of risk management, many companies are making the same mistakes that companies in the financial sector made. Put simply, they are pursuing a highly technical approach to risk management--characterized by complex financial models and elaborate, formal risk-management systems--in isolation from the day-to-day activities of the broader organization. The result, as was the case at many banks, is that risk management may exist as a formal function, but it is not really embedded in the "mindset" of the broader organization and, therefore, is not shaping behavior and informing decision making. To be sure, metrics, systems, and processes are important. And for the vast majority of companies, it probably does make sense to create a formal risk-management function. But developing the right risk-management mindset and organizational culture is even more important--and, in our experience, far more difficult to implement. Companies need a new approach. They need to stop thinking of risk management as primarily a regulatory issue and to reconceive risk management as a value-creating activity that is an essential component of the strategic debate inside the company. The goal of that discussion should not be to eliminate risk, or even to minimize it, but to use it to create competitive advantage. And doing that effectively depends upon a far more dynamic interaction between risk management experts and the line organization. Ten Principles of Risk Management Creating a more dynamic managerial system for risk management is as much an art as it is a science. In working with our clients to develop this new approach, BCG has identified ten principles that should govern the art of risk management. (See "Ten Principles of Risk Management.") We describe these principles below. Ten Principles of Risk Management 1. Risk management starts at the top. 2. Risk cannot be managed from an ivory tower. 3. Avoid relying on black boxes. 4. Risk management is strategy, and strategy is risk management. 5. Risk management is more than a policy; it is a culture. 6. A risk-aware culture requires the free flow of information. 7. What matters is the "talk," not the "report." 8. The path is the goal. 9. It is possible to prepare for unknown risks. 10. Avoid the downside, but don't forget the upside. 1. Risk management starts at the top. Most managers are eager to talk about ambitious plans and favorable results. They are generally far less enthusiastic, however, when it comes to discussing potential--let alone actual--losses that affect the business. For this reason, risk management has to be a high-priority topic with a dedicated owner--either the CEO or some other senior corporate executive. Otherwise, the impulse will be to "kill the messenger" whenever lower-level executives raise sticky questions about potential risks or obstacles to an ambitious business plan. One approach that many companies are taking to emphasize the importance of risk management is to appoint a chief risk officer (CRO). According to the 2011 Harvard Business Review survey, roughly 42 percent of companies with 10,000 employees or more have such a position--compared with only 11 percent three years previously. Companies with a CRO typically have more advanced planning tools in major risk areas, such as cost of capital, financial regulations, information security, and internal planning and reporting. But just because a company has appointed a CRO doesn't necessarily mean that it has made risk management a high priority. The critical factor is to have a highly visible commitment on the part of the senior executive team to make risk management an integral part of the managerial decision-making process. At General Electric, for example, the board of directors and senior management annually develop a list of the priority risks the company will face in the coming year. The list is public and available throughout the organization. The CRO, who leads the company's risk function, has the responsibility of coordinating GE's risk practices with the line organization and business units, including identifying and appropriately managing specific risks and ensuring the enforcement of companywide risk policies. The CRO also reports back frequently to the CEO, CFO, and board in order to discuss the latest trends and any changes in the company's risk scenarios. Without this kind of active senior involvement and a management process that links high-level considerations of risk with practices at the frontline of a company's businesses, a CRO will have limited effect. Responding to the Harvard Business Review survey, about 41 percent of the CROs said that the lack of strong senior-management support was the primary barrier to embedding risk management deep in the company. 2. Risk cannot be managed from an ivory tower. As a company elevates the importance of risk management through the creation of, for example, board-level committees and a dedicated risk-management function, it also needs to be careful not to turn the risk management organization into a kind of ivory tower. Too often, the bigger and more centralized a company's risk-management function, the more likely it exists in isolation from the rest of the organization, with an insufficiently granular understanding of the actual business-specific risks the company faces. To avoid this outcome, risk management needs to be integrated into all of the company's routine management processes, including planning, capital allocation, controlling, and reporting. This integration needs to be done collaboratively with the operating management in order to secure buy-in at all levels of the organization. Simply imposing a process from the top rarely works. BCG has developed a framework that uses the metaphor of a house to describe a truly integrated enterprise risk management (ERM) system. (See Exhibit 1.) Under the "roof" of strong senior-corporate leadership, and built on a "foundation" of appropriate metrics and tools, cross-functional processes and rules for governance, and a companywide risk mindset and culture, the risk management process has three basic steps: * To understand the scope of risks that the company faces by identifying key areas of risk, evaluating the likelihood of risk, and developing processes for reporting new data to relevant stakeholders throughout the company * To plan for how the company will manage those risks, primarily by incorporating risk management practices into the company's various planning processes * To act to mitigate or take advantage of risks if and when they become actualized, whether through specific strategic, financial, or operational moves or through broader crisis-management activities [] 1 / 1 When establishing such a process, the goal should be to encourage the entire organization to regularly consider issues of risk and uncertainty. The system should enforce cooperation and a "risk business partnership" among risk experts in corporate headquarters and the company's businesses. In our experience, the best approach is to combine a central risk unit (led by the CRO) that provides general guidance with business unit risk experts who report directly to the business unit leaders and indirectly to the CRO. 3. Avoid relying on black boxes. Another shortfall of many risk-management systems is that companies become overly reliant on complex metrics or models. There are some highly sophisticated mathematical models for estimating risk, and many are embedded in software systems that are available on the market. Although sometimes appropriate, they can also obfuscate the risk management process, turning it from a transparent management activity into a frustrating black box. Take, for example, the use of value-at-risk (VaR) as an aggregated risk metric calculated on the basis of Monte Carlo simulations. The simulations quantify the expected range of outcomes given the range of potential uncertainties in key financial inputs. When the number of input factors is limited and their distribution is easy to estimate (for example, long time series, such as currencies or raw-material prices), these simulations are a useful way to assess business risks.^1 1 For an example, see the section "From Single Point Estimates to Probabilities" in "Risk Management Tool Kit," BCG article, September 26, 2011. But in many situations, the distribution of input factors and the correlations among them are difficult to identify. The problem may be due to the relative paucity of data points. Or the interdependencies among input factors may be so complex that an organization is tempted to make oversimplifying assumptions. The end result is a VaR based on a complex web of interrelated assumptions that are extremely difficult to make transparent to decision makers. In such situations, a simpler system might be better. Avoid pseudoaccuracy when the data are too patchy to allow for sophisticated statistical analysis. Instead of creating a complex analytical system, focus on facilitating the engagement of the organization with key risks through simple and accessible analyses. Encourage plausibility checks of underlying assumptions. Avoid generating output that serves only to distract the organization from arriving at conclusions and taking action. The appropriate level of complexity will be company specific and will depend on the industry, business model, availability of data, level of experience, and mandatory legal requirements. Banks, for example, can rely on massive amounts of data for complex statistical analysis. They also have long-term experience in interpreting complex metrics. What's more, they are legally obligated to have detailed risk-management systems in place. But many other industries are not in this situation. For an example of a company that strikes the right balance, consider the oil giant Chevron.^2 2 This example is drawn from the Harvard Business School case study "Environmental Risk Management at Chevron Corporation," Harvard Business School, March 10, 1999. All major oil companies face significant risk in their daily operations. Mishandling of oil at any stage of production could damage the natural environment, human health, corporate profitability, or all three as in the case of BP and the Deepwater Horizon oil spill in 2010. In the 1990s, approximately 9 percent of Chevron's total expenditures were environment related. Precisely because the management of environmental risk is so important to the company, senior executives at Chevron decided to focus its risk-management efforts on personal judgment rather than on complex analytical models. They reasoned that a certain degree of simplicity was necessary to keep employees motivated to deliver meaningful information to the company's ERM system. Onerous requirements would only lead to superficial compliance and bad data. So in 1997, the company developed a simple tool (known as DEMA, for "DEcision MAking") to help managers assess environmental risk as part of the capital allocation process. The tool requires managers to fill out a predefined assessment of the potential environmental risks of each project, with separate sections for their personal judgment and for quantitative assessments. Senior executives reasoned that in a capital-intensive industry such as oil exploration and processing, excellence in decision making is often more important than excellence in execution. In effect, DEMA embeds Chevron's risk-management procedures and processes into the day-to-day decision-making process about large capital investments. By helping managers set priorities among capital investment projects on a cost-benefit basis, the tool prompts managers to think carefully about potential risks and to make decisions that minimize them. In part as a result of the DEMA tool and process, the costs of environmental incidents at Chevron declined substantially. For instance, in domestic refining, such costs were reduced by more than 80 percent after the introduction of DEMA--from $110 million in 1996 to $20 million in 1998. 4. Risk management is strategy, and strategy is risk management. Perhaps because of its origin in the financial services sector, most companies tend to think of risk management primarily in terms of potential financial risks. Although it is an important dimension of risk management, we think this financial perspective is too narrow. Of the 100 companies with the largest stock-price losses during the period from 1995 through 2004, only 37 were hurt by financial risks (caused by unexpected price movements in financial instruments or raw materials), while 66, nearly twice as many, suffered from strategic risks (caused by failures in the company's operations or actions by competitors). Therefore, it is important to align risk management with a company's overall business strategy. The objective of both should be shareholder value creation. For example, if the company's business strategy includes an element of acquisitive growth, the risk management system needs to emphasize the associated risks of the M&A process. One example of a company that has worked hard to align its approach to risk management with its overall business strategy is Infosys, an Indian information-services company. Infosys has made "de-risking" one of its four strategic pillars and calculates what it calls degree of affordable risk--a composite measure of the risk threshold of the company. The goal of the approach is not to dissuade employees from taking risk but to make sure that they carefully think through the risks they take. Another implication of this strategic dimension of risk management is that companies need to work hard to identify all relevant risks--not just those that can be easily quantified. In our experience, some of the most relevant risks for a company may be those that are more qualitative in nature and, therefore, especially difficult to quantify--for instance, a serious product failure or a major change in a company's regulatory environment. (For a typology of the variety of risks companies face, see Exhibit 2.) [] 1 / 1 To identify these hard-to-quantify risks, we recommend a three-step approach. First, convene a series of workshops with representatives from the company's various businesses in order to develop a detailed list of all the potential risks facing the company. Next, prioritize the risks by developing a relatively high-level assessment of their probability and likely impact. But don't stop there. For the highest-priority risks on the list, take a third step: try to quantify what others say can't be quantified. Even if the risks can't be quantified completely, going through the exercise will serve to structure the issue, develop a necessary fact base, and ensure that all the relevant experts are brought into the discussion. The end result may not be technically elegant, but, more often than not, it will be directionally correct and will greatly improve the company's ability to respond. 5. Risk management is more than a policy; it is a culture. Given the strategic importance of risk management, the objective of a company's risk-management system should be not only to enforce new policies but also to create a new organizational culture--one that addresses risks proactively, not reactively, and manages them to create new sources of competitive advantage. The goal of a robust "risk-aware culture" is not so much to avoid risk as to optimize the risk-return tradeoff. In some situations, that may mean embracing risk in order to realize important business opportunities. For instance, when the Canadian electric utility Hydro One began to design and implement an ERM system, the organizing principle was that "risk management is everyone's responsibility, from the board of directors to individual employees."^3 3 This example is drawn from Tom Aabo, John R. S. Fraser, and Betty J. Simkins, "The Rise and Evolution of the Chief Risk Officer: Enterprise Risk Management at Hydro One," Journal of Applied Corporate Finance 17 (3), Summer 2005, pp. 62-75. The company used the implementation process to make risk awareness an important part of the corporate culture. Among the tangible benefits of this companywide approach has been a more rational and better-coordinated capital-allocation process, which has contributed to an upgrade in the company's credit rating and a reduction in its cost of capital. As a result, Hydro One is much better positioned to respond to new developments in the business environment--favorable as well as unfavorable. And yet, when it comes to implementing a risk-aware culture, most companies still have a long way to go. In the Harvard Business Review survey, creating a "risk-aware culture at all levels" was chosen by more respondents (34 percent) than any other factor as the most important enabler of successful risk management. And yet, only 11 percent of those respondents who selected it as the most important factor thought that their organizations were doing a good job of it. 6. A risk-aware culture requires the free flow of information. Effective risk management depends on the free flow of information throughout the organization. Often, the most important data are buried in one part of the organization, unavailable to risk managers in corporate headquarters or other parts of the company. The risk management organization needs unrestricted access to risk-relevant data and the power to escalate problems quickly to the appropriate level of corporate management. Many companies are creating standardized risk-management information systems that aggregate all business-unit data. But unless employees at all levels of the organization are actively involved in the risk management process, it will be difficult to maintain the unrestricted flow of information. There are a variety of ways to improve cross-functional access to data. At one company we work with, the CFO conducts regular one-on-one meetings with divisional CFOs to encourage a culture of unrestricted information flow. And at another, the CFO has established a Web-based intranet system so that employees can easily inventory and share emerging risks with colleagues anywhere in the organization. 7. What matters is the "talk," not the "report." Risk management deals with uncertain futures. As a result, the goal should not be to develop absolutely precise metrics but to strive for a general understanding of the probabilities and potential impact of various trends and to prepare mentally for taking preventive or corrective action. In this respect, it is essential to establish regular processes for the open discussion and assessment of all types of risk. A focus on open discussion has several benefits. It facilitates cross-functional information exchange. It forces the organization to confront the uncertain nature of risk and be prepared to act. Finally, by encouraging multiple perspectives on a given set of data, it helps refine the interpretation of risks over time. 8. The path is the goal. Risk management is never about finding "the answer." Rather, it is about continually refining the organization's assumptions about the future and its understanding of the implications of those assumptions for the company's business. Therefore, it is important to invest in regular reviews and continuous improvement in all elements of the risk management setup. Keep in mind that assumptions about risk often change quickly, so the relevant parameters, probabilities, impacts, and correlations should be revisited frequently. At one of our clients, over a period of two years, what had traditionally been the most stable business unit turned into the riskiest. Why? The evolution of the company's supplier environment led to the emergence of a few dominant suppliers--which led to an unforeseen increase in the prices of raw materials. In a continuously changing economic environment, companies cannot assume a stable risk landscape. Therefore, when they develop new approaches to assessing new kinds of risk, it is best to start small and adapt rather than to try to craft the perfect comprehensive solution right at the beginning. This incremental approach ensures that risk management is rooted in the organization and its day-to-day business and is tailored to the practical requirements of the business. 9. It is possible to prepare for unknown risks. Some of the most difficult risks that companies face are so-called black-swan events that are, literally, without precedent. Such risks can be deadly because they threaten a company's fundamental ability to operate. Take, for example, the impact of the 2011 Japanese tsunami on the viability of the Japanese nuclear-power industry. It is possible, however, to prepare for such unknown events--by building an organization that so excels at crisis management that it is resilient even in situations in which it is blindsided by a black-swan event. BCG's research has demonstrated that highly adaptive companies outperform less adaptive companies in periods of economic turmoil.^4 4 For more information on the concept of adaptive advantage, see Martin Reeves and Mike Deimler, "Adaptability: The New Competitive Advantage," Harvard Business Review, July 2011. They do so by deploying five distinctive capabilities that confer advantage in disruptive environments: * Signal advantage: the ability to detect, capture, and exploit information patterns as well as to think outside existing frameworks and risk landscapes * Experimentation advantage: the ability to experiment with new products and services and to use market responses to guide the continuous improvement of their market offering * Organization advantage: the ability to create an environment that fosters adaptability among employees * System advantage: the ability to actively shape entire business ecosystems * Ecosocial advantage: the ability to align the company's business model with the broader social and ecological context For an example of how a company's risk-management system can help it cope with unprecedented challenges, consider the story of First Solar, a maker of photovoltaic panels for solar energy applications.^ 5 5 The material for this example is drawn from "First Solar, Inc., in 2010," Case SM-190, Stanford Graduate School of Business, October 2010. From its launch in 1999, the company has built its business model on the principle of minimizing financial risk. At a time when many companies in the photovoltaic industry were focusing on high-cost technologies for manufacturing high-efficiency cells, First Solar took the opposite approach: focusing on technologies for making moderately efficient but very low-cost solar cells. By specializing in technologies that had relatively low capital expenditure per watt of manufacturing capacity, its founders argued, the company would be able to scale more cheaply (and, therefore, more quickly) than its competitors and to fund the bulk of its growth through its own cash flow. Similarly, in order to avoid overreliance on the many government subsidies available for purchasing solar cells, the company decided to focus exclusively on sustainable markets with economic fundamentals that supported demand for solar cells over the long term. Both decisions would turn out to be critical when the 2008 global financial crisis completely transformed the company's business environment. The vertiginous decline in the availability of credit made it far more difficult for companies in the industry to raise financing--a situation that did not affect First Solar because it had been funding its new investments largely from its own cash flow. What's more, the global recession meant that governments were also cutting back on their subsidies to the green-energy sector, seriously harming the company's competitors that were too reliant on markets in which such subsidies had dominated. In short, First Solar was able to adapt to this new environment because it had built risk management into its business model. And since then, it has kept close track of emerging technological and political trends and adjusted its model accordingly. 10. Avoid the downside, but don't forget the upside. In the end, a big part of risk management is about avoiding the downside. And yet, it is critical that risk management not become yet another reason for senior executives to be risk averse or to fear losses more than they value equivalent gains.^6 6 See "Memo to Staff: Take More Risks," Wall Street Journal, March 20, 2013. For more on the widespread bias toward risk aversion, see Daniel Kahneman and Amos Tversky, "Prospect Theory: An Analysis of Decision Under Risk," Econometrica 47 (2), 1979, pp. 263-291. Companies should use risk management also to identify new opportunities and to exploit them in a systematic fashion. During the Great Depression in the U.S., for example, it was precisely those companies that were willing to take risks in order to exploit the enormous disruption and upheaval that ended up not only surviving the crisis but also thriving in its aftermath. Companies such as General Motors, IBM, DuPont, General Electric, and Procter & Gamble outperformed their peers in the Great Depression. They also used the period to create the competitive advantages that would allow them to continue to do so for many years afterward. Investors will support intelligent risk taking. In the aftermath of the 2008 global financial crisis, BCG surveyed global investors about their priorities for companies in a downturn economy. One of the themes that emerged from the survey was investors' desire that companies take advantage of the downturn in order to strengthen their competitive position and leapfrog their competitors. In fact, the concern of a majority of the respondents was not that companies were being too aggressive but that they were not being aggressive enough. One effective approach to benefiting from the upside of risk is to use scenario planning in order to define not only worst-case scenarios but also best-case scenarios.^7 7 For a description of how to use scenario planning as a risk management tool in the development of a company's value-creation strategy, see Risky Business: Value Creation in a Volatile Economy, the 2011 Value Creators Report, September 2011. The goal should be to think in advance about how a company can make the best use of the latest market developments and trends. A prerequisite for conducting frequent scenario analyses, however, is the ability to quickly quantify the impact on key metrics. To achieve this goal companies must define required premises and results, ensure transparency about calculation methodology and assumptions, and establish a quick-response planning process.^8 8 For more on this subject, see The Art of Planning, BCG Focus, April 2017 (originally published in 2011). Sensing Risk Early: The Leading-Indicators Report For a concrete example of how to put our principles for risk management into practice, consider the recent creation of a new leading-indicators report at a global company. BCG worked with the company both to design the report and embed its use throughout the organization. In the years after the 2008 global financial crisis, the company's CFO worried that the organization was ill prepared for the growing volatility of the world economy. So, in 2011, he initiated a major corporate program to improve the company's ability to deal with uncertainty and risk. As part of the program, the CFO set up a team to develop a companywide system of leading economic indicators. Identifying the right set of indicators, he reasoned, would help the company improve its forecasts of future market developments. It would also make possible the early identification of emerging trends that could affect the company's sales volumes. The team, led by the company's top financial controller and chief economist, had representatives from key corporate functions (such as controlling, sales, strategy, economics, and political intelligence) as well as all its major business divisions. Assisted by BCG, the team came up with three design principles to guide their efforts: selectivity, simplicity, and transparency. Selectivity. To design the report, the team used a typology of risk management activities that we have used with a number of clients. This typology, illustrated in Exhibit 3, characterizes a given risk-management process in terms of six critical dimensions: purpose, time horizon, unit of analysis, types of risk being addressed, methods for assessing those risks, and desired outputs. As the exhibit suggests, the purpose of the report was to enable quick adjustments to any geopolitical, market, and financial risks in the short-to-medium term that would have a material impact on the company's sales. [] 1 / 1 To define the appropriate metrics, team members started collecting all metrics that were currently tracked in various parts of the company. They also identified other internal and external data that, while not currently used, might shed light on future sales. But relatively early in the process, they decided that their strategy would be to focus on a manageable set of indicators that combined early availability (so that the organization would have time to react) with strong predictive power (so that the organization could estimate with confidence the impact on the business). Both criteria were important. Take the example of an indicator such as the rate of GDP growth in an economy. GDP growth rates had a strong impact on company sales. But, typically, official GDP metrics are retrospective. By the time official GDP growth rates are released publicly, the change has already occurred and the impact on sales is already being felt. Thus, official GDP statistics aren't much help to the company as leading indicators. In order to estimate future trends in GDP growth, the team chose to use the aggregated monthly GDP forecasts of several external economic institutes and analysts. In order to ensure that the indicators gave the organization necessary lead times, regional differences had to be carefully taken into account. For example, in Europe, consumers tend to preorder one of the company's key products directly from the company. Since there is significant lead time between order intake data and sales volume data, order intake data are a useful indicator. In the U.S., however, most consumers buy the product in retail stores, so there is hardly any lead time at all. The team found that in the U.S., the indicators with the most predictive power were delivery volumes from production sites to stores and the discounts offered by retailers. Ultimately, the team selected 12 key indicators across four dimensions (macroeconomic, political, market, and internal), four regions, and the company's five divisions. Data on many of these indicators were already being collected somewhere in the company. However, putting them together in a single report helped recipients see the connections and draw conclusions that, previously, had been obscured. Simplicity. Although predictive power was a key criterion for the indicators chosen, the team decided not to include complex statistical regressions in its leading-indicators report. Instead, they took a pragmatic approach, emphasizing simple correlations between the indicators chosen and the company's sales volume. The fear was that if the analysis was too sophisticated, it would limit discussion of the report to those with a background in statistics. Therefore, the predictive power of an indicator had to be obvious without complex calculations. This turned out to be critical for encouraging buy-in on the part of all parties throughout the company. Simplicity, however, did not mean shielding the businesses from the raw data. Often in leading-indicators reports, organizations aggregate information into a single "super indicator" on the theory that the very act of creating a methodology for calculating such an indicator will force the organization to think critically about risk. The downside of such a high degree of aggregation, however, is that the insights in the individual data points are hidden from decision makers and can also breed mistrust of the aggregated metric on the part of managers in the businesses. The team decided that the greatest benefit would come from exposing the businesses to a wider array of more granular--and sometimes conflicting--data. The conversations and debates sparked by the different perspectives that participants brought to the data would eventually lead to a shared view on potential market developments--one that was informed by a thorough vetting of the probabilities, risks, and critical interdependencies. Transparency. The discussion of leading indicators can deliver meaningful results only if that discussion is objective and unbiased. In many companies, such objectivity cannot be taken for granted. When anticipated adverse developments carry the implication that a given business is unlikely to meet its targets, two things tend to happen: first, the business ignores the data; second, should the adverse effect actually take place, the business uses the data as an all-purpose excuse for poor performance. Therefore, this company takes great care to avoid these pitfalls by ensuring total transparency of the data in its leading-indicators report. For instance, division sales and finance representatives have the authority to forward certain data for the report directly to corporate headquarters without first getting approval from the division and function heads (this is the only internal company report for which this is the case). And the leading-indicators team as a whole is empowered to escalate critical issues directly to the company's senior-management team. The subsequent discussion of the report is moderated by the chief economist, who reports directly to the top management team. The chief economist has the authority to express a dissenting opinion on the interpretation of each individual data point by the business units. This approach ensures full transparency of controversial indicators to top management. The company has been using the monthly leading-indicators report since early 2012. The divisions highlight any abnormal developments that arise in the indicators. And every quarter, the report is distributed among the top 100 corporate and division managers. The CFO also presents the quarterly report to the senior management team and moderates a discussion about the potential business implications of the data. The report is also used to guide the company's annual planning process. --------------------------------------------------------------------- Participants recognize that the report has enacted a cultural change in the organization. In the past, the businesses tried to avoid discussions about potential risks and their impacts, so such discussions took place only late in the game, when the impact of changes in economic trends had already hit the company. At that point, the discussion usually focused on blaming others and defending oneself from criticism rather than on defining the appropriate reactions. With the new report, the businesses and relevant corporate functions regularly discuss trends in the macroeconomic environment and product markets and openly share their various perspectives on the possible implications of those trends. Volatility and uncertainty are increasingly accepted as "normal," with most discussions focused on how best to manage them. Risk management at the company has become a whole new way of thinking and making decisions. Acknowledgments The authors would like to thank their BCG colleagues Henrik Blank and Dominic Klemmer for their contributions to the report. Authors [] Ulrich Pidun Partner & Director; BCG Henderson Institute Insight Leader Frankfurt [] Marc Rodt Partner & Director, Center for CFO Excellence Munich [] Alexander Roos Managing Director & Senior Partner; Global Leader, Center for CFO Excellence Berlin [] Sebastian Stange Partner and Director, Corporate Strategy and CFO Excellence Munich [] James Tucker Managing Director & Senior Partner; Global Leader, Corporate Finance and Strategy Practice Toronto Related Content art-performance-1694x950-tcm9-62234.jpg Finance Function Excellence Focus April 30, 2017 The Art of Performance Management Before investing in new performance management systems, leaders need to identify the metrics that really matter and design processes for translating data into effective decision making. Learn More art-planning-2017-1694x950-tcm9-112549.jpg Strategic Planning Focus April 30, 2017 The Art of Planning In today's increasingly complex and less predictable global environment, planning has never been more difficult--or more important. BCG highlights ten guiding principles for getting it right. Learn More [] Risk Management and Compliance Article September 22, 2023 Risk Management Failures: What Corporate CFOs Can Learn Recent failures highlight the importance of building resilient approaches to financial risk management. Learn More [] Corporate Finance and Strategy Article May 31, 2023 Uniting Strategy and Risk Management to Seize Opportunity in Uncertainty Risk is a two-sided coin--business leaders need to embrace its upside, not just avoid its downside. Learn More [] Corporate Finance and Strategy Article October 1, 2024 Are Leaders as Prepared for Strategic Risks as They Think They Are? Companies must be ready not only to mitigate the negative consequences of risk but also to capitalize on the positive ones. Learn More [] Risk Management and Compliance Article June 28, 2023 The New World of Risk--and What to Do About It Risk has always outpaced risk management, but the scale, complexity, and interconnectedness of risk today mean that businesses need a new approach. Learn More ABOUT BOSTON CONSULTING GROUP Boston Consulting Group partners with leaders in business and society to tackle their most important challenges and capture their greatest opportunities. BCG was the pioneer in business strategy when it was founded in 1963. Today, we work closely with clients to embrace a transformational approach aimed at benefiting all stakeholders--empowering organizations to grow, build sustainable competitive advantage, and drive positive societal impact. Our diverse, global teams bring deep industry and functional expertise and a range of perspectives that question the status quo and spark change. BCG delivers solutions through leading-edge management consulting, technology and design, and corporate and digital ventures. We work in a uniquely collaborative model across the firm and throughout all levels of the client organization, fueled by the goal of helping our clients thrive and enabling them to make the world a better place. (c) Boston Consulting Group 2026. All rights reserved. For information or permission to reprint, please contact BCG at permissions@bcg.com. To find the latest BCG content and register to receive e-alerts on this topic or others, please visit bcg.com. Follow Boston Consulting Group on Facebook and X (formerly Twitter). Unlocking the Potential of Those Who Advance the World * Careers * Alumni * Offices * Subscribe * About How can we assist you? We value the opportunity to connect with you. Please submit your inquiries and feedback, and our experienced professionals are ready to assist you. Contact Us * en| * ja Follow Us * * * * * * * Privacy Policy * * Terms Of Use * * Sitemap * * Responsible Disclosure Boston Consulting Group is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, age, religion, sex, sexual orientation, gender identity / expression, national origin, protected veteran status, or any other characteristic protected under federal, state or local law, where applicable, and those with criminal histories will be considered in a manner consistent with applicable state and local laws. Pursuant to Transparency in Coverage final rules (85 FR 72158) set forth in the United States by The Departments of the Treasury, Labor, and Health and Human Services click here to access required Machine Readable Files or here to access the Federal No Surprises Bill Act Disclosure. (c) 2026 Boston Consulting Group Hide Save It For Later Saved To My Saved Content Download Article Share Link copied Save It For Later Saved To My Saved Content Download Article Expand