If it feels like a high-profile corporate crisis is never very far from the headlines, then there is good reason. According to an estimate by risk advisers at Willis, the average enterprise will experience a crisis once every eight years. Many will suffer long-term damage and some will not survive at all.
The business climate is more cut throat, faster moving and less forgiving than ever. Partly as a result of the speed at which reports travel, spurred on by 24/7 news and social media, firms and their top executives are exposed to intense scrutiny. Reputations built over years can be trashed within days.
Business models, meanwhile, have become so complex that many top executives do not truly understand them. It is an alarming fact that, according to McKinsey survey data, almost a third of UK companies say their boards have “limited or no understanding” of the risks their companies face.
Airmic’s Roads to Ruin research published in 2011 demonstrated how a lack of understanding or focus on risk at the very top of the company is a root cause of corporate failure. By contrast, last year’s follow-up research, Roads to Resilience, demonstrated that companies where senior management were fully engaged with risks were not only more resilient, they were also more profitable.
We know from our research that boards are waking up to the importance of good risk management. Yet directors sometimes admit they do not know where to begin and they have plenty of other demands on their time. Many are frustrated that they lack the right tools and information to enable them to have an effective risk conversation. For example, the conventional event-driven risk maps, while useful in the right context, overlook many deep-seated risks with catastrophic potential.
If this brief analysis resonates with your organisation, we would urge you to consider a new approach, whereby boards explicitly view their critical risk exposures through the following two risk lenses:
- A detailed review of the corporate business model with analysis of critical threats and the effectiveness of response plans;
- A review of reputational risk vulnerabilities through the eyes of key stakeholder groups.
The benefit of using the business model as the basis for risk identification is that it provides the big picture and makes it easier to scrutinise the sustainability of how the business makes money.
Very briefly, our proposed approach, as described in the report Looking Through the Risk Lens, written together with the Chartered Institute of Management Accountants (CIMA), uses the four components of a business model – inputs, business activities, outputs and outcomes – as a basis for identifying the risks found in each layer of the value-creation process.
If a corporate crisis is perceived to be mismanaged, a loss of reputation can very quickly render all other assets virtually worthless, whatever your business model
What does this achieve? It enables boards to view the risks to the business from a strategic, tactical and operational viewpoint, and to identify the risks that really underpin success. It also pulls together risks arising from different siloes, while bringing to the surface those that have been overlooked. Perhaps most importantly, it forces boards to ask themselves different, and often difficult, questions.
No analysis of the business model is complete, however, without taking account of the company’s reputational risk vulnerabilities. Reputation is a critical underpinning of the business model – it is your licence to operate. If a corporate crisis is perceived to be mismanaged, a loss of reputation can very quickly render all other assets virtually worthless, whatever your business model.
It can require a different way of thinking to manage this hard-to-define risk. For example, a business might act within the law and even best practice, but yet still fall foul of public expectations. How often have we seen a company suffer for not issuing an apology early enough or sincerely enough?
We have worked closely with Reputation Institute on this subject and the importance of looking at risk events through a reputational lens has become increasingly clear. The most resilient companies constantly monitor how all stakeholders perceive their company which in turn encourages transparency. Looking at risk events through the reputational lens is therefore a critical dimension to identifying and mitigating risks before they turn into full-blown crises.
How does your business make its money? It sounds like a simple question, but much of our research has illustrated that many directors cannot adequately answer it. Or if they can, they have little understanding of what processes and events could leave it vulnerable.
Would this new approach have prevented the many corporate disasters we have witnessed in recent years? We are not claiming to have found a magic cure. But our approach surely would have flushed out some challenging questions for the C-suites to answer.
