Interview with Faculty Chair Robert S. Kaplan

What's the main focus of the Risk Management for Corporate Leaders program?

This program centers on the principle that risks grow out of strategy. We focus on how to help companies identify, assess, understand, and manage unexpected risks. How do you determine the risks in your strategy, and how do you put processes in place to address them in advance? The case method allows participants to take a deep dive into a company-specific situation and see how risks emerge, how to cope with them, and how to turn them into opportunities.

How does this program differ from others on risk management?

Our approach is unique in that we start with the firm's strategy and then analyze the risks inherent in its strategy. Most of these risks cannot be avoided, but they can be anticipated and their likelihood either reduced or their impact mitigated. We also explore emerging or "novel risks"—unusual events you don't anticipate that suddenly just happen. We recently had a new case about a technology company using robots and proprietary technology for order fulfillments. But, unexpectedly, its largest and most powerful competitor bought the supplier of the core technology. How do you anticipate and adapt to that?

How can a company prepare for these novel risks?

It's important to realize that your company has no control over many external risks that can adversely affect it. But the organization can still reduce the impact of such non-controllable external risks as long as it anticipates them and has already created a team ready to respond to them. Think about Nokia. They were able to deal with a supply crisis because they had a "Chief Worry Officer," whose only job was to think about what could really go wrong and take quick actions before a crisis developed.

What are two specific cases that you use in the course?

My colleague Eugene Soltes has interviewed every corporate executive who is in jail for some type of fraud, including Bernie Madoff and Jeff Skilling of Enron. Eugene studies the thinking and actions that result in compliance failures and unethical behavior, and how to put processes in place that can help keep your executives out of jail and your company out of bankruptcy. We also feature how companies have responded, both well and poorly, to natural disasters such as the nuclear accidents at Three Mile Island and the Fukushima plant of Tokyo Electric.

In the program curriculum, you talk about turning these risks into business opportunities. How is that done?

When companies get involved in this new approach, they find that there is both risk and opportunity. During Hurricane Katrina, the national and local government agencies couldn't get supplies to people. But Wal-Mart and Home Depot could because they were acting more as entrepreneurs. Their people anticipated the crisis, and their distribution channels already had people on the ground. So, what first sounds like a risk is now a way for companies to create a business opportunity to help local communities cope with natural disasters. We study how a travel company has carved out an attractive competitive niche by offering adventure expeditions – off the beaten path – for healthy retired people who recognize that "risk comes with the territory."

What's the first step a company can take to change its approach to risk?

Some crises are incubated because people don't know how to have good conversations about what concerns them. Many consulting organizations and software companies offer a cookie-cutter approach to risk management by encouraging the firm to follow a checklist procedure for compliance and internal controls. This is inadequate for identifying and managing complex risks. We provide a role-playing exercise in which each person has a different perspective on how to accomplish a goal as a small group. Because their individual incentives also differ, it's hard for them to see the big picture. We help them understand the importance of managing the inner dynamics of groups so that all perspectives can surface in an open and constructive dialogue.

How do you help each group work together to integrate risk management into a cohesive strategy?

We use the balanced scorecard strategy maps concept from our Driving Corporate Performance program and apply it to risk management. First, we talk about how you make a strategy work. Then we create a strategy map, balanced scorecard, and key indicators of what participants need to do well for the strategy to succeed. They look at each objective and measure in the balanced scorecard and ask: What can prevent our strategy from succeeding? What do we have to do to get it right? That's the first level. The second level is: What could go wrong?

After you determine what could go wrong, how do you eliminate that risk?

The idea is not necessarily to eliminate the risk, because risks are good opportunities. But what determines how fast you can drive a powerful car? Putting a really big engine in an economy car allows you to drive very fast, and many people find that exciting. But what determines how fast you can safely drive is not just the size of the engine. Imagine driving a small car very fast with a large engine inside when suddenly you see a little ball rolling across the road, soon to be followed by a three-year-old. That is a risk event that just materialized. How well you cope with that risk is now determined by how good your brakes are. Proper risk management is to ensure that you invest in brakes that are adequate for your engine size and driving speed. Investing in risk management is not intuitive since spending a lot to install an excellent braking system contributes virtually nothing to your ability win a race—you also have to be a good driver. But the more aggressive your strategy is, the more brakes and controls you need to prevent bad things from happening to your good strategy.

Have key risks changed based on today's global economy?

Six years ago, we really weren't thinking about cyber risk and people hacking into systems. But now we see that anything can become vulnerable. The events at Three Mile Island, Tokyo Electric, and Fukushima occurred because a lack of preparation in thinking caused an inadequate response. Risk with natural resources or geopolitical events is challenging because we can't predict when and where they will occur or what the magnitude will be. But in principle, you know a major earthquake could happen in California or a tsunami could be sitting somewhere in the ocean. You have to plan what to do in advance, because you won't have time to do it in real time.

What is the difference between risk management and crisis management?

Crisis management is what happens when you have not done a good job in risk management. An unexpected event has occurred for which you are unprepared, so you have to improvise and put a crisis management plan in place in real time. Good risk management should recognize that adverse events can occur, enabling you to put organizational or decision-making structures in place in advance. These can then be quickly deployed to adapt to the circumstances and mitigate the adverse consequences from the unexpected event.

Who would benefit most from attending this program?

Risk management is an essential part of leadership, so this program crosses all functions and industries. It's geared for a mix of professionals—seasoned or newly appointed risk managers and general managers and board members who want to know if their risk function is being handled well by the organization. What could go wrong in my company? Do I have the right people thinking about this 24/7? Managers and consultants from inherently risky industries—utilities, mining, financial services, aerospace, energy, and chemicals—would definitely benefit.

What are the key takeaways of Risk Management for Corporate Leaders?

Participants leave with several frameworks for moving forward. On a micro level, the strategy maps and risk indicator scorecards provide early warning about things that are going wrong. Another framework enables them to envision the external risks coming from geopolitical issues and natural disasters. Then there is the normal planning for risk versus the anticipating of events by a team that is already trained to cope with this particular emergency. Most important, participants return with a more rigorous approach to the nature of risk facing their company and with several frameworks for putting cost-effective risk management policies into action that protect value across the enterprise.