Risk and how we run our business
I like stories and metaphors to help me convey a message. In fact, my book on internal auditing is a collection of stories.
This time, I am going to use a metaphor involving the board game of Monopoly to illustrate how I feel about risk management.
The players compete to win by either having more money when the game ends (if there is a time limit) or by being the only one left standing after all the others have gone bankrupt.
Let’s imagine our executive team is playing a game against its main competitors.
The CEO is focused on the goal – making as much money as possible and taking advantage of the opportunities that may arise as the company’s shoe (my favorite piece) lands on properties that are for sale, competitors go bankrupt and have to dispose of their assets, passing Go and so on.
But, the company has a traditional Chief Risk Officer (CRO), whose name is Cassandra. Like the lady in Greek mythology, Cassandra is always looking into the future and seeing all kinds of dire things happening.
Cassandra provides the CEO and his team a list of the “top risks”. They include:
- If you land on a property owned by a competitor, you will have to pay rent. The rent will depend on the property itself (some are far more expensive than others) and how many houses or hotels have been built by the owner.
- If you land on certain squares, you may go to jail and then have to pay a fine to be released.
- If you land on a few other squares, you will have to draw a card with payments due that could be substantial.
- If you run out of cash, you will either have to sell hotels or houses, sell or mortgage properties, or go bankrupt.
As an experienced Monopoly player, the CEO’s reaction is dismissive. “I have been playing this game for a long time and you are not telling me anything I don’t already know.”
Meanwhile, the COO is urging the CEO to play. “Double six, and we will get a strong lead on the others.”
The CEO throws the dice and the shoe lands on an unoccupied property.
“Buy!” says the Sales EVP. “The potential is huge, especially as there is a good chance that the others, who are behind us, will land on the square.”
The CFO chimes in with assurance that there are sufficient funds to make the acquisition.
The intimidated CRO is silent. Internally, she is worrying that the team will buy all the properties it can and run out of funds. After all, there are dangers ahead.
The company buys the property and she watches as the other players roll the dice, move their pieces, and buy other properties.
It’s the CEO’s turn and he throws the dice. The COO moves the shoe to another property that is for sale.
The CEO asks for input on whether the company should make the purchase. Sales nods enthusiastically, the CFO confirms the funds are available, and the COO agrees that the company has the ability to manage both properties.
At this point, the CRO’s young deputy arrives. He sees the board and hears the conversation.
“Is there value in the purchase? It’s a different group from the other property we own and a competitor already owns a location in this group. If we save our funds, we would have more available not only for the contingencies in the top risk report, but to purchase a more attractive property in the future.”
The CEO listens and beckons the young man to sit next to him. “You are talking like a businessman. That’s helpful.”
Sometime later, the company lands on the property it needs to be the owner of a whole group of properties. The CEO looks around at the team and everybody agrees they should make the purchase, which they do. The CEO then asks for advice on whether they should build any houses and, if so, how many.
Sales jumps up and down with glee and claps his hands. “Yes, oh yes!”
The CFO looks worried. “Our cash flow is not very good, working capital is low, and our building fund is only just enough to support the purchase of a total of four houses.”
The CEO looks at the CRO: “Do you have anything to say?”
“If we buy four houses, we will not be able to survive landing on any of the properties four to six squares later. We would be exceeding the risk appetite statement approved by the board.”
Shaking his head, the CEO turns to the young man on his right. “What do you think, Fred?”
Fred is surprised to hear the CEO address him with a tone of respect, calling him by his first name – which Fred didn’t realize the CEO knew.
“Of course, Cassandra is right.”
“I would add something though.”
“I think we need to look at all the possibilities.”
“First, let evaluate the potential if we acquire one or more houses. How much would the rent increase? If we purchase between one and three, the rent increase should anybody land there is modest. If we purchased a fourth house, we could put two on one property and the rent increase would be substantial. So there is a clear value in going with four over three, if we can afford it. Having said which, what is the likelihood that one or more of our competitors will land on our properties and when would that happen? Does it make sense to buy now or later, given where they are?”
“We also need to look what might happen as we move forward at our next turn. Where could we land? If we moved between four and six spaces ahead, as Cassandra says, we would be in severe trouble. The likelihood of that happening, throwing a total of between 4 and 6 with two dice, is 42%. If we avoided that trouble, we would not only be safe but the path ahead would be clear of threats for a turn or two. In fact, we would probably pass Go and collect $200 which would replenish our funds.”
“I can’t work out all the figures quickly, but I can see the CFO has started putting the numbers into a model on his laptop.”
The CEO turns to the CFO, who takes a few minutes before informing the team that if they purchase up to three houses, given the likelihood of somebody landing on one of those sites at their next turn, the model puts a value of $300 on the purchase. They would have $250 cash remaining. He also used the model to evaluate the risk that they would land on a competitor’s property at their next turn and have to pay rent. That works out to $200, so while the risk appears to be high the potential for return justifies it. The CFO says he also evaluated the value of purchasing four houses. The value rises to $500, but cash remaining would not be sufficient to handle paying rent if they had to at their next turn.
Overall, the CFO advises purchasing three houses, not four.
Sales starts to say something, but subsides quietly.
The CEO agrees with the CFO and four houses are purchased.
The game continues, but now the CEO makes sure that the debate on strategy and tactics always includes an evaluation of all the possibilities, both negative and positive. What might happen, what are the potential impacts (there are always multiple) and what are the likelihoods of each? He constantly turns to Fred for assurance that all the right questions are being asked, while relying on the CFO to ‘crunch the numbers’.
The CRO leaves for lunch, but nobody notices.
Quietly, Fred takes the list of top risks. As each player throws the dice, moves, and actions are taken, he re-evaluates each of the top risks. When it is the company’s turn, he makes sure that the current levels of all threats – and the current levels of all opportunities – are taken into consideration.
This way, the CEO and his team continually make decisions that are informed by an understanding of the current level of risk, the potential effects of what might happen, good and bad, as they slowly but steadily win the race.
Now this is simplified (and I am not an expert Monopoly player).
Life is far more complex.
But the principles still apply:
- Risk is changing dynamically.
- Every situation and every event presents multiple potential effects, some of which may be positive and some negative. In fact most situations and events have multiple effects that can occur at different times.
- Both the positive and negative effects have to be assessed based on their potential effects and the likelihood of that effect.
- To win, whether in life or a board game, you need to make intelligent, informed decisions.
- Every decision changes the state of the game, including the level and nature of risk.
- You need to keep your eye on the goal, not focused on the threats to the extent that you are paralyzed with fear and unable to decide to take a risk when it is necessary.
- To be effective, a CRO must play on the team, helping the CEO and others make intelligent and informed decisions. The goal is NOT to minimize or mitigate risk. It is to WIN by taking the right level of the right risk.
- It’s not enough to play on the team. You have to be seen as playing on the team, with the same goal.
- Don’t be Cassandra, who may be ‘correct’ but is not seen as essential to success.
Your thoughts?
Join us for a discussion on effective risk management later this month or in May. Details here.
Good example, Norman. Incidentally, you list ‘going to jail’ as a risk. In the later stages of the game, when there are no more properties to buy and competitors rents may be high, it’s far better to stay in jail – an opportunity indeed!
It is right to say that every business is running within some tolerated range of risk appetite. By other words, it is to win by taking some level of risks. However the whole company is running successfully guiding by effective risk control, which is main function of enterprise risk management team leading by CRO. For specific business case, what CRO can do is to present all possibility of each senario and corresponding result. How much risk the organization is going to take depends on CEO and strategy team instead of CRO.
I like the way you had related Monopoly game to business, there is a lot of similarity and I believe there is an element of luck too, then luck as I see it is taking a chance after evaluating all the circumstances hence success rate is better. Just like when a project did take off close to the target, then it will support the business operations, somebody landed on your property (you had 4 lots, the rental is much higher).
I believe you intended to write “three houses.” The CEO agrees with the CFO and four houses are purchased. I found the article interesting.
Interesting analogy. I like the conclusion that CRO needs to seen as playing together with the team, with the same goal. Risk management are often viewed as a nay-sayer, the risk team need to position that they are on the same page as the management, wanting the best for the company.
I have posted further relevant comments on your other blog at https://iaonline.theiia.org/blogs/marks/2016/Pages/How-Many-Lines-Do-You-Need-to-Defend-Against-Risk.aspx
Why is every person in your scenario a man – except for the nay-sayer who leaves without anyone noticing?