The Art of Risk Management

The Art of Risk Management, which discusses the ten principles that should govern an approach to risk management, is part of a publication series by BCG on CFO excellence. The Art of Performance Management looks at the critical components of a best-in-class performance management system and operating model. The Art of Planning examines the ten principles driving best practices in corporate planning.

In the aftermath of the global financial crisis, companies worldwide have become more focused on risk management. What was once a concern primarily of senior executives in the financial services sector has now become a top-management priority in nearly every industry.

In a global survey of close to 1,500 C-suite executives conducted in the summer of 2011 by Harvard Business Review Analytic Services, more than two-thirds of respondents said that risk management had become somewhat or significantly more important over the previous three years. And in a March 2012 survey of finance executives by CFO magazine, 72 percent of respondents said their companies had increased the amount of time and resources devoted to risk management over the previous two years, with 23 percent calling the increase “significant.”

Risk management is essential in today’s volatile economy. And yet many of the very financial firms that took such dangerous risks before the financial crisis had some of the most sophisticated risk-management operations around. What’s more, some of the very few financial companies that had been praised for their deft risk management before the financial crisis have since gone on to make major errors. One dramatic example is JPMorgan Chase, which suffered a trading loss of $2 billion in 2012 due to trades that its CEO Jamie Dimon has termed “flawed, complex, poorly reviewed, poorly executed, and poorly monitored.”

We worry that in their headlong embrace of formal systems of risk management, many companies are making the same mistakes that companies in the financial sector made. Put simply, they are pursuing a highly technical approach to risk management—characterized by complex financial models and elaborate, formal risk-management systems—in isolation from the day-to-day activities of the broader organization. The result, as was the case at many banks, is that risk management may exist as a formal function, but it is not really embedded in the “mindset” of the broader organization and, therefore, is not shaping behavior and informing decision making.

To be sure, metrics, systems, and processes are important. And for the vast majority of companies, it probably does make sense to create a formal risk-management function. But developing the right risk-management mindset and organizational culture is even more important—and, in our experience, far more difficult to implement.

Companies need a new approach. They need to stop thinking of risk management as primarily a regulatory issue and to reconceive risk management as a value-creating activity that is an essential component of the strategic debate inside the company. The goal of that discussion should not be to eliminate risk, or even to minimize it, but to use it to create competitive advantage. And doing that effectively depends upon a far more dynamic interaction between risk management experts and the line organization.

Ten Principles of Risk Management

Creating a more dynamic managerial system for risk management is as much an art as it is a science. In working with our clients to develop this new approach, BCG has identified ten principles that should govern the art of risk management. (See “Ten Principles of Risk Management.”) We describe these principles below.

1. Risk management starts at the top. Most managers are eager to talk about ambitious plans and favorable results. They are generally far less enthusiastic, however, when it comes to discussing potential—let alone actual—losses that affect the business. For this reason, risk management has to be a high-priority topic with a dedicated owner—either the CEO or some other senior corporate executive. Otherwise, the impulse will be to “kill the messenger” whenever lower-level executives raise sticky questions about potential risks or obstacles to an ambitious business plan.

One approach that many companies are taking to emphasize the importance of risk management is to appoint a chief risk officer (CRO). According to the 2011 Harvard Business Review survey, roughly 42 percent of companies with 10,000 employees or more have such a position—compared with only 11 percent three years previously. Companies with a CRO typically have more advanced planning tools in major risk areas, such as cost of capital, financial regulations, information security, and internal planning and reporting.

But just because a company has appointed a CRO doesn’t necessarily mean that it has made risk management a high priority. The critical factor is to have a highly visible commitment on the part of the senior executive team to make risk management an integral part of the managerial decision-making process.

At General Electric, for example, the board of directors and senior management annually develop a list of the priority risks the company will face in the coming year. The list is public and available throughout the organization. The CRO, who leads the company’s risk function, has the responsibility of coordinating GE’s risk practices with the line organization and business units, including identifying and appropriately managing specific risks and ensuring the enforcement of companywide risk policies. The CRO also reports back frequently to the CEO, CFO, and board in order to discuss the latest trends and any changes in the company’s risk scenarios.

Without this kind of active senior involvement and a management process that links high-level considerations of risk with practices at the frontline of a company’s businesses, a CRO will have limited effect. Responding to the Harvard Business Review survey, about 41 percent of the CROs said that the lack of strong senior-management support was the primary barrier to embedding risk management deep in the company.

2. Risk cannot be managed from an ivory tower. As a company elevates the importance of risk management through the creation of, for example, board-level committees and a dedicated risk-management function, it also needs to be careful not to turn the risk management organization into a kind of ivory tower. Too often, the bigger and more centralized a company’s risk-management function, the more likely it exists in isolation from the rest of the organization, with an insufficiently granular understanding of the actual business-specific risks the company faces. To avoid this outcome, risk management needs to be integrated into all of the company’s routine management processes, including planning, capital allocation, controlling, and reporting. This integration needs to be done collaboratively with the operating management in order to secure buy-in at all levels of the organization. Simply imposing a process from the top rarely works.

BCG has developed a framework that uses the metaphor of a house to describe a truly integrated enterprise risk management (ERM) system. (See Exhibit 1.) Under the “roof” of strong senior-corporate leadership, and built on a “foundation” of appropriate metrics and tools, cross-functional processes and rules for governance, and a companywide risk mindset and culture, the risk management process has three basic steps:

• To understand the scope of risks that the company faces by identifying key areas of risk, evaluating the likelihood of risk, and developing processes for reporting new data to relevant stakeholders throughout the company
• To plan for how the company will manage those risks, primarily by incorporating risk management practices into the company’s various planning processes
• To act to mitigate or take advantage of risks if and when they become actualized, whether through specific strategic, financial, or operational moves or through broader crisis-management activities

When establishing such a process, the goal should be to encourage the entire organization to regularly consider issues of risk and uncertainty. The system should enforce cooperation and a “risk business partnership” among risk experts in corporate headquarters and the company’s businesses. In our experience, the best approach is to combine a central risk unit (led by the CRO) that provides general guidance with business unit risk experts who report directly to the business unit leaders and indirectly to the CRO.

3. Avoid relying on black boxes. Another shortfall of many risk-management systems is that companies become overly reliant on complex metrics or models. There are some highly sophisticated mathematical models for estimating risk, and many are embedded in software systems that are available on the market. Although sometimes appropriate, they can also obfuscate the risk management process, turning it from a transparent management activity into a frustrating black box.

Take, for example, the use of value-at-risk (VaR) as an aggregated risk metric calculated on the basis of Monte Carlo simulations. The simulations quantify the expected range of outcomes given the range of potential uncertainties in key financial inputs. When the number of input factors is limited and their distribution is easy to estimate (for example, long time series, such as currencies or raw-material prices), these simulations are a useful way to assess business risks.¹ 1 For an example, see the section “From Single Point Estimates to Probabilities” in “Risk Management Tool Kit,” BCG article, September 26, 2011. Notes: 1 For an example, see the section “From Single Point Estimates to Probabilities” in “Risk Management Tool Kit,” BCG article, September 26, 2011. But in many situations, the distribution of input factors and the correlations among them are difficult to identify. The problem may be due to the relative paucity of data points. Or the interdependencies among input factors may be so complex that an organization is tempted to make oversimplifying assumptions. The end result is a VaR based on a complex web of interrelated assumptions that are extremely difficult to make transparent to decision makers.

In such situations, a simpler system might be better. Avoid pseudoaccuracy when the data are too patchy to allow for sophisticated statistical analysis. Instead of creating a complex analytical system, focus on facilitating the engagement of the organization with key risks through simple and accessible analyses. Encourage plausibility checks of underlying assumptions. Avoid generating output that serves only to distract the organization from arriving at conclusions and taking action.

The appropriate level of complexity will be company specific and will depend on the industry, business model, availability of data, level of experience, and mandatory legal requirements. Banks, for example, can rely on massive amounts of data for complex statistical analysis. They also have long-term experience in interpreting complex metrics. What’s more, they are legally obligated to have detailed risk-management systems in place. But many other industries are not in this situation.

For an example of a company that strikes the right balance, consider the oil giant Chevron.² 2 This example is drawn from the Harvard Business School case study “Environmental Risk Management at Chevron Corporation,” Harvard Business School, March 10, 1999. Notes: 2 This example is drawn from the Harvard Business School case study “Environmental Risk Management at Chevron Corporation,” Harvard Business School, March 10, 1999. All major oil companies face significant risk in their daily operations. Mishandling of oil at any stage of production could damage the natural environment, human health, corporate profitability, or all three as in the case of BP and the Deepwater Horizon oil spill in 2010.

In the 1990s, approximately 9 percent of Chevron’s total expenditures were environment related. Precisely because the management of environmental risk is so important to the company, senior executives at Chevron decided to focus its risk-management efforts on personal judgment rather than on complex analytical models. They reasoned that a certain degree of simplicity was necessary to keep employees motivated to deliver meaningful information to the company’s ERM system. Onerous requirements would only lead to superficial compliance and bad data.

So in 1997, the company developed a simple tool (known as DEMA, for “DEcision MAking”) to help managers assess environmental risk as part of the capital allocation process. The tool requires managers to fill out a predefined assessment of the potential environmental risks of each project, with separate sections for their personal judgment and for quantitative assessments.

Senior executives reasoned that in a capital-intensive industry such as oil exploration and processing, excellence in decision making is often more important than excellence in execution. In effect, DEMA embeds Chevron’s risk-management procedures and processes into the day-to-day decision-making process about large capital investments. By helping managers set priorities among capital investment projects on a cost-benefit basis, the tool prompts managers to think carefully about potential risks and to make decisions that minimize them.

In part as a result of the DEMA tool and process, the costs of environmental incidents at Chevron declined substantially. For instance, in domestic refining, such costs were reduced by more than 80 percent after the introduction of DEMA—from $110 million in 1996 to $20 million in 1998.

4. Risk management is strategy, and strategy is risk management. Perhaps because of its origin in the financial services sector, most companies tend to think of risk management primarily in terms of potential financial risks. Although it is an important dimension of risk management, we think this financial perspective is too narrow. Of the 100 companies with the largest stock-price losses during the period from 1995 through 2004, only 37 were hurt by financial risks (caused by unexpected price movements in financial instruments or raw materials), while 66, nearly twice as many, suffered from strategic risks (caused by failures in the company’s operations or actions by competitors).

Therefore, it is important to align risk management with a company’s overall business strategy. The objective of both should be shareholder value creation. For example, if the company’s business strategy includes an element of acquisitive growth, the risk management system needs to emphasize the associated risks of the M&A process.

One example of a company that has worked hard to align its approach to risk management with its overall business strategy is Infosys, an Indian information-services company. Infosys has made “de-risking” one of its four strategic pillars and calculates what it calls degree of affordable risk—a composite measure of the risk threshold of the company. The goal of the approach is not to dissuade employees from taking risk but to make sure that they carefully think through the risks they take.

Another implication of this strategic dimension of risk management is that companies need to work hard to identify all relevant risks—not just those that can be easily quantified. In our experience, some of the most relevant risks for a company may be those that are more qualitative in nature and, therefore, especially difficult to quantify—for instance, a serious product failure or a major change in a company’s regulatory environment. (For a typology of the variety of risks companies face, see Exhibit 2.)

To identify these hard-to-quantify risks, we recommend a three-step approach. First, convene a series of workshops with representatives from the company’s various businesses in order to develop a detailed list of all the potential risks facing the company. Next, prioritize the risks by developing a relatively high-level assessment of their probability and likely impact. But don’t stop there. For the highest-priority risks on the list, take a third step: try to quantify what others say can’t be quantified. Even if the risks can’t be quantified completely, going through the exercise will serve to structure the issue, develop a necessary fact base, and ensure that all the relevant experts are brought into the discussion. The end result may not be technically elegant, but, more often than not, it will be directionally correct and will greatly improve the company’s ability to respond.

5. Risk management is more than a policy; it is a culture. Given the strategic importance of risk management, the objective of a company’s risk-management system should be not only to enforce new policies but also to create a new organizational culture—one that addresses risks proactively, not reactively, and manages them to create new sources of competitive advantage. The goal of a robust “risk-aware culture” is not so much to avoid risk as to optimize the risk-return tradeoff. In some situations, that may mean embracing risk in order to realize important business opportunities.

For instance, when the Canadian electric utility Hydro One began to design and implement an ERM system, the organizing principle was that “risk management is everyone’s responsibility, from the board of directors to individual employees.”³ 3 This example is drawn from Tom Aabo, John R. S. Fraser, and Betty J. Simkins, “The Rise and Evolution of the Chief Risk Officer: Enterprise Risk Management at Hydro One,”  Journal of Applied Corporate Finance 17 (3), Summer 2005, pp. 62–75. Notes: 3 This example is drawn from Tom Aabo, John R. S. Fraser, and Betty J. Simkins, “The Rise and Evolution of the Chief Risk Officer: Enterprise Risk Management at Hydro One,”  Journal of Applied Corporate Finance 17 (3), Summer 2005, pp. 62–75. The company used the implementation process to make risk awareness an important part of the corporate culture. Among the tangible benefits of this companywide approach has been a more rational and better-coordinated capital-allocation process, which has contributed to an upgrade in the company’s credit rating and a reduction in its cost of capital. As a result, Hydro One is much better positioned to respond to new developments in the business environment—favorable as well as unfavorable.

And yet, when it comes to implementing a risk-aware culture, most companies still have a long way to go. In the Harvard Business Review survey, creating a “risk-aware culture at all levels” was chosen by more respondents (34 percent) than any other factor as the most important enabler of successful risk management. And yet, only 11 percent of those respondents who selected it as the most important factor thought that their organizations were doing a good job of it.

6. A risk-aware culture requires the free flow of information. Effective risk management depends on the free flow of information throughout the organization. Often, the most important data are buried in one part of the organization, unavailable to risk managers in corporate headquarters or other parts of the company. The risk management organization needs unrestricted access to risk-relevant data and the power to escalate problems quickly to the appropriate level of corporate management.

Many companies are creating standardized risk-management information systems that aggregate all business-unit data. But unless employees at all levels of the organization are actively involved in the risk management process, it will be difficult to maintain the unrestricted flow of information.

There are a variety of ways to improve cross-functional access to data. At one company we work with, the CFO conducts regular one-on-one meetings with divisional CFOs to encourage a culture of unrestricted information flow. And at another, the CFO has established a Web-based intranet system so that employees can easily inventory and share emerging risks with colleagues anywhere in the organization.

7. What matters is the “talk,” not the “report.” Risk management deals with uncertain futures. As a result, the goal should not be to develop absolutely precise metrics but to strive for a general understanding of the probabilities and potential impact of various trends and to prepare mentally for taking preventive or corrective action.

In this respect, it is essential to establish regular processes for the open discussion and assessment of all types of risk. A focus on open discussion has several benefits. It facilitates cross-functional information exchange. It forces the organization to confront the uncertain nature of risk and be prepared to act. Finally, by encouraging multiple perspectives on a given set of data, it helps refine the interpretation of risks over time.

8. The path is the goal. Risk management is never about finding “the answer.” Rather, it is about continually refining the organization’s assumptions about the future and its understanding of the implications of those assumptions for the company’s business. Therefore, it is important to invest in regular reviews and continuous improvement in all elements of the risk management setup. Keep in mind that assumptions about risk often change quickly, so the relevant parameters, probabilities, impacts, and correlations should be revisited frequently. At one of our clients, over a period of two years, what had traditionally been the most stable business unit turned into the riskiest. Why? The evolution of the company’s supplier environment led to the emergence of a few dominant suppliers—which led to an unforeseen increase in the prices of raw materials.

In a continuously changing economic environment, companies cannot assume a stable risk landscape. Therefore, when they develop new approaches to assessing new kinds of risk, it is best to start small and adapt rather than to try to craft the perfect comprehensive solution right at the beginning. This incremental approach ensures that risk management is rooted in the organization and its day-to-day business and is tailored to the practical requirements of the business.

9. It is possible to prepare for unknown risks. Some of the most difficult risks that companies face are so-called black-swan events that are, literally, without precedent. Such risks can be deadly because they threaten a company’s fundamental ability to operate. Take, for example, the impact of the 2011 Japanese tsunami on the viability of the Japanese nuclear-power industry. It is possible, however, to prepare for such unknown events—by building an organization that so excels at crisis management that it is resilient even in situations in which it is blindsided by a black-swan event.

BCG’s research has demonstrated that highly adaptive companies outperform less adaptive companies in periods of economic turmoil.⁴ 4 For more information on the concept of adaptive advantage, see Martin Reeves and Mike Deimler, “Adaptability: The New Competitive Advantage,”  Harvard Business Review, July 2011. Notes: 4 For more information on the concept of adaptive advantage, see Martin Reeves and Mike Deimler, “Adaptability: The New Competitive Advantage,”  Harvard Business Review, July 2011. They do so by deploying five distinctive capabilities that confer advantage in disruptive environments:

• Signal advantage: the ability to detect, capture, and exploit information patterns as well as to think outside existing frameworks and risk landscapes
• Experimentation advantage: the ability to experiment with new products and services and to use market responses to guide the continuous improvement of their market offering
• Organization advantage: the ability to create an environment that fosters adaptability among employees
• System advantage: the ability to actively shape entire business ecosystems
• Ecosocial advantage: the ability to align the company’s business model with the broader social and ecological context

For an example of how a company’s risk-management system can help it cope with unprecedented challenges, consider the story of First Solar, a maker of photovoltaic panels for solar energy applications.⁵ 5 The material for this example is drawn from “First Solar, Inc., in 2010,” Case SM-190, Stanford Graduate School of Business, October 2010. Notes: 5 The material for this example is drawn from “First Solar, Inc., in 2010,” Case SM-190, Stanford Graduate School of Business, October 2010. From its launch in 1999, the company has built its business model on the principle of minimizing financial risk.

At a time when many companies in the photovoltaic industry were focusing on high-cost technologies for manufacturing high-efficiency cells, First Solar took the opposite approach: focusing on technologies for making moderately efficient but very low-cost solar cells. By specializing in technologies that had relatively low capital expenditure per watt of manufacturing capacity, its founders argued, the company would be able to scale more cheaply (and, therefore, more quickly) than its competitors and to fund the bulk of its growth through its own cash flow. Similarly, in order to avoid overreliance on the many government subsidies available for purchasing solar cells, the company decided to focus exclusively on sustainable markets with economic fundamentals that supported demand for solar cells over the long term.

Both decisions would turn out to be critical when the 2008 global financial crisis completely transformed the company’s business environment. The vertiginous decline in the availability of credit made it far more difficult for companies in the industry to raise financing—a situation that did not affect First Solar because it had been funding its new investments largely from its own cash flow. What’s more, the global recession meant that governments were also cutting back on their subsidies to the green-energy sector, seriously harming the company’s competitors that were too reliant on markets in which such subsidies had dominated. In short, First Solar was able to adapt to this new environment because it had built risk management into its business model. And since then, it has kept close track of emerging technological and political trends and adjusted its model accordingly.

10. Avoid the downside, but don’t forget the upside. In the end, a big part of risk management is about avoiding the downside. And yet, it is critical that risk management not become yet another reason for senior executives to be risk averse or to fear losses more than they value equivalent gains.⁶ 6 See “Memo to Staff: Take More Risks,”  Wall Street Journal, March 20, 2013. For more on the widespread bias toward risk aversion, see Daniel Kahneman and Amos Tversky, “Prospect Theory: An Analysis of Decision Under Risk,”  Econometrica 47 (2), 1979, pp. 263–291. Notes: 6 See “Memo to Staff: Take More Risks,”  Wall Street Journal, March 20, 2013. For more on the widespread bias toward risk aversion, see Daniel Kahneman and Amos Tversky, “Prospect Theory: An Analysis of Decision Under Risk,”  Econometrica 47 (2), 1979, pp. 263–291. Companies should use risk management also to identify new opportunities and to exploit them in a systematic fashion.

During the Great Depression in the U.S., for example, it was precisely those companies that were willing to take risks in order to exploit the enormous disruption and upheaval that ended up not only surviving the crisis but also thriving in its aftermath. Companies such as General Motors, IBM, DuPont, General Electric, and Procter & Gamble outperformed their peers in the Great Depression. They also used the period to create the competitive advantages that would allow them to continue to do so for many years afterward.

Investors will support intelligent risk taking. In the aftermath of the 2008 global financial crisis, BCG surveyed global investors about their priorities for companies in a downturn economy. One of the themes that emerged from the survey was investors’ desire that companies take advantage of the downturn in order to strengthen their competitive position and leapfrog their competitors. In fact, the concern of a majority of the respondents was not that companies were being too aggressive but that they were not being aggressive enough.

One effective approach to benefiting from the upside of risk is to use scenario planning in order to define not only worst-case scenarios but also best-case scenarios.⁷ 7 For a description of how to use scenario planning as a risk management tool in the development of a company’s value-creation strategy, see  Risky Business: Value Creation in a Volatile Economy, the 2011 Value Creators Report, September 2011. Notes: 7 For a description of how to use scenario planning as a risk management tool in the development of a company’s value-creation strategy, see  Risky Business: Value Creation in a Volatile Economy, the 2011 Value Creators Report, September 2011. The goal should be to think in advance about how a company can make the best use of the latest market developments and trends. A prerequisite for conducting frequent scenario analyses, however, is the ability to quickly quantify the impact on key metrics. To achieve this goal companies must define required premises and results, ensure transparency about calculation methodology and assumptions, and establish a quick-response planning process.⁸ 8 For more on this subject, see The Art of Planning, BCG Focus, April 2017 (originally published in 2011). Notes: 8 For more on this subject, see The Art of Planning, BCG Focus, April 2017 (originally published in 2011).

Sensing Risk Early: The Leading-Indicators Report

For a concrete example of how to put our principles for risk management into practice, consider the recent creation of a new leading-indicators report at a global company. BCG worked with the company both to design the report and embed its use throughout the organization.

In the years after the 2008 global financial crisis, the company’s CFO worried that the organization was ill prepared for the growing volatility of the world economy. So, in 2011, he initiated a major corporate program to improve the company’s ability to deal with uncertainty and risk.

As part of the program, the CFO set up a team to develop a companywide system of leading economic indicators. Identifying the right set of indicators, he reasoned, would help the company improve its forecasts of future market developments. It would also make possible the early identification of emerging trends that could affect the company’s sales volumes. The team, led by the company’s top financial controller and chief economist, had representatives from key corporate functions (such as controlling, sales, strategy, economics, and political intelligence) as well as all its major business divisions.

Assisted by BCG, the team came up with three design principles to guide their efforts: selectivity, simplicity, and transparency.

Selectivity. To design the report, the team used a typology of risk management activities that we have used with a number of clients. This typology, illustrated in Exhibit 3, characterizes a given risk-management process in terms of six critical dimensions: purpose, time horizon, unit of analysis, types of risk being addressed, methods for assessing those risks, and desired outputs. As the exhibit suggests, the purpose of the report was to enable quick adjustments to any geopolitical, market, and financial risks in the short-to-medium term that would have a material impact on the company’s sales.

To define the appropriate metrics, team members started collecting all metrics that were currently tracked in various parts of the company. They also identified other internal and external data that, while not currently used, might shed light on future sales. But relatively early in the process, they decided that their strategy would be to focus on a manageable set of indicators that combined early availability (so that the organization would have time to react) with strong predictive power (so that the organization could estimate with confidence the impact on the business).

Both criteria were important. Take the example of an indicator such as the rate of GDP growth in an economy. GDP growth rates had a strong impact on company sales. But, typically, official GDP metrics are retrospective. By the time official GDP growth rates are released publicly, the change has already occurred and the impact on sales is already being felt. Thus, official GDP statistics aren’t much help to the company as leading indicators. In order to estimate future trends in GDP growth, the team chose to use the aggregated monthly GDP forecasts of several external economic institutes and analysts.

In order to ensure that the indicators gave the organization necessary lead times, regional differences had to be carefully taken into account. For example, in Europe, consumers tend to preorder one of the company’s key products directly from the company. Since there is significant lead time between order intake data and sales volume data, order intake data are a useful indicator. In the U.S., however, most consumers buy the product in retail stores, so there is hardly any lead time at all. The team found that in the U.S., the indicators with the most predictive power were delivery volumes from production sites to stores and the discounts offered by retailers.

Ultimately, the team selected 12 key indicators across four dimensions (macroeconomic, political, market, and internal), four regions, and the company’s five divisions. Data on many of these indicators were already being collected somewhere in the company. However, putting them together in a single report helped recipients see the connections and draw conclusions that, previously, had been obscured.

Simplicity. Although predictive power was a key criterion for the indicators chosen, the team decided not to include complex statistical regressions in its leading-indicators report. Instead, they took a pragmatic approach, emphasizing simple correlations between the indicators chosen and the company’s sales volume. The fear was that if the analysis was too sophisticated, it would limit discussion of the report to those with a background in statistics. Therefore, the predictive power of an indicator had to be obvious without complex calculations. This turned out to be critical for encouraging buy-in on the part of all parties throughout the company.

Simplicity, however, did not mean shielding the businesses from the raw data. Often in leading-indicators reports, organizations aggregate information into a single “super indicator” on the theory that the very act of creating a methodology for calculating such an indicator will force the organization to think critically about risk. The downside of such a high degree of aggregation, however, is that the insights in the individual data points are hidden from decision makers and can also breed mistrust of the aggregated metric on the part of managers in the businesses.

The team decided that the greatest benefit would come from exposing the businesses to a wider array of more granular—and sometimes conflicting—data. The conversations and debates sparked by the different perspectives that participants brought to the data would eventually lead to a shared view on potential market developments—one that was informed by a thorough vetting of the probabilities, risks, and critical interdependencies.

Transparency. The discussion of leading indicators can deliver meaningful results only if that discussion is objective and unbiased. In many companies, such objectivity cannot be taken for granted. When anticipated adverse developments carry the implication that a given business is unlikely to meet its targets, two things tend to happen: first, the business ignores the data; second, should the adverse effect actually take place, the business uses the data as an all-purpose excuse for poor performance.

Therefore, this company takes great care to avoid these pitfalls by ensuring total transparency of the data in its leading-indicators report. For instance, division sales and finance representatives have the authority to forward certain data for the report directly to corporate headquarters without first getting approval from the division and function heads (this is the only internal company report for which this is the case). And the leading-indicators team as a whole is empowered to escalate critical issues directly to the company’s senior-management team. The subsequent discussion of the report is moderated by the chief economist, who reports directly to the top management team. The chief economist has the authority to express a dissenting opinion on the interpretation of each individual data point by the business units. This approach ensures full transparency of controversial indicators to top management.

The company has been using the monthly leading-indicators report since early 2012. The divisions highlight any abnormal developments that arise in the indicators. And every quarter, the report is distributed among the top 100 corporate and division managers. The CFO also presents the quarterly report to the senior management team and moderates a discussion about the potential business implications of the data. The report is also used to guide the company’s annual planning process.

Participants recognize that the report has enacted a cultural change in the organization. In the past, the businesses tried to avoid discussions about potential risks and their impacts, so such discussions took place only late in the game, when the impact of changes in economic trends had already hit the company. At that point, the discussion usually focused on blaming others and defending oneself from criticism rather than on defining the appropriate reactions. With the new report, the businesses and relevant corporate functions regularly discuss trends in the macroeconomic environment and product markets and openly share their various perspectives on the possible implications of those trends. Volatility and uncertainty are increasingly accepted as “normal,” with most discussions focused on how best to manage them. Risk management at the company has become a whole new way of thinking and making decisions.

Acknowledgments

The authors would like to thank their BCG colleagues Henrik Blank and Dominic Klemmer for their contributions to the report.