Norman Marks on Governance, Risk Management, and Internal Audit

I recently re-read an article in a McKinsey’s Strategy & Finance newsletter, Overcoming a bias against risk. (I strongly recommend subscribing.)

Although it starts with “Risk-averse midlevel managers making routine investment decisions can shift an entire company’s risk profile,” the main point I got from the piece was that individual managers at any level, including on the board, can be overly risk-averse. They can also be overly risk-taking.

Why? Because their individual bias for or against taking risk gets in the way of objective decision-making.

Here are some excerpts:

• Much of the commentary about behavioral economics and its applications to managerial practice, including our own, warns against overconfidence—that biases in human behavior might lead managers to overstate the likelihood of a project’s success and minimize its downside[1]. Such biases were certainly much debated during the financial crisis.
• Often overlooked are the countervailing behavioral forces—amplified by the way companies structure their reward systems—that lead managers to become risk averse or unwilling to tolerate uncertainty even when a project’s potential earnings are far larger than its potential losses[2].
• …dynamics like this play out many times per year across companies, where decisions are driven by the risk appetite of individual executives rather than of the company as a whole. In a single large company making hundreds of such decisions annually, the opportunity cost would be $2 billion if this were to happen even 20 times a year over five years. Variations of this scenario, played out in companies across the world, would result in underinvestment that would ultimately hurt corporate performance, shareholder returns, and the economy as a whole.
• Mitigating risk aversion requires that companies rethink activities associated with investment projects that cause or exacerbate the bias, from the processes they use to identify and evaluate projects to the structural incentives and rewards they use to compensate managers.
• In fact, we frequently run across CEOs stymied by their company’s struggle with risk; decisions that may be in the best interest of individual executives, minimizing the risk of failure, are actually harmful for their companies. As the CEO at a manufacturing company observed, his company’s business unit–level leaders gravitate toward relatively safe, straightforward strategies with earnings goals that seem reachable, even if these strategies mean slower growth and lower investment along the way. We have also heard from many nonexecutive board members that their companies are not taking enough risks.
• When we tested how 1,500 executives from 90 countries reacted to different investment scenarios, we discovered that they demonstrated extreme levels of risk aversion regardless of the size of the investment, even when the expected value of a proposed project was strongly positive. Specifically, when presented with a hypothetical investment scenario for which the expected net present value would be positive even at a risk of loss of 75 percent, most respondents were unwilling to accept it on those terms. Instead, they were only willing to accept a risk of loss from 1 to 20 percent—and responses varied little, even when the size of the investment was smaller by a factor of 10. This is almost shocking, as it suggests that the level of risk aversion is remarkably constant within organizations, when it should vary based on the size of the investment and its potential to cause financial distress.

The article has more on the above, although it focuses on risk aversion and doesn’t talk about managers who take too much risk. Their personal risk attitude may be to put the longer term in jeopardy so they can make money and earn bonuses today.

I have seen this many times in sales organizations, where the sales personnel see the only downside to taking excessive risk (even on occasion committing fraud in the process) is having to find their next job – not a significant concern because on average they only stay with a company for a couple of years or so. “According to HubSpot, the average sales rep tenure is 18-20 months[3].”

The authors have some interesting suggestions for addressing excessive risk aversion:

Up the ante on risky projects. Risk-averse organizations often discard attractive projects before anyone formally proposes them. To encourage managers and senior executives to explore innovative ideas beyond their comfort levels, senior executives might regularly ask them for project ideas that are risky but have high potential returns. They could then encourage further work on these ideas before formally reviewing them. They could also require managers to submit each investment recommendation with a riskier version of the same project with more upside or an alternative one.

Consider both the upside and downside. Executives should require that project plans include a range of scenarios or outcomes that include both failure and dramatic success. Doing so will enable project evaluators to better understand their potential value and their sources of risk.

These scenarios should not simply be the baseline scenario plus or minus an arbitrary percentage. Instead, they should be linked to real business drivers such as penetration rates, prices, and production costs. For example, when evaluating the introduction of a new consumer-goods product, managers should explicitly consider what a “home run” scenario would look like—one with high market share or high realized unit prices. They should also look at a scenario or two that captures the typical experience of product introductions, as well as one scenario where it flops. By forcing this analysis, executives can ensure that the likelihood of a home run is factored into the analysis when the project is evaluated—and they are better able to thoughtfully reshape projects to capture the upside and avoid the downside.

Avoid overcompensating for risk. Managers should also pay attention to the discount rates they use to evaluate projects. We repeatedly encounter planners who errantly use a higher discount rate simply because an outcome is more uncertain or the range of possible outcomes is wider (see “Avoiding a risk premium that unnecessarily kills your project”). Higher discount rates for relatively small but frequent investments, even if they are individually riskier, do not make sense once projects are pooled at a company level.

Instead, if companies are concerned about risk exposure, they might adopt a rule that any investment amounting to less than 5 to 10 percent of the company’s total investment budget must be made in a risk-neutral manner—with no adjustment to the discount rate.

Evaluate performance based on portfolios of outcomes, not single projects. Wherever possible, managers should be evaluated based on the performance of a portfolio of outcomes, not punished for pursuing more risky individual projects. In oil and gas exploration, for example, executive rewards are not based on the performance of individual wells but rather on a fairly large number of them—as many as 20, in one company. Hence, it may not be surprising to find that oil and gas executives pool risks and are more risk neutral.

Reward skill, not luck. Companies need to better understand whether the causes of particular successes and failures were controllable or uncontrollable and eliminate the role of luck, good or bad, in structuring rewards for project managers. They should be willing to reward those who execute projects well, even if they fail due to anticipated factors outside their control, and also to discipline those who manage projects poorly, even if they succeed due to luck. Although not always easy to do, such an approach is worth the effort.

What should practitioners do about this?

The authors talk about a “corporate center”. That would probably include both risk and audit practitioners:

The corporate center must play an active role in implementing such changes—in setting policy, facilitating risk taking, and serving as a resource to help pool project outcomes. It will need to become an enabler of risk taking, a philosophy quite different from that currently expressed by many corporate centers.

While many are talking about “risk culture”, I am not an advocate of the idea. There is no single, homogenous culture within an organization around risk-taking – and nor should there be. I don’t want my sales personnel having the same risk attitude as the accounting staff or the safety team.

My thoughts:

1. Recognize, and assess if possible, the risk of taking too little risk.
2. Also assess the risk of taking too much risk.
3. Understand and assess the policies, controls, and other activities that can lead to being excessively risk averse or risk-taking. Do they collectively provide reasonable assurance that individuals will take the right level of the right risks (assuming they have all the necessary information). If not, what can and should be done?
   1. Talk to top management about their tolerance for mistakes, which can lead to excessively risk averse behaviors.
   2. Make sure individual targets and other measures used to determine compensation and bonuses are in line with organizational objectives.
   3. Understand how risk attitudes are considered in the hiring process.
   4. Are there appropriate risk indicators that will identify the wrong level of risk-taking?
   5. Is action taken, as needed, when the wrong level of risk is (or is likely to be) taken?
4. Understand and assess the potential (i.e., the risk) for risk assessments to be warped by cognitive bias. I discuss this at some length in World-Class Risk Management, but there is more in Daniel Kahneman’s books.
5. Where the risk of bias is high, and therefore risk assessments are likely to be high, understand and address the root cause(s).

I’m sure there is more than should be done.

Your thoughts?

===================================================================

[1] Daniel Kahneman and Dan Lovallo, “Delusions of success: How optimism undermines executives’ decisions,” Harvard Business Review, July 2003.

[2] Daniel Kahneman and Dan Lovallo, “Timid choices and bold forecasts: A cognitive perspective on risk taking,” Management Science, January 1993.

[3] https://www.smartwinnr.com/post/statistics-that-prove-that-sales-turnover-is-exploding-and-some-useful-tips-for-you-to-reduce-this-tunover-at-your-organization/#:~:text=is%201.8%20years.-,Permalink,even%20reach%20their%20maximum%20potential.