Certain organizations always seem to be in front of the pack. They consistently deliver good results and are more apt than competitors to capitalize on industry shifts. When surprises occur, they act with speed and efficiency. In short, they are in better control of their operations and turn this into competitive advantage. Think of General Electric in the 1980s and 1990s - a powerful but nimble giant - or your favorite stock in the fastest-growing small companies.   

Regardless of size, the key to winning is translating the CEO's goals and values into employee actions and behavior. Successful organizations possess four key attributes: 1) strong leadership; 2) individual accountability; 3) effective risk management; and 4) human resources reinforcement.

A practical action plan to garner better control of your company requires steps in each of these areas.  

Leadership

Consciously or not, employees look to executives for goals and values that are clear, inspiring and provide a context for their individual goals. Effective leadership brings a shared sense of purpose and a belief that the team will win. These leaders spell out a strong "tone at the top" supporting integrity, ethics and risk management. These leaders also develop business goals and risk tolerance levels. 

Winning does not just happen. It requires setting specific goals and ensuring that everyone understands their part. Think of your company. Is the goal to"make money for shareholders" or to "build the fastest computer, period?" The first goal is surprisingly common but does not guide executives and employees to set their own goals and prioritize accordingly. The second allows executives to develop specific business plans that cascade down the organization. With specific goals, everyone understands what is expected of them and how their part fits into the whole.  

Leaders articulate a risk tolerance that ties back to their goals and values. Everyone understands that the manager of a widows and orphans fund will be far more conservative that a hedge fund manager. So it should also follow that someone building the "fastest computer, period" will consciously foster a risk-taking culture to stimulate innovation. Think of your culture - are you supposed to "swing for the fences" or "never make a mistake?" Which is more suited to your individual business goals? 

Having defined goals, values and risk tolerance, management must also "walk the walk." Nothing undermines employee drive and values more than the perception that higher-ups live by a different standard. For example, if an accounts payable clerk complains to his supervisor that the vice president of sales is constantly padding expense reports and the supervisor takes the complaint up the chain of command to the CEO who then does nothing, it will begin to erode office morale.   

Goals and values are meaningless if they are just words on a business plan. Leaders must be tireless in reaching out to employees, customers and other stakeholders with visits, emails and all forms of communication. This communication must be two-way for both good and bad news. Former GE CEO Jack Welch was a very effective communicator and listener. Each quarter, he traveled around the world visiting GE facilities and customers. Often, he would stand on a table in a conference room and address employees. He focused on three key messages: reiterating the company's goals and values; explaining the role of the specific location he was visting; and emphasizing that any question was fair game. Employees and managers alike left those sessions fired up and with a better understanding of their roles within the GE organization.   

Individual Accountability

Success starts with a strong CEO and an independent board setting a tone of oversight, guidance and accountability at all levels of the organization. For each individual, it is important to have specific annual goals, a list of the specific risks they are expected to manage, and a clear understanding of ethical boundaries and risk tolerance. The following steps can help strengthen employee accountability.

Develop individual goals: Overall company goals must cascade down the organization so that everyone's actions are coordinated. In the case of building the fastest computer, the head of human resources may have a goal of finding the best R&D talent in the world. The head of sales may want to develop more effective contacts in the Department of Defense. In all cases, there must be a linkage with the person above you and those below. These goals should also be developed collaboratively to ensure buy-in. 

Establish authority: Employees need to be empowered to achieve their objectives and targets by wielding proper authority to allocate resources. 

Measure performance: The individual goals, developed above, should be measurable - reduce customer returns by 10%, no ethical violations, etc. Individual performance should be reviewed periodically so that there are no surprises at the year-end review.

Conduct risk management training: All managers and employees should have their set of business goals. Training should be conducted to educate everyone on the risk tolerance of the organization and to identify the risks to be managed. They should also be aware that the risk champion is available for assistance.
 
Develop risk monitoring metrics: The best practice is to develop dashboard reports showing how the measurable risks are performing within an established risk tolerance band. Typical things to track include inventory, sales pipeline, customer credit, performance of competitors, health of vendors, customer satisfaction, etc. Depending upon the environment, this dashboard may be real-time (trading desk), weekly (retail) or monthly (basic industry). 

Managing Risks

Effective organizations do not think of risk as something about which only the auditors worry. They create a culture where managing risk is openly discussed and shared by management, employees, auditors and other monitors.  

Effective risk management begins with the appointment of a champion - a highly regarded individual who can devote sufficient time to begin the process and drive it through the organization. The champion's role is to assess risks but also to educate the organization and be and catalyst for change. 

Documenting risks is vital. The best method is to interview executives and subject matter experts throughout the organization about their business plans and the risks that might be encountered. Once the themes and points from these interviews are consolidated, it can be helpful to cross-reference your results with industry and compliance checklists. Be careful, however, not to base your entire risk assessment on these checklists as they may not provide a total picture of the company's risk. In order to also identify the big risks ("black swans") that may be unique to your company, it is important to incorporate open-ended, brainstorming sessions that cover operational, financial and compliance risks.

Consider the 2008 risk assessment taken by Goldman Sachs and their competitors. Goldman concluded that their risk models were too limited to assess their mortgage backed security positions. They concluded that far more extreme conditions could develop and they exited the business. At the same time, Lehman Brothers and Bear Sterns were comfortable with their models, remained in the business and eventually had to file for bankruptcy when the market collapsed. Everyone had the same data, but Goldman chose to interpret it in a different, more expansive way and identified a potential black swan.  

Aligning monitoring and controls begins with identifying the risk monitoring processes. Effective risk monitoring does not always require elaborate internal controls. Many risks can be adequately monitored by setting numerical performance indicators and assigning the daily, weekly or monthly monitoring of that risk to a qualified individual.

In the identification process, three different issues will arise. Certain risks will lack monitoring processes or controls, certain monitoring processes or controls will be ineffective, and opportunities for greater efficiency will be identified. For each of these cases, the risk champion can develop an improvement plan with the specific management team that includes corrective actions, individual accountability and a timeline for improvement.

Human Resources Reinforcement

For many organizations, the greatest asset is quality, motivated employees. As a result, HR processes - from hiring and rewarding desired behavior to punishing undesired behavior - are critical to success. 

Good performers should receive a disproportionate share of the bonus and raise pool to encourage even better performance. Poor performers must be coached on a set schedule and told exactly what they must do to remain on the team. Consider your team, if the average raise last year was 2.5%, did this mean that your lowest performer received 0% and the top person received 8%? If not, why not?

Hiring the right people is also critical. Think about your last important hire. Did you spend a significant amount of time developing a profile of the technical and behavioral attributes that you needed? Screening the pool, first, with a detailed profile lowers the risk of hiring the wrong people and often shortens the process. So, each position should have a thorough job specification covering both technical and behavioral demands. The technical description covers the necessary skills and experience required in the position.  The behavioral requirements will ensure a fit with the demands of the position (instant action vs. patience) and fit into the culture. 

__________

Written by:  Andy Barfuss

Andy Barfuss is a partner in the risk advisory practice at accounting firm of Amper, Politziner & Mattia in Edison, New Jersey.

The above article is reprinted from the July 2010 on-line edition of Risk Management Magazine.