23 June 2009

Factors That Kill Risk Management: Stupidity, Fear, Greed

Ineffective risk management is a symptom of a disease that has been spreading throughout corporations over the last two to three decades, leaving tremendous devastation in its path. The disease has been difficult to detect and, in many cases, the symptoms are masked. However, over time, this disease has wreaked havoc on employees, business, and even entire industries. It has been somewhat of a silent killer, yet it has been well fed by those at the top. The disease has tainted so many and spread so widely that not many corporate cultures have been spared. The disease is called greed.

Upper management in progressive corporations created the right conditions for greed to thrive when they designed an executive compensation system that predominantly rewarded short-term financial performance. Companies quickly learned from each other, and in order to stay competitive, many publicly held corporations designed executive compensation packages rich in stock options that were exercisable within a short amount of time after being awarded. Of course, upper management has justified this approach because of its need to increase shareholder value through increasing its market valuation, which takes us to the other system that has been fueled by greed: the overall stock market.

The focus continues to be on the near term with a reward system that reinforces behavior that will try to bring, or even force, early success. A mindset has developed that some have called a "conspiracy of hope." It is a conspiracy of hope because those who need to know and should know about possible risks act irresponsibly as they avoid dealing with the ugly realities. They demand that "it" be "managed," which sometimes means the risk is simply ignored or rationalized away. Those in their organizations who openly verbalize their concerns are not seen as "team players," or they are labeled as not being "tough enough" for the job. In this kind of corporate culture, management wants to keep and reward those who will "make it happen" and takes pride in replacing the naysayer as quickly as possible. The practice of risk management can become merely an exercise where everyone goes through the motions, but no one is really trying to understand the threats. And remember that publicly held companies are required to disclose any known material risk that could have a negative impact on the company stock performance (i.e., possible stock option degradation for the boss). It is not beneficial to know and understand the true risk situation if you have to report it.

The basic underlying value system of a company is reflected in the actions and decisions made by management. Employees at the bottom can wave all the red flags they want, but until those who control the company are motivated to care about long-term results, many of these red flags may be ignored. People are very clever and very adaptable. We learn quickly how to survive and thrive in a particular company by knowing and understanding both the written and unwritten rules and practices. If there is not a basic value system that places a high importance on operating with integrity and high ethical behavior, risk management just becomes a game.

Albert Einstein said, "Three great forces rule the world: stupidity, fear, and greed." When it comes to risk management, I think we have all three of these forces coming together in an ugly way.

I welcome your comments on this issue of the Cutter Edge and encourage you to send your insights on the market in general to comments@cutter.com.

-- Christine Davis, Fellow, Cutter Consortium

Factors That Kill Risk Management: Stupidity, Fear, Greed

Advice and Analysis

The Cutter Edge is a free biweekly e-mail service that gives you information and advice that you can put to work immediately for your organization. Issues are written by Cutter Consortium's journal and Senior Consultants. Sign Up »

New Report
  • Ending Security and Privacy Leaks
  • Has your organization done all it can do to reduce the risk of a security incident or privacy breach?
  • Learn More »