​Silo-based processes, a hyper focus on numbers, and confusing terminology often produce lots of activity with no real management of risk. This article introduces business leaders to a simple framework for helping their organizations manage risk.

This multi-part article summarizes our experience in helping business leaders adopt and apply a risk management approach that is useful to every member of the organization, from senior management to entry-level employees. Since the inception of building corporate risk management capacity in post-World War II companies, business leaders have struggled to define and implement processes that identify and manage material risks, often with devastating consequences. The collapse of Enron in late 2001 which, in turn, led to the passage of Sarbanes-Oxley Act of 2002 is a good example.

​Named “America’s Most Innovative Company” by Fortune for six consecutive years between 1996 and 2001, Enron developed a “killer app” reputation by converting energy supplies into financial instruments that could be traded online like stocks and bonds. Much of Enron’s success was attributed to its Risk Assessment and Control Unit (the “RAC”) which employed more than 150 analysts (financial experts, accountants, statisticians etc.) and had a $30 million budget.

As reported in the book The Smartest Guys in the Room: The Amazing Rise and Scandalous Fall of Enron (2003), Enron’s RAC and internal risk management processes were increasingly ignored as hubris took over and company leaders began to think that if they could trade energy, they could trade any type of derivative from television advertising time to high-speed data transmission. Many of these trading ventures failed and when their creative (and often illegal) hiding places were discovered, Enron collapsed into the biggest corporate bankruptcy ever. Since then, Enron has been surpassed by even larger corporate bankruptcies (e.g., WorldCom, Lehman Brothers etc.).

The lesson in all of this is that risk management is personal – it’s what lies within each of us. Every person, every employee is a risk manager. We all make risk decisions every day, often habitually and without critical thinking or input from others. We overestimate our abilities and underestimate what can go wrong and we have been doing this since the beginning of time. Greek mythology is replete with stories about how heroes (e.g., Achilles) failed because of their arrogance and conceit.

With the knowledge that risk management is personal and still in its infancy, we offer our definition:​

A Framework for Learning to Thrive in a World of Uncertainty​

For now, let’s concentrate on the phrase learning to thrive. As our elders often remind us, learning is a lifelong pursuit. One of the best examples of risk management in sports, UCLA’s John Wooden, the ESPN Coach of the 20th Century, was fond of saying that ability may help you get to the top but it takes character to stay there and “that when you are through learning, you are through.” Our choice of the word “thrive” is also intentional. Thrive means to grow or develop well; to prosper and flourish.

Learning to thrive, therefore, is the purpose of risk management. Our aim should be to learn what we can do better, individually and collectively, to help people in our midst grow. It means supporting people so they can realize their potential in ways that are good for them personally and those around them. We encourage our children to do well in school so they have freedom to pick their favorite college, and eventually make a living that is of value on many levels. In other words, the parent-child relationship is one of trust: children learn that in exchange for effort and commitment, parents will help them realize their potential.

Looking back at the case of Enron, CEO Jeffrey Skilling violated this precept and the signs were there from the beginning. Loren Fox in the book Enron: Rise and Fall (2003) tells a story about Skilling’s time as a student at Harvard. A professor asked Skilling what he would do if he were CEO of a company that made a product that killed customers. Skilling replied that he would continue to make and sell the defective product because his responsibility was to enhance shareholder value, not worry about the public’s health.

In part two of this article, we will look at the work of Arie de Geus, the former Corporate Planning Director in charge of business and scenario planning at Royal Dutch Shell. In 1997, de Geus published a book entitled The Living Company: Habits for Survival in a Turbulent Business Environment which has been translated into more than twenty languages. There is no better place to start than de Geus’s work to study the concept of “learning to thrive.”