The Art of Risk Management

We worry that in their headlong embrace of formal systems of risk management, many companies are pursuing a highly technical approach to risk management—characterized by complex financial models and elaborate, formal risk-management systems—in isolation from the day-to-day activities of the broader organization. The result is that risk management may exist as a formal function, but it is not really embedded in the “mindset” of the broader organization and, therefore, is not shaping behavior and informing decision making.

To be sure, metrics, systems, and processes are important. And for the vast majority of companies, it probably does make sense to create a formal risk-management function. But developing the right risk-management mindset and organizational culture is even more important—and, in our experience, far more difficult to implement.

Companies need a new approach. They need to stop thinking of risk management as primarily a regulatory issue and to re-conceive risk management as a value-creating activity that is an essential component of the strategic debate inside the company. The goal of that discussion should not be to eliminate risk, or even to minimize it, but to use it to create competitive advantage. And doing that effectively depends upon a far more dynamic interaction between risk management experts and the line organization.

Creating a more dynamic managerial system for risk management is as much an art as it is a science. In working with our clients to develop this new approach, BCG has identified ten principles that should govern the art of risk management.