The sources of company disruptions range from natural calamities such as hurricanes and earthquakes, to human-caused disasters such as terrorist attacks, oil spills, and chemical accidents. Economy-wide shocks such as the 2008–2009 financial crisis in the United States caused enterprise disruptions worldwide. Technological breakthroughs such as digital marketing have upended established business models. Public regulations and government restrictions, from emission rules to immigration bans, have also threatened some of the best-operating enterprises. Company disruptions can sometimes come from inside the firm’s own walls, whether from executive malfeasance, worker sabotage, fraudulent reporting, the unexpected departure of an indispensable executive, or the release of a fatally flawed product. Costly litigation, cover-ups, and failed mergers can add their own troublesome waves.
FROM INTUITIVE TO DELIBERATIVE THINKING
Decision-makers tend to be shortsighted when reaching decisions on whether to invest in protection against catastrophic risks, reluctant to incur high upfront costs for loss mitigation measures unless near-term payoffs are evident. Intuitive thinking, guided by emotional reactions and simple rules of thumb does not work well when managers do not have data on the possible outcomes and when complexity is high. Deliberative thinking, by contrast, gives greater attention to reasoned analysis and complex protocols before choosing among alternative courses of action. The analytic and systematic methods associated with deliberative thinking can better direct a manager’s attention to the multifaceted sequences and consequences that characterize low-probability, high-impact events.
RISK ANALYSIS AND RISK MANAGEMENT
When disaster strikes, if directors, executives, and managers have already put in place a risk management culture and architecture enabling them to take comprehensive action in response, they will be better prepared to recover from disruption and remain aligned with the firm’s core values.
Management identifies and assesses the hazards faced by the firm, and then sets its risk appetite and risk tolerance as the foundation for developing and leading its risk-management and crisis strategies.
Specifying the firm’s risk appetite and risk tolerance often entails testing the company’s resilience at the extremes by applying scenario analyses and stress testing. While the degree of financial distress is usually the first benchmark, it is not the only ranking criterion at many companies. The impact of risk on a firm’s brand and credibility is frequently also important as it is generally recognized that a damaged reputation can severely impair a firm’s earnings.
Boards have become more directly engaged in company strategy and leadership, helping to define risk appetite, risk tolerance, and risk readiness. Catastrophic risks deserve the attention of all directors. Directors can appraise company risks in the development of new products and services, posing critical questions. Directors are advised to draw a bright line between risks where they should play an active role and those over which executives should exercise delegated authority. Alerting directors to company operations can help prioritize risk management in the boardroom.
SEVERE STOCK PRICE DROPS
What risks or events are likely to have a negative impact on the market value of a firm? And how long will it take for the stock price to bounce back, if ever? Enterprise resilience, a firm’s readiness to come back from adversity, can be measured by the time it takes for the full restoration of its market value. With our research team, we studied stock prices of S&P 500 firms over the period January 1, 2000 to December 31, 2011, focusing on disruptive events that resulted in a value loss of at least 20 percent–plus changes in stock price for individual companies over a ten-trading-day period relative to changes in their overall industry average.
The three most frequent drivers of precipitous losses in company value were reputation and marketing (risks related to the firm’s brand, reputation, image, product pricing, and market share); operations (risks associated with mismanagement or unforeseen shortfalls in the internal operation of a business, including production and manufacturing); and acquisitions (risks stemming from all phases of a major acquisition). The number of significant drops in stock prices rose five-fold from 2000–2006 to 2007–2011 as a result of government policies or actions.
SIXTEEN STEPS TOWARD MASTERING CATASTROPHIC RISK
We propose a set of management practices for company leaders to overcome systematic biases and reduce the likelihood and the impacts of large-scale disruptions. On the premise that we can all become better at catastrophic risk management if we learn from one another, we encourage readers to share experiences, tactics, and nudges at cat-risk@wharton.upenn.edu.
1: Prepare for Low-Probability Events
Without specifying their willingness to accept some risks and avoid others, company leaders are less able to identify the hazards that require attention. Directors set the tone for the C-suite and subordinates.
2: Know Your Risk Appetite and Risk Tolerance
Some firms, notably financial institutions, have developed ways to quantify both their risk appetite and their tolerance for taking on risks. By specifying these two metrics, companies can better determine the risks they are willing to take and the protective measures required as a result.
3: Think Long-term
Many firms are reluctant to engage in protective measures because of their high upfront costs. The lack of investment will not be a problem until the “Big One” hits Tying executive pay to multiyear performance-based incentives like stock options can remind those most responsible for company performance of the need for long-term planning.
4: Consider Worst-Case Scenarios
Scenario planning, sensitivity analyses, and stress testing enable firms to determine where the benefits of preventive measures exceed their costs for a wide variety of consequences across a range of severe events. Given the great uncertainties associated with extreme events, firms should run their algorithms with a range of outcomes, likelihoods, and timeframes.
5: Appreciate Global Interconnections
A flattened world has facilitated international trade but also proliferated risks, given companies’ increased reliance on dispersed networks of suppliers and distributors. Manufacturers depending on a single supply source, for instance, can face disruptions from disasters on the opposite side of the globe, as the auto industry experienced in the wake.
6: Diversify Suppliers
The best time to appreciate if a firm has sufficiently diverse sources of supply is before one is taken offline. Earthquakes and floods disrupt global supply chains, and many companies are taking steps to diversify their suppliers.
7: Stretch Time Horizons
Taken individually, extreme events are relatively rare. If the likelihood of a specific adverse event this year is one in a hundred, that seemingly remote probability may understandably result in our failure to pay much attention. On the other hand, if we redo the math to report the probability over the next thirty years, we learn that it is one in four, and that may be more than enough to lead companies to take protective measures.
8: Act Fast, Even with Imperfect Information
Company calamities are by definition fast-moving and widely impacting, which often limits the information available to those responsible for surmounting the adversities. Complete data for making management decisions are never available, and even less so in the midst of a crisis, but that is precisely when fast and informed decisions are needed.
9: Conduct After-Action Reviews
Disciplined learning from both near misses and direct hits can be invaluable. After a close call or disruption has just occurred, a company’s leadership is more open to doing something than before the adverse event to prevent a recurrence.
10: Beware of Fighting the “Last War”
When company leaders believe that the next disruptive event will somehow be similar to the last one, they are likely to be ill-prepared for the coming one. Learning from after-action reviews is essential, but so too is recognizing that the next disaster is unlikely to resemble the most recent setback.
11: Be Alert to Near Misses
Business leaders are likely to congratulate themselves on avoiding a disruptive event, rather than asking why they were fortunate not to have been hit this time. A counterfactual for surmounting this shortcoming would be: “Can we gain insights from a near miss if it had actually been a hit instead?”
12: Learn from Competitors’ Misfortunes
Some might gloat over competitors’ calamities, but these present a unique learning opportunity for others wishing to avoid the same. Directors, executives, and managers should not believe that threats or incidents at other firms are devoid of implications or warnings. Trade and professional associations can play a vital role in disseminating experienced-based lessons and creating spaces where directors and executives can learn from counterparts in other organizations.
13: View Risk Management as a Value-Creating Strategy
Risk management should be viewed as a long-term investment in staying competitive by creating sustainable value and protecting the firm and its reputation, rather than a short-run burden on management’s time and the company’s budget.
14: Insure Against Adverse Events
By transferring financial exposure to a third party through insurance, firms are able to increase their risk appetite and risk tolerance, knowing they have protection against large losses. When a firm cannot secure insurance against a given risk at an attractive price, however, it may opt to self-insure, though the high price of insurance could be viewed as a market signal that the risk is not worth taking.
15: Be Unsurprised by Surprise
Catastrophic situations rarely provide sufficient warning in advance of their occurrence. Preparedness for shocks has become an essential company capacity according to most of the firms in our study. The unexpected is to be expected, as is a readiness to think deliberatively and to act with alacrity.
16: Everybody Is Responsible
Enterprise risk management can best be viewed as the responsibility of all, from front-line managers to the risk-analysis team, to the internal audit group, to top executives. Directors can also provide invaluable guidance on risks and their mitigation if they serve not just as a watchdog for investors but also a partner with executives.
14: Insure Against Adverse Events
By transferring financial exposure to a third party through insurance, firms are able to increase their risk appetite and risk tolerance, knowing they have protection against large losses. When a firm cannot secure insurance against a given risk at an attractive price, however, it may opt to self-insure, though the high price of insurance could be viewed as a market signal that the risk is not worth taking.
15: Be Unsurprised by Surprise
Catastrophic situations rarely provide sufficient warning in advance of their occurrence. Preparedness for shocks has become an essential company capacity according to most of the firms in our study. The unexpected is to be expected, as is a readiness to think deliberatively and to act with alacrity.
16: Everybody Is Responsible
Enterprise risk management can best be viewed as the responsibility of all, from front-line managers to the risk-analysis team, to the internal audit group, to top executives. Directors can also provide invaluable guidance on risks and their mitigation if they serve not just as a watchdog for investors but also a partner with executives.
Howard Kunreuther is the James G. Dinan Professor, Wharton School, and Co-Director of the Wharton Risk Management and Decision Processes Center. He has a long-standing interest in ways that society can better manage low-probability, high-consequence events related to technological and natural hazards. He is the author of Insurance and Behavioral Economics: Improving Decisions in the Most Misunderstood Industry (with Mark Pauly and Stacey McMorrow); and Leadership Dispatches: Chile’s Extraordinary Comeback from Disaster (with Michael Useem and Erwann Michel-Kerjan).
Michael Useem is the William and Jaclyn Egan Professor of Management and Director of the Center for Leadership and Change Management at The Wharton School, University of Pennsylvania. He is the author of The Leadership Moment, Investor Capitalism, and The Go Point, among other books. The Leadership Moment is listed as one of the 10 best leadership books on the Washington Post “Leadership Playlist.”
© 2018 Wharton Risk Management and Decision Processes Center. All rights reserved. No portion of this brief may be reproduced without permission of the authors. Unless otherwise stated, viewpoints are those of the authors.