CEOs are not idiots when it comes to risk management

CEOs got to the pinnacle of their organization because they are anything but idiots.

Yet, if you consider the small number of organizations where risk management is considered as providing a strategic advantage (according to the latest study by the ERM Initiative that number is 20% of all organizations), one of these alternatives must be true:

1. Even mature risk management doesn’t provide a strategic advantage. In fact, it is doubtful (as indicated in the report as the sentiment of most organizations) that the value of risk management exceeds its cost.
2. People don’t know how to design a risk management program that delivers value in excess of its cost, to the point that it provides strategic advantage.
3. CEOs are idiots.

I pick the prize behind door number two.

Here’s the problem.

If all you do is manage the downside, you are not helping manage the upside.

I have been saying for at least a decade that management needs to take risks to survive and thrive, and that means balancing the potential harms that may occur against the potential rewards.

Yet, time and again I keep seeing risk management portrayed as understanding, assessing, evaluating, and addressing potential…