At your own risk! : how the risk-conscious culture meets the challenge of business change

375 Pages·2008·11.325 MB·English

by  Lynch, Gary Scott

At Your
Own Risk!
Howthe Risk-Conscious
Culture Meets the
Challenge of Business
Change
At Your
Own Risk!
Howthe Risk-Conscious
Culture Meets the
Challenge of Business
Change
JohnWiley& Sons, Inc.
Thisbookisprintedonacid-freepaper.
Copyright 2008byGaryS.Lynch.Allrightsreserved.
PublishedbyJohnWiley&Sons,Inc.,Hoboken,NewJersey.
PublishedsimultaneouslyinCanada.
Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,ortransmittedinanyformorby
anymeans,electronic,mechanical,photocopying,recording,scanning,orotherwise,exceptaspermitted
underSection107or108ofthe1976UnitedStatesCopyrightAct,withouteitherthepriorwritten
permissionofthePublisher,orauthorizationthroughpaymentoftheappropriateper-copyfeetothe
CopyrightClearanceCenter,Inc.,222RosewoodDrive,Danvers,MA01923,978-750-8400,fax978-646-
8600,oronthewebatwww.copyright.com.RequeststothePublisherforpermissionshouldbeaddressedto
thePermissionsDepartment,JohnWiley&Sons,Inc.,111RiverStreet,Hoboken,NJ07030,201-748-6011,
fax[phone],oronlineathttp://www.wiley.com/go/permissions.
LimitofLiability/DisclaimerofWarranty:Whilethepublisherandauthorhaveusedtheirbesteffortsin
preparingthisbook,theymakenorepresentationsorwarrantieswithrespecttotheaccuracyorcompleteness
ofthecontentsofthisbookandspecificallydisclaimanyimpliedwarrantiesofmerchantabilityorfitnessfor
aparticularpurpose.Nowarrantymaybecreatedorextendedbysalesrepresentativesorwrittensalesmaterials.
Theadviceandstrategiescontainedhereinmaynotbesuitableforyoursituation.Youshouldconsult
withaprofessionalwhereappropriate.Neitherthepublishernorauthorshallbeliableforanylossofprofitor
anyothercommercialdamages,includingbutnotlimitedtospecial,incidental,consequential,orother
damages.
Forgeneralinformationonourotherproductsandservices,ortechnicalsupport,pleasecontactourCustomer
CareDepartmentwithintheUnitedStatesat800-762-2974,outsidetheUnitedStatesat317-572-3993or
fax[phone].
Wileyalsopublishesitsbooksinavarietyofelectronicformats.Somecontentthatappearsinprintmay
notbeavailableinelectronicbooks.
FormoreinformationaboutWileyproducts,visitourWebsiteathttp://www.wiley.com.
LibraryofCongressCataloging-in-PublicationData:
Lynch,GaryS.(GaryScott),1958-
Atyourownrisk!:Howtherisk-consciousculturemeetsthechallengeofbusinesschange/GaryS.Lynch.
p.cm.
Includesindex.
ISBN978-0-470-25941-2(cloth:acid-freepaper)
1. Organizationalchange. 2. Riskmanagement. I. Title.
HD58.8.L962008
658.406–dc22
2008008488
PrintedintheUnitedStatesofAmerica
10 9 8 7 6 5 4 3 2 1
To Kenneth Lynch—my Dad
Fifty-five years of service as a Fireman.
Risk is his job.
Risk is his life.
Table of Contents
AbouttheAuthor ix
Acknowledgements xi
Introduction:CauseandEffectintheBraveNewWorld 1
CHANGE,THEDOUBLE-EDGED SWORD 13
RapidChange,EscalatingRisk 17
CauseandEffect 35
TheVulnerableOrganization 61
LINEOFSIGHT/OBSTRUCTED VIEWS 85
ALeadershipCrisis? 89
TheValueChain 115
CONSCIOUSNESS,ENGAGEMENT,AND EXECUTION 141
Develop,Nurture,andSustainARisk-ConsciousCulture 143
DiverseStakeholders’ ViewsandMotivationsAcrossthe
ValueChain 171
ExecutingthePlan 195
Index 231
About the Author
GaryS.Lynch,CISSP,istheGlobalLeaderofMarsh’sSupplyChainRisk
and Intelligence Solutionspractice.Duringhis30-yearcareer,hehas
heldanumberofseniorpositionsinoperationalrisk,businessresiliency,and
IT security at Chase Manhattan Bank and The Prudential. Before joining
Marsh,hewasapartneratBoozAllenHamiltonand,priortothat,atErnst&
Young. He was also global research director and market analyst for the
GartnerGroup.AgraduateofNewYorkInstituteofTechnologywithaBS
degreeinFinance,Garyhasbeenaguestlectureronoperationalriskatthe
NYU Stern School of Management, has contributed to the World
Economic Forum (WEF) 2007 and 2008 Global Risk Report, and been
a panel member at the 2008 World Customs Organization (WCO); 2007
AsiaPacificEconomicRegion(APEC),and2006/7/8RiskandInsurance
Management Society forums.
GaryhasappearedonCNBCAsiaSquawkBox,theDiscovery/Equinox
Channel,NBCNightlyNews,andtheABCbroadcastnetwork.Hehasbeen
published in CEO Magazine, the Wall Street Journal, Knowledge@Wharton,
CIO Insights, Financial IT Decisions, The Asset, Business Review Weekly, and
Business Insurance Magazine, as well as a number of other publications.
Gary received a commendation from the U.S. Secret Service for his
contribution during the 9/11 crisis and was awarded the Silver Medal of
Valor by the Nassau County Fire Service, New York.
Gary has four children and lives in Mendham, New Jersey.
Acknowledgements
AsIsatdowntocompilethelistofpeoplethatIwantedtoacknowledge,I
couldnothelpbutbedistractedbytwobreakingnewsstories.Bythe
time you have picked up (and hopefully read) this book, these stories will
havebeenanalyzedfromeveryangle.IreflectforamomentbecauseIcannot
help but be concerned at these real examples of rapidly escalating risk;
Societe Generale’s 7.2 billion alleged trading fraud (exposure estimated at
onepointtobeinexcessof 70billion1)and,GeneralElectric’sMoneyunit
misplacingacomputer tapethatcontainedthepersonalrecordsof650,000
J.C.Penneycustomers.2Ithinkbacktothedaysofworkingasanoperational
and ITrisk manager. One of the first people I’d call for advice was Craig
Goldman.IwouldliketoacknowledgeCraigastheultimateriskadvocatein
hisroleasthefirstCIOoftheChaseManhattanBank(nowJPMorganChase)
and a board memberof a numberof companies.Retirednow,Craig isstill
committed to raising awareness. He not only sacrificed countless hours
providingvaluableinsightforthisbook,buthewasthefirstexecutivethatI
encounteredwhobackedthetalkwithaction.IconsiderCraigamentorand
visionary,butmostofallIconsiderhimafriend.Thisbookwouldnothave
been possible without Craig’s help and support.
I would also like to thank Karen Avery, who inspired me to write this
book.Sheisadearfriend,andtogetherKarenandIhavebeen‘‘breakingalot
of glass’’ over the years, trying to get executives to heed the warning and
embrace the issues
1Wall Street Journal, January 27, 2008.
2CNNMoney,http://money.cnn.com/2008/01/17/news/companies/penney_data
.ap/ index.htm?postversion=2008011722.
I’d also like to acknowledge my consulting clients, and members of my
private network. There are a few that stand out; Lou Belsito at DRS
Technologies, thanks for your incredible commitment to execution and
believing inthemessage(andme),longbeforeallothers;GaryMuchaand
Diane Foley at BAE Systems for your insight, vision, and willingness to
execute; Dave Carpenter at PepsiCo for your broad perspective based on
reality;JohnBarbanoatJohnson&Johnson,thanksfortheinitialstakeholder
hierarchy; Roger Lyster formerly at Chase, who inspired me to pursue all
negative information; Jim O’Brien at the Albright Group for valuable
insight and a public-sectorcontext (Ienjoyed traveling the globewithyou
and the entire Albright team in our quest to advance pandemic prepared-
ness);JimWoolseyforsharinghisincredibleinsightandexperience;Lenny
Goldstein, thanks for being committed to the cause and making risk a
priority;MichaelLiebowitzatNYUandformerpresidentofRIMS,thanks
for the great debates and valuable insight—I really enjoyed working with
youoverthepastthreeyears,tryingtoraiseawarenessoftheneedtobebetter
preparedforahealthemergencysuchasapandemic(let’skeepwearingthem
down!); Harry Leff at Marsh, thanks for the introduction and the ‘‘going
beyond’’ support; John DeRemigis, executive editor at Wiley, for your
patience; Michael C. Thomsett for your writing and support; John
Merkovsky at Marsh, thank you for your support in getting this project
moving; my brother/sister firefighters in the Floral Park and Mendham
TownshipFireDepartments,30yearsofendlessfriendshipandpreparation,I
willneverforgetthelessonslearnedandlifeexperiences;andofcourse,my
children; thanks for the constant reminderof why I stay committed to the
cause.Finally,inmemoryofAshleyCarltonandRobertNewton,youwill
serveasaconstantreminderofhowpainfulandeverlastingriskcanbewhen
it becomes a reality.
Introduction:
Cause and Effect in the Brave
New World
O brave new world, that hath such people in it.
—WILLIAM SHAKESPEARE, 1612–13
W hen Huxley wrote Brave New World, taking his title from one of
Shakespeare’s later works, he aptly described some aspects of the
society we live in today. In Brave New World, a Utopian future society has
createdacultureofcompletedependenceinexchangeforspecificbenefits,
butatthecostoflostpersonalfreedomandresponsibility.
The equivalent in today’s organizations is that with amazing technolog-
icaldevelopment,instantaneouscommunications,globallydistributedcus-
tomer base and workforce, and lean/modularized supply chains, it has
become difficult to manage—that is, identify, assess, prioritize, mitigate,
andmonitor—potentialrisk.Therealityofthisbravenewworldisthatrisk
isontherise;threatshavebecomemorepervasiveandvulnerabilitiesmore
relevant.
At Your Own Risk!: Howthe Risk-Conscious Culture Meets the
Challenge of Business Change
By Gary S. Lynch
Copyright © 2008 by Gary S. Lynch.
Theseissuesshouldconcerneveryorganizationandindividualsincethe
lack of consciousness, priority, resources, and action jeopardize our social
andeconomicinfrastructures.Unlikethecatastrophicor‘‘low-probability/
high-impact’’ event, these everyday risks, when aggregated or repeated,
can become a ‘‘flash point’’ for an undesirable outcome. Beware: the vul-
nerability gap is widening at an exponential pace. Change to our newand
constantlyevolvingglobaleconomyisoutpacingmanyorganizations’abil-
itytosystematicallymanagetherisk.Iprovideagraphicthatdescribesthis
wideninggaporchasminChapter2.
One of the principles of capitalism is the idea of control. Small busi-
nesses desire less oversight and more autonomy. As a result, corporations
can quickly and easily find themselves in a conflicting position. By over-
stratifying supply chains, incorporating numerous tertiary parties, busi-
nesses create quite the opposite result of autonomy. In reality, they have
created a long line of interdependency, leaving each link in the chain con-
tingent on the previous link. Control has been relinquished to so-called
‘‘partners,’’ but in reality, many organizations know very little about all
thosethattheydependontocreatevalue.Worseyet,blindassumptionsare
being made about their partners’ ability to understand, assess, and manage
risk in a way that is consistent with their own risk expectations. Many of
these partners, and their partners’ partners, are operating in environments
prone to hazard, political, environmental, societal, health, and criminal
risks. Many of these partners share their capabilities and resources with
yourorganization’scompetitors.Andmanyofthesecompetitorsoperatein
locations without labor, environmental, privacy, intellectual property, and
product regulation or oversight. All of these threats and vulnerabilities
are real and relevant. In the past six months many organizations have
witnessed—orworse,fallenvictimto—manyoftheserisks.Herearejusta
fewexamples:
The supplyof the lifesaving blood-thinning drug heparin was halted
in February 2008. A Chinese facility responsible for the production
of the active product ingredient has been suspected of being conta-
minated, resulting in the deaths of four people and hundreds of
otherswithallergicreactions.1
The financial viability of a major financial institution was brought
into question when a rogue derivatives trader was able to bypass