Governance, Risk and Compliance

There is an old saying that the first step in solving a problem is giving it a name. I think we have a problem called catastrophic corporate failures and I think it has become a pandemic.

Historically, we have been treating the corporate failure problem in its many forms like we do the weather: it is something that is to be endured, not as something that can be eliminated or reduced. I believe it is a problem we are now ready to solve. I am in my 4th decade of professional practice and would estimate that in each and every year of my career there have been catastrophic corporate failures linked primarily to what we now call operational risk.

What is catastrophic corporate failure? Let me suggest a definition. I’ll use one suggested by Deloitte published in a recent paper a which defined catastrophic corporate failure as 20% loss in shareholder value over a 30 day period. I’d argue that definition is a low standard, but a reasonable starting point. Corporations can inflict catastrophic impacts on stakeholders that do not show up in share price. There have been massive frauds, massive environmental incidents, frequent tragic and needless industrial accidents, tragic losses due to natural events, massive financial reporting failures and massive compliance failures, all of which have had catastrophic impacts on shareholders and other stakeholders. One of the symptoms of our failure to address the problem is that we do not even count the number of such failures. In retrospect all of these catastrophes were systemic, predictable and avoidable. Virtually none were random. The failures afflicted companies in all industries, from retail, to oil companies, financial institutions, and telephone companies and on and on. They seem to have become more pervasive, more frequent and larger over my career. Each round of failures spawns hope in the form of new regulations, new standards, new methodologies, new ideas and new professions. They have had no lasting impact. Catastrophic failures continue unabated nd they grow larger and more pervasive. My question is this. Who is responsible today for driving down catastrophic corporate failure? Internal Auditors? Risk Managers? Compliance Managers? Procesor Business Owners?.  If I have missed anyone please write yourself in. Whose job is it to pull the pieces together and solve the problem of catastrophic corporate failure?

We have auditors of all shapes and sizes. We have risk specialists, computer specialists, actuaries, accountant, quality specialists and fraud specialists. We have regulators of all sorts. We have professional standard setters. We have organizations and associations of professional standard setters. But whose job is it to end catastrophic corporate failure and drive resilient business performance?

Today’s headlines tell us of the new financial regulatory reform being debated in Congress. Will that reform bring about the necessary change? I’m really interested in your thoughts on this question although to be quite honest I have come to my own conclusion. Without fundamental change there will be no reduction in the rate, size or pervasiveness of catastrophic corporate failure. unless it becomes the driving goal of a specific group or organization that sets out to accomplish it. No such group exists today. All of the current GRC professions, regulators and standard setters have had no impact to date. Does the knowledge and skill exist today to drive down catastrophic corporate failure? Most certainly among the frameworks, regulators and professions listed above the knowledge and tools exist. Technology will play a role. What’s missing? The only major missing ingredient is the single organization with the single driving mandate to do so. Do precedents exist? Actually they do exist. Here is the analogy I use. If aviation was managed the way GRC is managed, airplanes would be falling out of the sky or colliding in mid air daily. The aviation industry undertook to drive down aviation catastrophes and they have done so. Somewhat facetiously in a blog a few weeks ago I compared the regulatory framework of the airline industry and specifically the National Transportation Safety Board (NTSB) efforts in relentlessly driving down aviation catastrophes over the past decades. The industry has succeeded by integrating what I call Context risk – understanding where failure can occur; Event risk, understanding what causes failure; and Human Behavior risk – learning how to leverage human skills and knowledge through training, accountability and motivation. Every single principle used to drive down catastrophic aviation failure could also be used to drive down catastrophic corporate failure. There is nothing exotic or complicated about it. It simply requires a clear goal and a relentless effort. Step 1 is starting to recognize that there is such a thing as catastrophic corporate failure. Step 2 is starting to count and analyze the failures. Step 3 is beginning to bring to bear the tools to solve the problem. I am convinced driving down catastrophic corporate failure is possible and that none of the individual measures in place today will have any effect on their own.