An Approach to Managing Operational Risk

You plan, you set expectations, and you deliver. You meet your goals, and you are well-rewarded. There are handshakes, slaps on the back, and the cycle repeats. You and your company are on a roll—masters of your universe.

Then, a butterfly flaps its wings six time zones away, and a snowstorm of epic proportions closes O'Hare airport. This strands your head of sales in Omaha, causing him to miss his son’s championship basketball game for the fourth year in a row. He decides to quit and take a job requiring less travel. You successfully recruit a replacement with a stellar resume—so stellar, in fact, that she leaves your company after just two quarters. You miss your revenue expectations for three consecutive quarters, and suddenly, the board wants to know what’s going on.

The Illusion of Control Life—and business—is uncertain, yet we often plan and manage our responsibilities as if it isn't. Our early successes are based on an ability to make things happen, get things done, and keep variables under control. We work hard, and our resulting achievements reinforce the dangerous illusion that no problem is beyond our control. Human psychology makes it difficult for us to accept that we don’t control nearly as much as we think we do.

This is exacerbated by the way we construct narratives. Sports provide a perfect illustration. Though a New England Patriots fan, I am keenly aware that one of their recent Super Bowl victories was largely made possible by a coin flip ("heads") in Kansas City that gave the Patriots the ball first in overtime, keeping the high-powered Chiefs offense off the field. Yet, subsequent interviews focused entirely on "a good week of practice" and "doing your job." A more accurate portrayal would have started by thanking the universe (or the butterfly wings) for the coin flip, followed by acknowledging the hard work. But narratives rarely leave room for uncertainty, randomness, or factors completely beyond our control.

Formalizing Uncertainty When we finally recognize uncertainty, we can manage it formally—and this leads to better outcomes. People make smarter decisions when they possess an accurate sense of uncontrollable factors. Formal analysis weighs the probability of an event against the cost of mitigating that risk. When organizations (such as Sony, GE, and Bridgewater Associates) formalize their decision-making processes, a natural result is the elevation of explicit risk planning.

To build a common approach, let’s examine the nature of uncertainty across three key dimensions of operations:

• Core Delivery: This encompasses the creation, sales, and delivery of your products or services. External uncertainties might include supply chain dependencies or delivery disruptions. Additionally, think of core delivery as an asset vulnerable to shifting markets. For a software company, a major risk to their core delivery asset is the market's sudden shift away from traditional software toward service-based platforms (SaaS).
• Personnel: Companies often have succession plans for executives, but the real risk usually lies deeper. It is the key operational resources—those with unique, difficult-to-replace knowledge—who present the greatest vulnerability. The person in your organization who is the only one capable of managing your platform migration goes home every day, and you just have to hope she chooses to come back tomorrow. Departments experiencing inordinately high attrition are red flags pointing to root causes that must be addressed.
• Change Initiatives: Industry surveys suggest that the failure or "disappointment rate" for major change initiatives is roughly 40%. Even if the reality is half that, it behooves a thoughtful company to manage the risk. One rarely pursued but highly effective strategy is launching redundant or competing efforts. If you need to bet your company's future on an effort with those odds, maybe you should bet on both red and black.

A Standardized Approach to Operational Risk Against this backdrop, we have developed a simple, comprehensive framework to manage risk. It is designed to be inclusive (gathering input from all key contributors) and focused (ensuring results are actionable without creating unnecessary overhead).

1. Inventory: Develop an outline of the areas to be assessed. Create an objective, comprehensive view of the risks for each area. Formal, published assessment frameworks are helpful starting points, though you will need to tailor them to your specific operational reality.
2. Focus: Engage in moderately structured work sessions to explore the perspectives and concerns of key contributors. The goal is to invoke frank, honest discussions about challenging areas.
3. Align: Position these discussions positively as "risk identification brainstorming" rather than an "assessment" or audit. A knowledgeable but neutral facilitator is highly recommended here. The output should be a prioritized list of risks with agreed-upon actions. Document and communicate these outcomes clearly.
4. Execute: Develop and formalize the action paths. Assign ongoing, long-term responsibilities for these actions to specific individuals.

One Final Caveat Never ignore the elephant in the room. If your company is facing an existential core challenge, make that an explicit dimension of your risk management. For instance, a brick-and-mortar retailer transforming into a digital enterprise is best served by investigating the operational risks of their new hybrid model, rather than wasting time analyzing how digital factors might impact a legacy retail model that is already dying.

At Orchestration Services, we’ve developed targeted risk assessment frameworks for a variety of industries and functional areas. Contact us to learn how we can help secure your operational future.