Risk management is a formal process owned by senior executives responsible for keeping everyone safe and sound day and night. They report to internal and external audit committees or, actually, prefer to avoid any and all interaction with audit folks since even a casual discussion with auditors can result in a boatload of work for entire teams of already overworked professionals.
So what do they audit and how is risk assessed? Most risks are the standard fare. If the audit tells you that your disaster recovery plans are inadequate, then the company will be placed at risk. If your wireless networks are insecure, then the risk bells will go off. If your change-control processes are weak, then the audit will identify some major risks for you to address, reduce, and eliminate.
All the standard questions should be asked — and answered. Auditors, bean counters, and “admin Nazis” all deserve their due. It’s who we are as good (legal) corporate citizens. But there are some significant additional questions and issues that should be addressed as well that speak to a set of quotients we all should seek. Here’s the short list:
1. Agility Quotient (AQ)
If your company (and the professionals who run it) are slow, deliberate, conservative, and risk-averse, then your risk to profitability — and indeed even survival — is high. The global marketplace is a high-velocity trading floor that requires companies to assess, decide, implement, and change — quickly. If your decision-making apparatus is old and tired, you are at risk. If you’ve got layers of decision-making authority, you’re at risk. Agility challenges governance and standardization. It makes them flexible — and living. The best way to increase your AQ is to define your decision-making processes and identify the obstacles to speed and flexibility.
2. Inconsistency Quotient (IQ1)
This is the real “IQ” — the extent to which your company is creatively inconsistent. This counterintuitive business risk is high when policies, procedures, processes, and protocols become obstacles to change. One of the major metrics a company should embrace is creative inconsistency — the ability to change its mind over and over again in the face of information and experience that challenge what appears to be “right.”
3. Talent Quotient (TQ)
TQ speaks perhaps the most important risk you face. It’s an insidious risk because it’s mixed with friendships, relationships, and pure emotion. How good are you at telling your lunch buddy that he or she is a lazy idiot? Probably not very good. In fact, and underscoring the risk, research suggests clearly that we prefer to work with people who are nice but not all that talented. The challenge, of course, is to brutally assess talent in spite of emotion, personal relationships, and the drama associated with making tough personnel decisions.
4. Competitor Intelligence Quotient (CIQ)
CIQ should improve every year if you expect to remain competitive in a constantly changing marketplace. Who are your competitors today? Who will they be in five years? It’s the unconventional competitors that pose the greatest risk. Will you be disintermediated by the Web? Will your cost structures change dramatically because of shifting labor rates? Will your primary and secondary markets change or be threatened by some competitors you’ve never heard of? Competitor risk is not just from corporate competitors. The government is another competitor especially in highly regulated industries. It’s a good idea to track the environment and even international relations as well; natural disasters and wars are usually not that good for business — unless you make bottled water or semiautomatic weapons. The failure to track the right competitors over time will substantially increase your product, service, and marketing risks.
5. Innovation Quotient (IQ2)
A high IQ2 is a core competency for every company on the planet. In fact, it’s so obvious that every company today talks about innovation all the time. The problem is that very few companies understand innovation and even fewer invest in it. Low IQ2s are everywhere. If innovation was a school, the dropout rate would be about where it is in most US big city high schools. So how can innovation risk be managed? First and foremost, just about all of us should acknowledge that our IQ2s are low. Then we need a disciplined investment program staffed by creative, empowered, and incentivized professionals, which may be consultants if you can’t find them internally (or don’t have time to grow them internally). Contrary to popular belief, innovation is a business with its own processes, procedures, protocols, and tools. What’s necessary to increase innovation is commitment. Companies that commit to innovation and entrepreneurialism are far more likely to have high IQ2s than those that don’t. It’s really that simple.