Risk is a fact of business life. Taking and managing risk is part of what companies must do to create profits and shareholder value. But the corporate meltdowns of recent years suggest that many companies neither manage risk well nor fully understand the risks they are taking. Moreover, our research indicates that the problem goes well beyond a few high-profile scandals. McKinsey analyzed the performance of about 200 leading financial-services companies from 1997 to 2002 and found some 150 cases of significant financial distress at 90 of them.1 In other words, every second company was struck at least once, and some more frequently, by a severe risk event. Such events are thus a reality that management must deal with rather than an unlikely "tail event."
Directors confirm this view. A 2002 survey by McKinsey and the newsletter Directorship showed that 36 percent of participating directors felt they didn’t fully understand the major risks their businesses faced. An additional 24 percent said their board processes for overseeing risk management were ineffective, and 19 percent said their boards had no processes.
The directors’ unfamiliarity with risk management is often mirrored by senior managers, who traditionally focus on relatively simple performance...