Managing risk

Risk plays a role in all businesses, but they rarely manage it as well as they could. Management must better understand where companies and business units are vulnerable by assessing their exposure to each type of risk.

Companies must take risks to make profits and create shareholder value. But the record of failure and financial distress in many industries shows that too many executives and directors fail to recognize risk and to manage it appropriately. A risk is any event that would push a company's financial performance below expectations, and there are four main kinds: market risk, which affects the value of a company's products or services; credit risk, from changes in interest rates and from debtors who don't pay up; operational risk, arising from internal mistakes or corruption; and business-volume risk, the result of fluctuating costs or of moves by competitors.

The first step for management is to understand where a company and its business units are vulnerable by assessing their exposure to all types of risks, which vary from one industry to another. A heat map like the one in the exhibit can help managers spot high-risk areas that require immediate attention—in this case, units B and D are running credit risks that exceed 10 percent of their capital. Other areas too require careful attention.

For more about how executives can begin to think about building high-performance risk-management organizations, read "Running with risk."