OK, you’ve read the headline. Now you’re thinking: what is he talking about? What does a board game have to do with risk management?
Bear with me.
First, a little history. Snakes and ladders originated in ancient India. The game was played on elaborate boards decorated with gods, angels, flowers, animals, and other majestic things. Ladders represented virtues. Snakes represented vices. The number of ladders was fewer than the number of snakes. The message of the game was: “live a virtuous life and attain salvation. Succumb to vice and suffer.” And with fewer ladders than snakes, there were always plenty of opportunities for bad things to happen.
So, there is the first piece of the puzzle answered. Our destiny is shaped by our choices and affected by things that pull us off course.
Risk management starts with organizational values. They define the strategic direction and the organization’s appetite for risk. Those values shape strategic choices and translate into operational processes, practices and controls.
That all sounds like a morality lesson. How does it help me redesign my organization to manage risk better?
In Midnight’s Children, Salman Rushdie wrote:
All games have morals; and the game of Snakes and Ladders captures, as no other activity can hope to do, the eternal truth that for every ladder you hope to climb, a snake is waiting just around the corner, and for every snake a ladder will compensate.
Organization are like games. They involve strategy, chance and uncertainty. Companies attack the competition. They suffer setbacks when unexpected things happen. A good dice roll — call it planning, luck, or foresight — sends a business up the ladder. A bad dice roll causes the organization to suffer the consequences.
Designing robust and resilient risk management systems involves a complex set of activities and judgment calls. Potential risks need be identified and evaluated based on the probability that they’ll occur and the impact they’d have on the organization. A low impact risk might take you down a short snake. A high impact risk — one of those dreaded “red zone” risks — could drive your business right to the bottom of the gameboard.
Another key factor — and one that is often overlooked — is where an organization’s people and culture fit into risk management. Let’s face it: the most robust and well-designed risk management system in the world won’t work if your people don’t have the right mindset and your culture isn’t aligned with your organizational values. If your people don’t understand and embrace your risk management culture, there’s a good chance that you’ll end up suffering the consequences. Another slide down the gameboard.
Opportunities are ladders, risks are snakes. The key to reaching your organization’s desired destiny lies in your ability to build a mindset and a culture — right from the top — that sets the right conditions for the game.
So how do you design a resilient risk management system?
Start by thinking of risk and (risk management) as an experience — rather than an analytical process driven by spreadsheets. Gather a cross-disciplinary team from across your organization — and be sure to involve people with skills that seem counter-intuitive to the work. Stock up on Post-It-Notes and find a large space. Engage your team in mapping out their understanding of your values, and what they understand about risk in your business.
This latter point is key. Before you go too far, you need to have a clear vision about your organization’s appetite for risk. For some organizations — especially many nonprofits — risk is a thing to be avoided at all costs. But if your business is in a highly competitive market, risk is the feedstock for innovation.
Once you’ve mapped your values and clarified your risk appetite, test them against your strategy. Do the pieces fit together? If not, it’s time for a refresh. Next, take a look at how your organization works day-to-day. Do you have a strong culture of accountability and reporting and well-defined systems and processes? Do they align with your values, risk appetite and strategy? If not, then grab those Post-It-Notes and engage your team in redesigning your risk management experience.
The players in the game (your team) can’t avoid risk or seize opportunity if they don’t know and play by the rules. If you don’t mind an occasional trip down the snake — if you need take a few of those risks to succeed — then you’d better create a culture that tells your people how to play the game.
So risk management is a morality lesson and the game is your business. The key to success in the game lies in designing an organizational experience that rewards and celebrates the risk mindset you need to reach your destiny.
One last thought. Go into your files and junk all of the complex risk registers and spreadsheets that were created by the last group of high-priced risk management experts you hired. Go out and buy a copy of Snakes and Ladders and a big stack of Post-in-Notes and start designing a risk culture that will enable your organization to thrive in a rapidly changing world.
