In retrospect, it’s clear that the heart of the 2008 credit crisis was a failure in risk management. Indeed, the crisis provides a rich context for understanding where risk management goes wrong and how it can be improved. Banks overextended themselves, but the root cause was not individual bad judgment. It was formalization: the institutional bad judgment that comes from habitual reliance on regulations and structures (or, as Max Weber defined it, bureaucracy) to control activity.
Historically, bureaucratic control has had many benefits: It establishes formal rules and procedures that transcend individual idiosyncrasies and traditional orthodoxies. However, it also has many unwanted side effects: It can become overly rigid and specialized, it encourages groupthink, and it can lead to depersonalization and a lack of commitment on the part of employees. Reliance on rules can bring down companies because it inhibits them from taking the right risks in the right way.
That is precisely how bureaucracies failed many of the large investment banks. During the 2000s, the banks developed, with many signatories, multistage procedures to evaluate which risks were worth taking. These procedures were so elaborately defined that, as Andrew Kuritzkes put it, well-intentioned managers could no longer see the forest for the trees. The banks also externalized risk management, relying on expertise and approval from outside parties such as auditors, regulators, and credit-rating agencies. This allowed individuals to detach themselves — legally and morally — from the system in which they were working.
The banks that survived the credit crisis most effectively, such as Goldman Sachs and JPMorgan Chase, had a different approach to risk: personalization. Instead of embracing bureaucracy, they pushed more responsibility to individual decision makers and required them to live with the consequences of their choices. This in turn required a higher quality of insight, greater personal accountability, and a stronger supportive culture for risk management. Gillian Tett of the Financial Times reported about this in January 2008: “Employees [at Goldman] typically view themselves as being affiliated to the bank, not business line, and there is a strong ethos of shared accountability.” Similarly, at JPMorgan Chase, CEO Jamie Dimon has been known to take an active personal role in risk briefings.
Most smaller players, such as hedge funds, also escaped relatively unscathed. This was partly because their decision makers were close to the action, highly knowledgeable, and personally accountable for the outcomes of their decisions. As one leading hedge fund executive commented to us, “We have robust informal systems, we communicate naturally, and we develop our own views on what risks to take. We get a return on our judgment.”
Successful companies in other sectors also have highly developed forms of personalization. In the pharmaceutical industry, for example, firms make high-stakes investments in new drugs all the time. These firms have sophisticated formal systems and stringent external regulations, but in addition they rely on the strong ethical norms and professional standards of the medical community.
Insight, Accountability, and Culture
For us, the importance of personalization became clear in a research project we conducted on risk management in large organizations, beginning in late 2007. We interviewed executives in financial-services, pharmaceutical, oil and gas, mining, and telecommunications companies, and in the public sector, particularly among law enforcement agencies in the United Kingdom. We found that the concept of personalization has great intuitive appeal. Nonetheless, people struggle with applying it in large organizations that rely on formal systems to get work done.
Our research suggests three elements are necessary. Each of them can be fostered through organizational practices.
1. High-quality insight. Effective personalization of risk management requires putting the right information in the hands of those making a decision, and then rapidly transforming that information into insight, based on collective deep experience. The U.K. police force provides one example: When an incident flares up and becomes serious, an employee of any rank can call on a cross-force “critical incident” group to pull together all the available information about the situation and the larger community. Critical incidents are called only occasionally — when the officer’s “antennae” are “twitching” — but they provide an effective way of quickly bringing to bear all the different views on an issue and reaching a thoughtful decision.
One major mining company achieves similar levels of insight by deploying an independent assessment team to consider any proposed investment (such as a new mine) before a decision is made. The corporate investment committee reviews the proposal in light of two views: that of the business unit seeking investment funds, and that of the independent team. This company now has an enviable record of making profitable mining investments.
2. Personal accountability. Organizations managing risk need a system in which the individual or team with the highest-quality insight is also responsible for the decision. For example, every airline captain knows that decisions about risk must be made at an appropriate level, one where the decision maker has the requisite experience and maturity. The captain may, for example, delegate specific decisions to engineering specialists or dispatchers, but the decision to fly the plane rests with him or her, not the air traffic controllers or the airline’s chief executive.
In the business world, accountability is as likely to sit with a team as with a named individual, but the logic is essentially the same. Every board member in a public corporation, and every partner in a partnership, understands his or her formal accountability. But clearly the top of the organization is not the appropriate level for many decisions; firms need to find mechanisms for pushing personal accountability down to those who are closest to the action. For example, in the banking sector this might mean replacing short-term rewards for consummated deals with a set of short-, medium-, and long-term incentives that reflect the value of the trade over time.
3. A culture that encourages employees to keep sight of the big picture. The informal norms of behavior in a firm — its culture — should support the principles of high-quality insight and personal accountability. Karl Weick of the University of Michigan has pointed out the importance of this behavior in his studies of nuclear power plants and aircraft carriers, where errors can have catastrophic consequences. In these “high reliability” organizations, individuals employed in activities such as routine maintenance understand the risks their organizations face and act accordingly. Rather than compartmentalizing every task, employees are encouraged to look across the boundaries of their jobs and to understand the implications their work has for others.
This refusal to lose sight of the big picture is a crucial aspect of personalization. For example, in 1993 the Danish pharmaceutical company Novo Nordisk failed badly in a mock audit. This led to a root-and-branch rethinking of its management processes that culminated in a new approach called the “Novo Nordisk way of management.” The firm put forth a formal statement of its “values” (accountable, ambitious, responsible, engaged with stakeholders, open and honest, ready for change) and built a set of teams to instill these values across the organization. One team, dubbed “stakeholder relations,” looks internally at dilemmas and opportunities to raise awareness of the values. Another team performs annual organizational audits, and a third group — 14 facilitators drawn from the ranks of senior management — visits units to evaluate how well they comply. A critical feature of this approach is that it is non-hierarchical: It encourages individuals at all levels to talk with the facilitators about issues that are not being taken up through the chain of command.
Evolving toward Personalization
The elements of personalization may seem familiar. But comparatively few companies exhibit them — or even get close. Instead, most corporate decision makers operate within cultures that institutionalize poor judgment. They reinforce biased and blinkered insights; they allow people to make decisions without being accountable for the consequences; and they create siloed structures in which people lose sight of the forest for the trees.
Today the economy depends on the ability of companies to evolve past their own reliance on bureaucracy. Companies that move from formalization to personalization tend to do so slowly but deliberately, building the capabilities for decision making as they make relationships stronger, reduce their reliance on procedures, and increase the value they place on accountable individual judgment. Before long, with increasing personalization, people in these companies learn to recognize “false positives”: the risks that are not worth taking because they lead to wasted investments. And they also see the “false negatives”: the risks of inaction when, if they don’t step in, a competitor might or an opportunity could be lost.
- Julian Birkinshaw is a professor of strategic and international management at the London Business School, a cofounder of the school’s Management Innovation Lab, and the deputy dean for programs. His book Reinventing Management: Smarter Choices for Getting Work Done (Jossey-Bass) will be released in May 2010.
- Huw Jenkins is an executive with BTG Pactual, a Brazilian investment bank. He was formerly executive in residence at the London Business School and CEO of UBS Investment Bank.
- An earlier article by the authors on this theme was published by the United Kingdom’s Advanced Institute of Management Research.