Protecting Against Operational Disasters

Operational risks are much more difficult to manage than financial risks. But a methodical approach can save companies from operational catastrophes.

Most companies are revenue-focused, not risk-focused. They don't gain a real awareness of all the hazards within their organization until something goes wrong. A good example was the Firestone-Ford controversy a few years ago, when neither company accurately anticipated the risks that led to a large number of accidents in Ford vehicles on Firestone tires -- and the business partners blamed each other for the fallout.

Paying attention to operational risks has always been a good idea, but Sarbanes-Oxley is serving as a wake-up call for many companies, since it requires senior managers and board members to achieve a deep understanding of all the significant nonfinancial risks threatening their business. But ferreting out the dangers in a company's operations is a complex and potentially vexing task. Imagine asking a house cleaner to tidy up an entire stadium. That's how daunted some finance executives -- used to managing only traditional financial risks -- feel when they face operational risk management. Who's accountable for each risk? Who's in charge of monitoring it? How much money does controlling it cost? Which risks demand the most attention and resources?

Companies that bring far-flung operational risks under control do so by methodically identifying, ranking, assessing and monitoring those risks. And they develop the kind of culture that encourages cross-departmental communication about the various dangers the company faces.