Too Much Information, Not Enough Analysis

"Where is the knowledge we have lost in information?"

Who knew that poet T.S. Eliot was such a shrewd risk manager? Chief risk officers (CROs), CFOs and other finance executives would do well to heed this line from one of Eliot's works. Eliot's question crystallizes one of the most disastrous pitfalls threatening organizational risk management programs: too much information and too little analysis.

During the past two years U.S. companies, survey data tell us, have made enterprise risk management (ERM) programs more popular and more sophisticated than ever before. Yet, the high number of companies that perished, or nearly did so, in the past two years (e.g., Borders, Blockbuster, A&P, Urban Brands, Innkeepers USA, MGM, Oriental Trading Company and so many more) also indicates that we have a major risk management shortcoming in our midst.

Yes, we have entered an era in which companies are "Competing on Analytics," as Tom Davenport and Jeanne Harris announced in their 2007 book. Yes, Moneyball, the film based on Michael Lewis' 2003 best-selling account of Oakland Athletics' GM Billy Beane's groundbreaking use of analytics in Major League Baseball, is one of the most noteworthy Hollywood releases of the fall. And, yes, the thirst for more precise and more illuminating analytics in marketing, human resources and just about every other corporate function has never been greater.

No offense to Davenport, Beane or any analytics advocate, but analytics fall short. Moneyball is like a baseball game cancelled in the fourth inning due to rain. The incompleteness exists not in transforming data into information (which more and more organizations do quite well) but in the subsequent and more important step: deriving knowledge from this information. Doing so requires better human decision-making based on heady analysis of the right information.

Risk management programs, complete with risk metrics, existed at Borders, MGM and most of the other companies that filed for bankruptcy protection or ceased to exist in the past 18 months. Blockbuster has a worldwide director of ERM.

The conventional wisdom that Borders went out of business because of e-books and online bookselling seems more convenient than accurate on closer inspection. After all, Borders sold e-book devices in its stores just as Barnes & Noble hawks its Nook e-reader (much more prominently and effectively, of course). And Amazon did not kill Books-A-Million, the lesser-known, still-in-business Birmingham, Ala.-based book chain. Unlike Borders, Books-A-Million did not cede its online channel to Amazon.

Also, Books-A-Million, which briefly flirted with buying Borders (and has subsequently opened new locations in old Borders' stores and hired former Borders employees), sells the Nook from its own online channel. So, both booksellers were aware of the threats and opportunities e-books created, but one possessed and acted upon better knowledge about this risk.

For its part, Blockbuster's demise cannot be wholly attributed to Netflix, but also to Blockbuster's failure to compete down-market with low-cost, kiosk-movie-renter Redbox. The failures at Blockbuster, Borders and most of the other companies that floundered in 2010 and 2011 have less to do with faulty risk information and more to do with a scarcity of risk knowledge.

Just ask the corporate board members who have been drowning in risk information ever since the passage of the Sarbanes-Oxley Act. A new Protiviti article indicates that the volume of risk information delivered to the board has "increased steadily in the past decade," the quality of these reports "requires improvement."

The problem with the risk reports board members receive from CFOs and CROs are threefold; the risk information lacks focus, contains too little analysis and is too voluminous. Protiviti's financial services experts suggest that companies in all industries would benefit from a risk index that is customized to an organization's unique qualities and designed to answer two big questions with confidence:

• Is our organization riskier today than it was yesterday?
• Is our organization likely to become riskier tomorrow than it is today?

Such an index would rely on an algorithm that churns specified risk metrics into knowledge.

That may not sound poetic, but it certainly will help companies steer clear of the competitive wasteland.

Contributing editor Eric Krell reports on governance, risk management and compliance for Business Finance.