A New Balanced Scorecard

7/31/2019 A New Balanced Scorecard

1/12

A new balanced

scorecardMeasuring performance andrisk


2/12

Risk lets get this straight up

front is good. The point of risk

management is not to eliminate

it; that would eliminate reward.

The point is to manage it that

is, to choose where to place

bets and where to avoid betting

altogether.

Managing Risk in the 21st Century

Thomas A. Stewart, Fortune, 7 February 2000


3/12

1A new balanced scorecard Measuring performance and risk

Due to the recent turmoil in the nancial sector, it is easy

to lose sight of the fact that risk management at many non-

nancial companies is not sufciently effective either. All

too often, and in all sectors of our economy, efforts in risk

management are dispersed, isolated and unrelated to the

wider company strategy. Many organizations would benet

greatly from a more comprehensive and integrated risk

management approach that takes into account strategic,

operational, nancial and compliance risks.

An effective risk management system covers all risk areas,

is deeply embedded within existing practices in the company

and is present throughout all its businesses. Risk management

should not be a separate silo, a relatively isolated add-on to

the day-to-day workings of the organization. On the contrary,

risk management should be intimately linked to performance

management. Performance management and risk management

are two sides of the same coin and should be treated as such.Splitting them into different and virtually separate management

systems signicantly reduces the effectiveness of risk

management and may have dramatic consequences.

Introduction

The goal:

Risk management should not be a

separate silo, a relatively isolatedadd-on to the day-to-day workings

of the company. To the contrary, risk

management should be intimately

linked to performance management.

The reality:

The pressure on the risk department to keep up and

approve transactions was immense criticisms that

we were being non-commercial, unconstructiveand obstinate were not uncommon.

At the root of it all, however, was and still is a deeply

ingrained aw in the decision-making process The

business line was more focused on getting a transaction

approved than on identifying the risks in what it was

proposing. The risk factors were a small part of the

presentation and always mitigated Collective common

sense suffered as a result. Often in meetings, our gut

reactions as risk managers were negative. But it was

difcult to come up with hard-and-fast arguments for

why you should decline a transaction, especially when

you were sitting opposite a team that had worked for weekson a proposal, which you had received an hour before the

meeting started. In the end, with pressure for earnings

and a calm market environment, we reluctantly agreed

to marginal transactions.

The Economist, Confessions of a Risk Manager,

7 August 2008


4/12

2 A new balanced scorecard Measuring performance and risk

Risk management aligned with

performance management

One of the most effective ways to link performance and

risk management is the integration of risk factors and risk

management in a companys performance management tool

of choice. Currently, the balanced scorecard (BSC) is by far

the most popular tool for performance management. For each

of the four main perspectives in the classic BSC, a company

denes its goals and the related Key Performance Indicators

(KPIs). These KPIs allow the organization to measure and

monitor its performance. Now is the time to enhance the BSC

with Key Risk Indicators (KRIs) and integrate performance

and risk management. In a business world that is growing

more complex and global by the day, this need for integration

is more pressing than ever.

The corporate scandals in the early years of this decade led

to stricter rules regarding nancial reporting and internal

controls: the Sarbanes-Oxley Act in the US; additional corporate

governance requirements in many other countries; stricter

regulations at most stock exchanges. These new rules, however,

tend to deal primarily with only one aspect of risk management:

ensuring the reliability of reported nancial performance.

Without denying the essential importance of this issue, it is clear

that there are many other risks out there in the business world.

It is perfectly possible for a company to be fully SOX compliant

but suffer from clearly inadequate risk management, with aws

that can prove fatal. In fact, more shareholder value has been

destroyed as a result of strategic mismanagement and poor

execution than in all the nancial reporting scandals combined.1

What companies need beyond strict controls over nancial

reporting is integrated, comprehensive risk management. A new,

risk-enhanced BSC is a solid tool for achieving this objective.

Risk management aligned with performance management two sides of the same coin

Seek opportunities Avoid negative events

Resolve problems

Performancemanagement

focus

Riskmanagement

focus

Create value Dene strategy Protect value

Continuous improvement

1 Are Boards Worrying About The Wrong Risks?, Corporate Board, March/April 2006


5/12


By integrating the risk dimension into this new BSC, we can

do for risk management what the traditional BSC has done

for performance management. Since its introduction, the BSC

has been instrumental in unifying the culture and language

in a company regarding its business goals and performance

management, regardless of function and management layer.

In the new BSC, we can achieve the same unifying result for risk

management and position risk management where it belongs:

intrinsically linked to performance management.

The KPIs on the BSC provide an organization with tools to plan,

measure and monitor its performance. As a result, the BSC helps

a company to translate its vision and strategy into a clear and

balanced set of nancial and non-nancial objectives that can

be measured. These objectives are cascaded throughout the

organization. From a top-down perspective, one KPI at a higher

level is granulated into various, more detailed KPIs at a lower

level. Obviously, from the bottom-up perspective, various KPIsat the lower level are aggregated into one KPI at the higher

level. At the top of the pyramid sits the Dashboard BSC for

top management, with a limited number of main KPIs. Thus, the

traditional BSC has become the key link between different levels

of management and between long-term and short-term goals.

It integrates the general strategic goals and nancial targets

with operational planning and with ongoing nancial forecasts

and performance review.

Risk management beyond SOX

Many listed companies have made a big effort to comply

with regulations on nancial reporting and internal controls

as demanded by the US Sarbanes Oxley Act and other,similar laws, codes or regulations. However, the mere fact

that a company is fully SOX compliant does not mean that

it has an adequate risk management system in place.

Imagine a car race in which the owners (shareholders) of

the car (company) have entrusted their vehicle to a driver of

their choice (management). After a few nasty accidents due

to speeding, the organizers of the race (government) have

obliged all participants to install a SOX Information System

in each car. This system ensures that both drivers and owners

receive frequent, reliable information on the speed of their

car, information that is difcult to tinker with. However, the

SOX Information System doesnt give any information on

other important factors that inuence the performance and

risk level of the car during the race such as tire pressure,

oil level, expected weather conditions or the expertise

of the maintenance team. Each one of these risk factors

frequently has a major negative impact on performance and

occasionally even causes an all-out crash. In other words,

the SOX Information System ensures that drivers and owners

can be pretty sure they have the right information on speed;

it hardly mitigates the many other risks that may reduce

performance or even cause total-loss accidents.

Examples of performance and risk in the new balanced scorecard

Performance: penetrate new markets through licensing agreements

Risk: underreporting of sales by licensees

Performance: engage suppliers at a very early stage to increase speed and efciency of product development

Risk: unintentional disclosure of trade secrets and other proprietary technology or knowledge

Performance: increase sales in emerging markets

Risk: increased exposure to political instability or legal uncertainty

Performance: acquire a competitor and merge it with an existing business unit

Risk: organizational stress and reduced employee loyalty


6/12


In a similar way, the new BSC, enhanced with KRIs, will allow

a company to plan, measure and monitor its risk management

at each level of the organization. Executive management will

be able to frequently gauge the essential risk situation of the

company through the regularly updated Dashboard BSC. With

adequate, dynamic information on both performance and risk, top

management has all the information it needs to decide if and when

a modication of strategy, objectives or procedures is appropriate.

Important decisions should not be taken just from a performance

perspective. The risk dimension should be an integral part of the

decision-making process. Management basing its strategy only on

performance criteria is like a group of sailors setting out with a

good map, compass, GPS and speedometer, but with no weather

forecast, spare parts, tools, rst-aid kit or life jackets. The sailors

may be lucky and get to the right harbor on time. But then again,

they may arrive too late, they may arrive at the wrong harbor

or in the worst scenario they may never be seen again.

Obviously, the choice of performance objectives and related KPIs

will inuence the relative importance of risks and, therefore, the

choice of KRIs. In the BSC area of clients and stakeholders, if acompany has embraced the strategic goal to shift from older to

younger customers, a suitable KPI could be Percentage of clients

under 40 years of age. Two risks the company may face while

pursuing this objective spring to mind. Older customers may feel

abandoned and leave the company much faster than envisaged;

youngsters may be enticed by special offers to become

customers, but may leave soon after, because the company

hasnt learned yet how to cater to their needs and tastes. Two

KRIs to monitor these risks could be the defection rate of older

customers and the churn rate of new, younger customers.

Classic balanced scorecard

Clients and stakeholders Internal business process

Financial

Learning and innovation

Visionand

strategy

To achieve our

vision, howshould we appearto our clients andstakeholders?

To achieve ourvision, how willwe sustain ourability to changeand improve?

To succeednancially,how should weappear to ourstakeholders?

To satisfy our

clients andstakeholders,what businessprocesses mustwe excel at?

Objectives

KPIsMeasures

Targets

Initiatives

Objectives

KPIs

Measures

Targets

Initiatives

Objectives

KPIs

Measures

Targets

Initiatives

Objectives

KPIsMeasures

Targets

Initiatives

Source: Adapted from The Balanced Scorecard by Dr. Robert Kaplan and Dr. David Norton


7/12


As for internal business process,

a company may set the goal of down-

sizing its labor force by 10% through

nancial incentives in order to achieve

a competitive cost level. The related

KPI would be the number of employees.

However, the company may run the risk

that too many high performers who are

of key importance for the organization

may decide to take the money and run.

It could monitor this risk by dening the

group of high performers and measuring

how many of them are leaving. Again, this

KRI is intimately related to the KPI.

In nance, a company may respond to

shareholders criticism of an inefcient

balance sheet with a strategy to increaseits nancial leverage. Shareholders funds

as a percentage of total liabilities could

be a suitable KPI to measure progress.

But obviously, increasing leverage means

increasing various risks, e.g., the risk that

a company breaks its loan covenants with

banks. This covenant risk can and should

be measured with a KRI.

Companies are constantly trying to

improve their operations through learning

and innovation and rightly so; but often

the endeavor to make operations moreefcient enhances existing risks or creates

new ones. For example, if a company

wants to reduce production lead times

(easily measured by a KPI) this strategy

if inappropriately designed or executed

may cause an increase in quality problems.

Therefore, this risk should be monitored

with the correct KRIs in conjunction with

the KPI. KRIs in this area could be the

percentage of faulty products deemed

unsuitable for sale or the percentage

of product devolutions by customers.

Scorecard re-balanced

Clients and stakeholders Internal business process

Financial

Learning and innovation

Visionand

strategy

To achieve ourvision, howshould we appearto our clients andstakeholders?

To achieve ourvision, how willwe sustain ourability to changeand improve?

To succeednancially,how should we

appear to ourstakeholders?

Objectives

KPIs

Measures

Targets

KRIs

Initiatives

Objectives

KPIs

Measures

Targets

KRIs

Initiatives

To satisfy ourclients andstakeholders,what businessprocesses mustwe excel at?

Objectives

KPIs

Measures

Targets

KRIs

Initiatives

Objectives

KPIs

Measures

Targets

KRIs

Initiatives

Source: Adapted from The Balanced Scorecard by Dr. Robert Kaplan and Dr. David Norton


8/12


Linking the KRIs to the KPIs in the BSC is a good remedy to

avoid an unbalanced analysis of a companys progress. At many

companies, performance is monitored and measured constantly

and structurally, and executive management has sufcient

information to judge where the company stands regarding its

performance targets. However, information on risks related to

the various company strategies is of much lower quality and

sometimes merely anecdotic, especially in the areas of markets/

customers and internal organization. A new, risk-enhanced BSC

will eliminate this imbalance.

Whats more, a clear denition of risks and related KRIs in all

four BSC areas will unify risk culture and language within an

organization: everybody knows what the company has dened

as its key risks and, through the KRIs, what its risk tolerance

and risk appetite are regarding each of these risks.

This common language and culture is a necessary condition for a

clear denition of responsibilities and processes: who owns whichrisks? What communication channels should be used to inform

the owner of a risk quickly of new, relevant events? Of course,

much as with KPIs, great care should be taken when dening the

related KRIs for a BSC: is a KRI really measuring what we want

it to measure? And if so, are we measuring it correctly?

This full use of KRIs in all four areas of the BSC has an important

additional advantage: it helps to ensure that risks are detected

and taken into account before they show up in the nancial

gures of a company. All too often, top management only thinks

of risks if and when they show up in one of the many nancial

gures of the company. Most risks, however, do not start out as

a purely nancial risk, but in other areas: Markets, Operations or

Organization. KRIs in those non-nancial areas are often more

relevant for risk management as they precede nancial problems.

In other words, non-nancial indicators are often leading,

whereas nancial indicators are often lagging. This holds true

for KRIs as it does for KPIs.

Now is the time to integrate our risk and performance

management through the introduction of KRIs in the BSC. In the

process, we will develop a common risk culture and language for

the whole organization. The new, risk-enhanced BSC will allow us

to break down barriers within an organization, to clearly deneand prioritize risks and to cascade these priorities throughout

the organization.


9/12

7

Contacts

For enquiries about our Advisory services in the

following countries and regions, please do not hesitate

to contact our global team

Norman Lonergan Global Vice Chair + 44 (0)20 7980 0596

Robert Patton Americas + 1 404 817 5579

Andrew Embury EMEIA + 44 (0)20 7951 1802

Nigel Knight Far East + 86 21 2228 2189

Isao Onda Japan + 81 3 3503 1100

Doug Simpson Oceania + 61 2 9248 4923

Ernst & Youngs

Advisory Services

The relationship between risk and

performance improvement is an

increasingly complex and central

business challenge, with business

performance directly connected

to the recognition and effective

management of risk. Whether yourfocus is on business transformation

or sustaining achievement, having

the right advisors on your side can

make all the difference. Our 20,000

advisory professionals form one of

the broadest global advisory networks

of any professional organization,

delivering seasoned multi-disciplinary

teams that work with our clients to

deliver a powerful and superior client

experience. We use proven, integrated

methodologies to help you achieveyour strategic priorities and make

improvements that are sustainable

for the longer term. We understand

that to achieve your potential as an

organization you require services that

respond to your specic issues, so

we bring our broad sector experience

and deep subject matter knowledge

to bear in a proactive and objective

way. Above all, we are committed to

measuring the gains and identifying

where the strategy is delivering thevalue your business needs. Its how

Ernst & Young makes a difference.


10/12



11/12


12/12

Assurance | Tax | Transactions | Advisory

Ernst & Young

About Ernst & Young

Ernst & Young is a global leader in assurance,

tax, transaction and advisory services.

Worldwide, our 135,000 people are united

by our shared values and an unwavering

commitment to quality. We make a difference

by helping our people, our clients and our wider

communities achieve their potential.

For more information, please visit www.ey.com .

Ernst & Young refers to the global organization

of member firms of Ernst & Young Global Limited,

each of which is a separate legal entity.

Ernst & Young Global Limited, a UK company

limited by guarantee, does not provide services

to clients.

www.ey.com

EYG no. AU0227

2009 EYGM Limited.

All Rights Reserved.

This publication contains information in summary form and is

therefore intended for general guidance only. It is not intended

to be a substitute for detailed research or the exercise of

professional judgment. Neither EYGM Limited nor any other

member of the global Ernst & Young organization can accept

any responsibility for loss occasioned to any person acting

or refraining from action as a result of any material in this

publication. On any specific matter, reference should be made

to the appropriate advisor.

A New Balanced Scorecard

Documents

Transcript of A New Balanced Scorecard