Corporate Strategies for Managing Catastrophic Risks...
Transcript of Corporate Strategies for Managing Catastrophic Risks...
Corporate Strategies
for Managing Catastrophic Risks in the S&P 500:
Linking Intuitive and Deliberative Thinking
Howard Kunreuther, Erwann Michel-Kerjan, and Michael Useem
The Wharton School, University of Pennsylvania
Interim Report – Preliminary – Do Not Quote
November 22, 2013
i
Table of Contents
Foreword: Riding the Wave .............................................................................................................iii
Section 1. Setting the Scene: A More Risky World for Corporations ........................................... 1
Section 2. A Framework for Understanding and Managing Catastrophic Risks by Key
Decision Makers in Firms ................................................................................................................. 5
Section 3. Twelve Preliminary Findings from the Interviews...................................................... 21
Section 4. Preliminary Findings from our Analysis of 10K Risk Sections ................................. 29
Section 5. Preliminary Findings from our Analysis of S&P 500 Stock Prices ........................... 35
Section 6. Overcoming Challenges through the Development of Long-term Strategies ........... 47
Section 7. Open Questions for the Next Phase of the Project ...................................................... 50
Appendix 1. Statistics on the 100 Firms Interviewed ................................................................... 52
Appendix 2A. 10K Risk Factor Mentions across Industry Sectors ............................................. 54
Appendix 2B. Percentage of the 10Ks Discussing Specific Risks (across sectors) ..................... 57
Appendix 3. Methodology for Analyzing Stock Price Changes ................................................... 59
Appendix 4. Leadership and Governance Lessons from Three Case Studies ............................ 61
Study Directors ……….…………………………………………………………………………77
ii
Acknowledgements
The study on Effective Corporate Leadership and Governance Practices in Catastrophe Risk Management
started in 2011 and will continue through 2015. It is being undertaken under the direction of Howard
Kunreuther, Erwann Michel-Kerjan and Mike Useem of the Wharton School of the University of
Pennsylvania.
The research team includes Karen Campbell, Preston Cline, Rebecca Henderson, Matthew Hill (who
served as project manager), Richard Hong, Carol Heller and Ann Miller and Greg Nini. Sourav Bose,
Laura Boudreau, Danbi Hwang, Nicole Kwok, Shaun Lee, Wing Li, Joy McKenzie and Sean Niznik
provided excellent research assistance.
We would like to thank all the experienced managers, executives and directors of the over 100 firms
we interviewed for taking the time to talk to us about their firm’s practices, lessons learned from past
experiences with severe events, and the way they foresee the future of (catastrophe) risk management.
A dedicated advisory board had provided us with strategic guidance on several aspects of the project.
The board is chaired by Jay Fishman, Chairman and CEO of The Travelers Companies; other
members of the Board are, in alphabetical order: Paul C. Curnin (Simpson Thacher & Bartlett LLP),
Luis G. Custodio (IBM Corporation), William J. Egan (Bank of America - Merrill Lynch), Peter
Kellogg (Merck & Co., Inc.), Joe Morton (IBM Corporation), Stephen Propper (Merck & Co., Inc.),
Tom Ridge, (former Governor of Pennsylvania and U.S. Secretary of Homeland Security), Paul
Slovic, (President, Decision Research) and J. Eric Smith (Swiss Re America),
This ongoing initiative benefited from the financial support of the Travelers Foundation through the
Travelers-Wharton Partnership for Risk Management and Leadership Fund, the Wharton Risk
Management and Decision Processes Center and the Wharton Center for Leadership and Change
Management.
iii
Foreword: Riding the Wave
Many of Morgan Stanley’s more than 4,000 employees had already started their work day at the
World Trade Center on twenty floors of the South Tower on Tuesday, September 11, 2001, when
American Airlines flight 11 slammed into the North Tower at 8:46 am. Morgan Stanley’s director of
security, Richard Rescorla, called the Port Authority, the center’s landlord, for guidance, and then
called the company chief executive, Philip J. Purcell.
The World Trade Center’s owner recommended against evacuating the South Tower, but Rescorla
nonetheless urged his CEO to approve immediate evacuation of all employees. Rescorla had lived
through the 1993 truck bombing of the World Trade Center that had killed six people; that experience
led him to institute quarterly evacuation drills ever since. Now, he started an evacuation for real. He
and his staff managed to move virtually all of their on-site employees out of the South Tower before
it was hit at 9:03 am and then collapsed at 9:59 am. Just six staff members were lost -- among them
were Rescorla himself and three deputies who had returned to make sure no one remained in the
building. In reflecting on Rescorla’s preparations and Morgan Stanley’s remarkably swift and nearly
complete evacuation on 9/11, chief operating officer Robert Scott later offered, “If you wait for a
crisis to begin to lead, it’s too late.”1
By contrast, when Lehman failed on September 15, 2008, the leadership of insurance giant AIG
proved woefully ill-prepared to avert its own collapse that resulted from the actions of one small part
of its entire organization. The board, the chief executive, and the managing director for its Financial
Products subsidiary (AIGFP) – which at the time had only 400 employees – had not anticipated that
the company’s credit rating would be downgraded, requiring that it post tens of billions of dollars of
collateral to back the insurance policies that it had written against defaults on debt, including massive
amounts of subprime mortgage debt. But in the wake of Lehman’s failure, rating agencies turned to
see if AIG held large amounts of the same toxic subprime mortgages that had pushed Lehman over
the edge. AIG-Financial Products did, and a major rating agency downgraded the parent to A-. Due
to industry convention of requiring collateral if an insurer is not top-rated, the drop instigated
collateral calls from AIG’s customers. By the end of the month, AIG had lost $32 billion, and by the
end of the year, $61 billion, the largest annual shortfall in corporate history. The U.S. federal
government injected more than $182 billion to save the company from complete collapse and took
control of it.2 Remarkably, the firm is back on track today: it paid all its debt to the government, with
interest: a total $205 billion, for a profit of $23 billion to the U.S. federal government. To do so, it
had to go through a very significant restructuring of its leadership and of its portfolio of activities.
Morgan Stanley’s experience in 1993 created a readiness to save itself in 2001. By contrast, AIG’s
years of success might have ill-prepared it to save itself in 2008. The firm is now reinventing itself;
something that would have certainly been hard to do before the financial crisis.
iv
Examples such as these abound across industry sectors. We often learn as much from setbacks as
successes, often even more, and with unflinching study of our stumbles, we believe, companies can
become better prepared for the hazards ahead.3
This is partly why Cisco Systems’ John Chambers had been one of the longest surviving chief
executives in Silicon Valley. Chambers took the Cisco helm in 1995 and rode the Internet wave in
the late 1990s to make his company one of the world’s most valued entities, with a market
capitalization soaring above $500 billion. But when the Internet bubble burst at the end of that decade,
Cisco flipped from extraordinary growth to stunning contraction. Chambers and Cisco survived the
collapse, and he attributed much of the company’s success in the decade that followed to what he
learned when it felt as if he were touching the void.4
Until one undergoes a rare but wrenching experience, there is little natural impetus for preparing for
catastrophic risk. But we believe that executives and directors of large, publicly-traded companies
need not – and indeed should not – have to wait for such an experience before building their own
company’s capacity to avert or overcome low-probability but high-consequence events. They can
learn from one another and from other’s disasters without having to live it themselves. How they can
do so is the focus of the findings of this Wharton initiative.
In the pages ahead, we speak to those who are responsible for company enterprise, their managers,
executives, and directors. We try to better understand how risk management has evolved over time
and how it is conducted in large publicly traded companies today. Leadership of these enterprises
calls for thinking deliberatively, imaging the unimaginable, and acting strategically; recognizing the
shortcomings of human behavior; and preparing for the long-term even when short-term pressures
prevail. Company leaders can and should move their firm to a state of readiness for extreme events,
and we draw upon their experience to offer guidance on doing so well before a disaster strikes.
1
Section 1. Setting the Scene: A More Risky World for Corporations
1.1. Introduction
In today’s world, as a senior manager, executive or director of a large company, you cannot afford to
ignore the necessity of having an effective catastrophe risk management strategy in place. What
constitutes a catastrophic risk depends on your company and industry sector.
Given the unprecedented series of extreme events and crises that have occurred in recent years, it is
becoming clear to many more top decision makers in firms that we have indeed entered a new era of
catastrophes, with disasters, accidents and crises occurring at a more frequent rate and having greater
ripple effects across continents than in the past.5
Natural disasters such as hurricanes, floods and earthquakes have increased in intensity and
frequency, leading to historic records of economic losses given increased numbers residing in hazard-
prone areas. Also of concern are technological disasters such as large-scale chemical and nuclear
power plant accidents, environmental disasters such as oil spills, and externally caused events such
as terrorist attacks. These events could also be considered catastrophic: legal or reputational issues,
fraud, losing key personnel, stringent regulations that change the firm’s business model, and strategic
errors and competition that has a severe impact on market share.
All of these have caused firms to pay more attention to taking steps in advance of the next catastrophe
rather than treating them below their threshold level of concern. Firms have also learned the hard
way that global financial crises, intercontinental pandemics and cyber-attacks can have systemic
impacts.6 Some firms have been successful in addressing situations that could or have had severe
negative impacts on their bottom line.
In a recent survey of over 1,300 CEOs worldwide, the majority considered that “increasing
accountability in risk management” (62%) and “increasing resources devoted to risk management”
(53%) were two statements that “appropriately described their approach to managing their
organization in a complex and changing competitive environment.”7 This is a sea change compared
to where the corporate world was just a decade ago.
1.2. The Wharton S&P 500 Initiative
The Wharton Risk Management and Decision Processes Center and the Wharton Center for
Leadership and Change Management recently teamed up on a multi-year research initiative supported
by the Travelers Foundation to more fully understand how Standard & Poor’s (S&P hereafter) 500
firms approach catastrophe risk management today.
We define catastrophic risk broadly as events that can have severe physical, financial or
reputational impacts on the conduct of the firm’s activities. These can be internal or external to
the firm and typically require the involvement of top management and their Board of Directors.
2
We have now interviewed over 100 CEOs, Chief Risk Officers, other executives and Board members
concerned with these issues to address the following questions:
What extreme events have those firms experienced?
What insights have they gained from them?
Why is the risk management function playing a more central role in these firms?
What processes were in place in those firms, from risk identification, risk prioritization, and
risk assessment, to risk and crisis management?
What can we learn from leaders in the C-suite and at the Board level as to how they have
interacted with others in the organization on these issues in recent years?
How is the risk management function organized internally?
Has the Board become more active and if so, in what ways?
The distribution of the nearly 100 S&P 500 firms we interviewed during the past 18 months is highly
representative of the entire S&P 500 group (Figure 1). They differ in size, industry sector and their
risk management practices. Their annual revenues range from $1 billion to over $400 billion (median:
$12 billion; average: $29 billion); their human capital base ranges from 2,100 to over two million
employees (median: 20,000; average: 70,000). (See Appendix 1 for more details on the distribution
of firms in our sample compared to the full S&P 500 group of firms.)
Almost all the leading executives and risk managers we interviewed confirmed that risk management
has assumed a much more important role in their firm’s activities as well as having a higher profile
on their Board’s agenda. To a large extent this is due to recent experiences they have had in dealing
with events affecting their balance sheet and/or impacting on their long-term operations due to
changes in the business environment. The companies also provided us with lessons they have learned
from these events and steps they have taken to reduce the future likelihood and resulting
consequences of these events.
3
FIGURE 1.1: DISTRIBUTION OF THE INTERVIEWED FIRMS VERSUS FULL S&P 500
Interviewed Firms
Full S&P 500
Consumer
Discretionary
18%
Consumer
Staples
7%
Energy
7%
Financials
25%
Health Care
11%
Industrials
7%
Information
Technology
15%
Materials
4%
Telecommunication
Services
1%
Utilities
5%
Consumer
Discretionary
16%
Consumer
Staples
8%
Energy
9%
Financials
17%Health Care
10%
Industrials
11%
Information
Technology
15%
Materials
6%
Telecommunication
Services
2%
Utilities
6%
4
Organization of the Interim Report
This interim report is organized as follows. Section 2 develops a framework for understanding how
firms have dealt with risks that, if they were to materialize, could have a serious negative impact on
the firm, the changing role that catastrophic risk is playing in their organizations and how to manage
these risks in a more proactive manner. We propose themes and findings that can be tested both
quantitatively and qualitatively. In Section 3 these findings are illustrated with comments from our
interviewees. The names will remain confidential, but the lessons that can be gleaned from their
experiences will be highlighted so others can learn from them.
The data from these interviews were complemented by analyzing risks officially disclosed in the risk
section of these firms’ 10K annual reports, the results of which are provided in Section 4. We
were able to compare how risk disclosure practices have evolved over time, across industry sectors
and risk types. The majority of the firms have significantly expanded their discussion of risks they
have faced or dealt with than they did just five or six years ago. The top risk for almost all these
firms is Government.
We also conducted a series of analyses of the stock prices of the entire S&P 500 (as of 2011) over
time. Our goal was to examine cases where the stock price of a firm dropped significantly over a short
period of time compared to its competitors in the same industry sector and to understand factors that
may have led to significant drops. We also analyze the resilience of these firms (i.e., how long did it
take for the stock to bounce back to a pre-drop level). Section 5 focuses on the lessons learned from
the stock price analysis.
Section 6 provides guidelines for improving the effectiveness of risk management strategies for
decision-makers. Section 7 raises questions for your consideration as we update and revise this report.
The Appendices provide statistics on the firms interviewed (Appendix 1); complementary analyses
of the 10Ks (Appendix 2); stock price changes at a more granular level than presented in the body of
the report, and the methodology for analyzing the stock price changes (Appendix 3). We also present
three detailed case studies of firms that went through specific crises and highlight the key governance
and leadership lessons learned from each case (Appendix 4).
5
Section 2. A Framework for Understanding and Managing Catastrophic
Risks by Key Decision Makers in Firms
In dealing with issues associated with events that have the potential to have a severe adverse impact
on the firm, key decision makers are concerned with ways to reduce the likelihood of potential losses
in the future and how to deal with these extreme events should they occur. We first specify some of
the key decision makers internal to the firm and then delineate the following two key features that
characterize a framework for determining what actions these individuals or groups should take for
understanding and managing catastrophic risks in firms and in guiding a firm’s strategy:
Their risk analysis and management process
Their intuitive and deliberative thinking process
2.1. Key Internal Decision Makers
There are a number of different stakeholders within the firm itself who play a role in firms’ decision
making with respect to catastrophic events.
Board of Directors The board of directors acts as an independent, third party entity that oversees
the management of risk by a firm’s top executives. The Sarbanes Oxley Act (2002) furthered the
independence of the corporate boards of listed companies by requiring that a majority of board
members must be independent, and that certain committees (e.g., audit and compensation) must be
comprised of entirely independent directors. Board members are often current or former Chief
Executive Officers (CEOs) who bring a wealth of experience and connections with them from other
industries. Today, boards are hearing about risk management practices more often than in the past,
and hence are becoming more informed about risks facing the firm. In our interviews, the majority of
risk management leaders who discussed board involvement said that they reported to the full board
or to a board committee more than twice a year.
As we will discuss in more detail below, risk management is indeed now entering the board room in
an unprecedented way. Boards are often responsible for helping to define the risk appetite for the firm
in consultation with senior management company and are ultimately responsible for the risks that
face the firm. Board members leverage their knowledge to help set broad risk goals for the firm,
provide a governance function by overseeing the risk-related activities of the firms and provide
guidance as to how the firm can strengthen their risk mitigation efforts. Firms also use board
members as thought partners to test their ideas, to make connections with other industry leaders as a
means of benchmarking their operations, and to receive advice and feedback on enterprise risk
management (ERM) initiatives. While boards may help decide which risks companies should focus,
they are rarely involved in the everyday decision making as to how to deal with these risks. The CEO
of a firm in the travel services industry responded to a question on the role of the Board by saying
that its primary role was to ask tough questions such as whether the firm is prepared for future adverse
events, and to oversee how the company will deal with the situations, should they occur.
6
Senior Management Senior managers play a critical role in enterprise management by both setting
the tone and promoting a risk culture throughout the organization. This culture extends both upwards
to the board and downwards through the ranks of the organization. More firms have developed
enterprise-wide risk management functions and processes, even though the nature of it varies widely
from one firm to another. As the ERM director of an oil exploration and production company said:
Top management sets the tone, the war tone at the top, if you will. They are influencers of
doing the right thing. Senior management needed to set an example, by encouraging open
discussions around risk as well as honesty, forthrightness, clarity, and crispness rather than
letting concerns about risk be buried deep in the organization.
Chief Risk Officers (CROs) and their management teams play an important, executive-level role in
managing the risks related to a business and its various units. For instance, the CRO of an information
technology (IT) software products company pointed out that he works with the board, senior
management and the various divisions of the company to identify the company’s most significant
risks and their likelihood and potential impacts to set the tone for how the company deals with extreme
events. We also heard this message from the CRO of a North American bank, who noted that top
management plays a critical role in the success or failure of a financial institution.
CROs carry out this role by putting into place processes and procedures to facilitate risk management
across the firm. Through our interview process it becomes clear that, while many companies do not
have a CRO, the functions and responsibilities of this position are often assumed by the chief financial
officer (CFO) or the General Counsel and their teams.
Front Line Managers and Employees Almost all of those interviewed view frontline managers as
critical players in the risk management process because they are more in tune with specific risks that
an organization might face in a particular division, business unit or country. This is particularly true
for multi-national corporations operating in a large number of countries around the world, where
crises can be local. As previously noted, CROs (or those who assume similar functions) attempt to
harvest the local knowledge about specific risks by putting processes into place that help managers
communicate this information up the chain of command. The most proactive companies cast a wide
net, querying frontline managers through formal processes that take place on a regular basis.
7
2.2. Risk Analysis and Management Process
The risk analysis and management process in most firms that we interviewed typically follows the
steps depicted in Figure 2.1.
FIGURE 2.1: EIGHT STEPS OF THE RISK ANALYSIS AND MANAGEMENT PROCESS
Step 1: Identify the risks. Understand the risks the organization faces (likelihood, magnitude, and
cascading effect). Typically this process can identify a number of risks that need to be considered.
Step 2: Prioritize the risks. Determine several key risks that have been judged critical for the
organization and should be considered more seriously.
Step 3: Undertake risk assessment. Collecting data to quantify the risk can be time-consuming so
one needs to consider the purposes of undertaking such an analysis and what information end users
with require. For example, engineers will require a different type of risk assessment than financiers,
emergency planners or lawyers.
Step 4: Identify risk management options. The risk culture of an organization will set the tone for
managing the risks that firms face. This process involves determining options to consider in advance
of a severe event to reduce potential physical, economic and reputational losses and their likelihood
of occurrence as well as well as actions required following such events to limit further losses.
Step 5: Design a risk management strategy. After risk management options are developed, a strategy
needs to be implemented to reduce potential losses from adverse events and facilitate the recovery
process should a catastrophe occur.
4. Identify Risk
Management Options
5. Design Risk
Management Strategy
7. Implementation
8. Monitor Progress and
Update the Strategy.
1. Identify Risks
2. Prioritize Top Risks
3. Undertake Risk
Assessment
6. Design Crisis
Management Strategy
8
Step 6: Design a crisis management strategy. It is important for firms to clearly define roles and
communication procedures to make decisions and take actions for dealing with a crisis when it occurs.
The strategy often includes plans for dealing with the emergency, preserving business continuity and
informing top management and directors as to what actions are required to deal with the crisis and
over what time period.
Step 7: Implement the strategy. Depending on the priorities of top management and the board,
implementing a risk and crisis management strategy can be achieved over several years. It is
important to obtain tangible results early, to demonstrate that progress is occurring. As for any
project, it is also important to establish deadlines and adhere to a timeline.
Step 8: Monitor progress and update the strategy. This last step involves monitoring progress toward
achieving goals of risk and crisis management in light of changes in the risk environment and the
firm’s strategy.
Below we discuss what we have learned as to how S&P 500 firms approach different aspects of the
risk analysis process. We provide paraphrased comments from some of our interviews to highlight
these points.
Risk Identification and Prioritization
More than three-quarters of the firms we interviewed noted the importance of risk identification and
prioritization. The process is usually formalized; some firms have more ad-hoc procedures, but most
of them are moving to a more systematic process.
FIGURE 2.2: WHO IS INVOLVED IN RISK IDENTIFICATION AND PRIORITIZATION
Enterprise Risk
Management
(ERM)
Heads of Division,
Business UnitsFrontline
Employees
Managers
Consultants
Board
Audit/Risk
Committee
Executives
Executive
Committee Internal
Audit
Others
9
The process often begins with front-line employees, managers and heads of divisions or business
units playing a key role, as depicted in Figure 2.2. The CEO and CRO often play a role as does the
board through specific committees such as internal audit/risk. Consultants are rarely used to identify
risks, as there is a sense by most firms that nobody knows your business like you know your business.
The risk identification process normally involves characterizing risks from the bottom-up through
required reporting systems and meetings or workshops that bring cross-functional teams together to
review and assess potential risks and then recommend how best to manage them. Those involved in
developing Enterprise Risk Management (ERM) strategies play a key role by synthesizing the data,
and presenting a report to the executives, the Board and their committees on the important risks facing
the firm. This process can lead to a large number of risks being considered, in some cases over one
hundred.
Top executives, often in consultation with the Board, make final decisions on the three or four risks
that have top priority because of negative impact they would have on the firm’s operations and
balance sheet should they occur. Figure 2.3 indicates the frequency of mentions of different risk
identification and prioritization processes by firms that we interviewed.
FIGURE 2.3: HOW ARE RISKS IDENTIFIED AND PRIORITIZED
Checkpoints or Self-
Audits
Interviews
Meetings
& Workshops
Reporting
Listing/Matrix
Synthesis of
Findings by ERM
team
Event Specific
Auditing points of
failure
Research
Software
10
Risk Assessment
By risk assessment we mean the process by which firms characterize and rank key risks on which to
focus attention based on selected criteria. Risk assessment is normally distinct from risk
identification, requiring a much more specialized set of skills on the part of its ERM professionals.
For some firms, it is also part of the process by which the senior leadership and the board of directors
define the firm’s willingness to assume certain risks. Figure 2.4 characterizes parts of the organization
that are involved in risk assessment.
FIGURE 2.4: WHO IS INVOLVED IN RISK ASSESSMENT?
The ERM team or risk management personnel generally play a supportive role by presenting the most
important risks to the Board, and helping them determine priorities by specifying metrics that should
be monitored. For example, the General Counsel in a real-estate firm classified its leverage ratio
(i.e., debt/equity) as dry, damp or wet. If it is in the damp range, you need to indicate how you are
going to get it back to dry. You never want your leverage ratio to be so high that it is in the wet zone.
The director of corporate risk management in a healthcare industry firm classified its risks into 21
different categories and indicated that those that should get the most scrutiny by the Board, as those
are the ones that are likely to make the most significant difference in the performance of the
organization. They are often ones requiring more effort and investment to manage so they need to be
discussed at a strategic level by the top management and the Board.
Board
ERM
Executive
Internal Audit
Others
Senior Management
11
The risk assessment process was nearly always highly formalized and conducted regularly and
systematically in firms as shown in Figure 2.5, with 45% of firms meeting annually on risk
management issues, 37% either bi-annually, quarterly or monthly, and 8% on a continuous basis.
Only 4 percent of firms undertake risk assessments less frequently than annually basis. As noted by
the director of risk management of a beverage distributor, “We want to meet quarterly with the audit
committee of the Board to assess the potential impacts of the five critical risks of facing the firm,
mitigation measures currently in place to reduce the likelihood and impact of specific events.”
FIGURE 2.5: FREQUENCY OF RISK ASSESSMENT
Annually
Bi-Annually
ContinuouslyLess than anually
Monthly
Quarterly
12
Firms use a variety of methods for assessing risk ranging from quantitative methodologies such as
scenario analysis, stress tests and ranking/scoring metrics to prioritizing key risks on a qualitative
basis. The CRO of a firm in the financial sector indicated that they stressed their system such that
they would be prepared for any type of extreme or tail risk. Many firms go through this process more
quantitatively, through the examination of metrics in meetings and discussions — an important
distinction we discuss below. Figure 2.6 depicts how often each of the different risk assessment
approaches was mentioned by firms that we interviewed.
FIGURE 2.6: HOW RISK IS ASSESSED
With respect to scenario analysis, the CRO of an insurance firm noted that one has to fully test the
spectrum of scenarios in identifying and quantifying the key risk factors that are at the core of
preventing tail events. The risk manager of a retail store that uses ranking and scoring methods
indicated that the firm defined risk families based on their similarity with respect to implications,
ramifications, outcomes and damage. One bank noted that it utilized stress tests with respect to their
contingent capital plans by examining whether there is a scenario where it would have insufficient
capital. Another firm wanted to stress their system to ensure that it can take care of the tails and
extreme events that could occur.
A mapping approach involves categorizing risk into the frequency and their potential severity. An
industrial firm noted that it has to do a lot of work in identifying some of the tails or extreme risks to
make sure that it has stressed their system to be able to take care of decisions to reduce the risk if
either its frequency and/or severity were classified as high. After it imposed appropriate controls,
most of these risks shift down to low frequency, and especially low severity.
Mapping
Meeting or
Discussion
Ranking, scoring or
metrics
Scenerio Analysis or
Modeling
Stress Test
13
Many interviewees commented on the relative merits and use of quantitative or qualitative methods
for the full risk assessment process. The majority of firms we interviewed relied upon numbers to
conduct risk assessments, others undertook qualitative analyses and some utilized both approaches.
Figure 2.7 indicates the distribution of firms that specifically noted the type of approach they were
utilizing in the process.
FIGURE 2.7: NATURE OF RISK ASSESSMENT PROCESS
The arguments supporting a qualitative approach focused on the inaccuracy of numbers, and noted
that firms relying on them were often blindsided, especially when they tried to quantify probability.
We introduce the distinction between “intuitive” and “deliberative” thinking in the following
subsection to highlight the need for a combination of qualitative and quantitative risk assessments.
For example, the risk manager of a large bank noted that there is an element of judgment regarding
the likelihood of particular events occurring that make them difficult to quantify. The more
quantitatively oriented firms in the interviews we conducted tend to be in the financial and insurance
industry. One bank models its portfolio and balance sheet by constructing many different scenarios
and developing a loss distribution through a Monte Carlo simulation process. It then specifies the
amount of capital needed to withstand a 1 in 10,000 year shock. An insurer looks at the probability
and potential impact that low-probability events may have on the enterprise and revise these estimates
on an annual basis.
Quantitative
Qualitative
14
Risk Management
By risk management we mean the activities that firms select to modify their exposure to internal or
external events that could critically impact the firm’s operations and functions (i.e., steps 4 and 5
depicted in Figure 2.1). The types of strategies undertaken will be guided by the firm’s risk appetite
to reflect the level of risk that an organization is prepared to accept to achieve its objectives such as
profitability and safety goals. The degree of risk taking or risk aversion exhibited by a firm reflects
the tradeoffs between the potential benefits of a specific business decision and the possible negative
impacts to the firm.
Firms we interviewed dedicate a great deal of attention to the risk management process; 90 of our
interviews discussed concrete measures they deploy to mitigate risks they face and to facilitate the
recovery process following a disaster. There were over 500 mentions of risk management strategies.
A larger group of interviewees (82) discussed activities focused on reducing the risk of a catastrophic
event ex ante, while a smaller group (56) described measures to facilitate the recovery process
following a negative event. Many firms discussed both types of measures. They are partly determined
by the risk appetite of the firm and include the following strategies that are discussed below.
Mitigation measures are steps taken by firms to reduce losses from adverse events. For example, a
health care firm designed a plant in Japan to withstand an earthquake of 7.0 magnitude and protect
their employees. Following a fire at one of their warehouses, a distributor created underground
channels, so any materials that were ignited could be extinguished due to lack of oxygen so as to
prevent the fire from spreading to other buildings. A chemical manufacturing firm designed a facility
that was resistant to flooding, and a supplier designed a building that has a communications center
that is capable of withstanding a Category 5 hurricane.
Accountability measures provide organizational or behavioral controls that are put in place by the
firm to limit unauthorized risk taking. Sometimes these measures are implemented after an adverse
event creates a problem for the firm from external sources. For example, an investment management
and services company began auditing its third party suppliers when it discovered after 9/11 that the
backup communication line that it had purchased was rerouted by its supplier to the same location as
its primary line, resulting in a total communications failure. Similarly, an IT company started to audit
the risk management practices of one of its suppliers after a fire severely impacted its operations.
Internally, firms hire third parties to determine how effective they are at mitigating risks once they
have been identified. Some use evaluations and financial incentives to discourage employees from
taking unnecessary risks. In this regard, a real estate firm implemented a system where local
construction managers are held accountable for identifying and taking responsibility for risks
associated with building projects.
Supply chain diversification refers to the process of maintaining alternative sources of raw materials,
supplies and suppliers to maintain business continuity. A health care services company relies on two
suppliers so that if one is not functional, they can turn to the other to pick up the slack. A distributor
that requires a four month lead time to purchase copper now has a large supply on hand in the event
15
of a crisis with its supplier. A computer firm maintains an excess inventory of finished products and
supplies to hedge against sudden fluctuations in the availability of materials and the prices to purchase
them. And a chemical company maintains a global warehouse and works closely with its suppliers to
ensure that there are continuity plans in place in the event of a catastrophe.
Avoiding less profitable risks by discontinuing or reducing the activity that gives rise to the risk, or
by shedding risks that do not reflect a significant driver of profits is especially common among firms
that are too small to take on large risks. For example, one firm in the oil and gas industry decided to
sell their deep water exploration division even before the 2010 Deepwater Horizon accident; they
determined that it comprised a small percentage of their overall business mix and was not worth the
risk. Another firm in the same industry decided to avoid partnering with companies it considers too
small to cover the cost of the indemnities for a drilling disaster in the wake of the 2010 Deepwater
Horizon accident, out of fear that they might be left holding the bag. A chemical manufacturing firm
decided that it was too small to take on the risk of having its products used in medical devices
implanted in the human body, so it chose to avoid that market.
Transferring the risk by buying liability, property and/or business interruption insurance or hedging
its risk by sharing it with another party is an approach utilized by many firms that we interviewed.
To illustrate, a biotech company purchases insurance to cover risks related to product liability and
business interruption, and has started its own captive insurance company to cover some of its own
risks internally. This is a common practice in many industry sectors. A firm in the financial industry
prices credit risk in its derivative transactions so that it can generate funds for purchasing insurance
to protect itself against problems created by the insolvency of a lower quality counterparty.
Retaining the risk by setting aside sufficient reserves to cover the cost of a catastrophic loss is a
strategy that can be used by firms that recognize that it would be too costly to transfer the risk through
insurance, as was the case for a food processing company after it experienced an explosion in one of
its storage facilities and then saw the price of insurance spike, as is often the case after a disaster.
Retaining the risk is often a good strategy when the firm assesses the risk as being low probability
and has started implementing a more rigorous risk management strategy to make sure such events do
not happen. Sometimes risk retention is not by choice. For instance, an IT firm could not transfer its
risks in emerging markets because the company was unable to find an insurer who would offer
coverage for protection against adverse events occurring in these markets.
Early warning systems alert firms to the likely occurrence of a natural disaster, political crisis,
financial downturn, or severe cyber-attack so that steps can be taken to prepare and effectively
respond to the event should they be affected by it. A retail firm with numerous stores in the United
States has a storm-tracking team that does satellite checks for threat of potential hurricanes off the
coast of Africa, giving one to two weeks to prepare before it crosses the Atlantic. Within 72 hours of
a storm likely to hit the U.S., the team issues regular bulletins to senior management, store operations
and distribution-center operations and those on the catastrophic response team to let them know it is
closely monitoring the event.
16
Simulations and tabletop exercises on a regular (often annual) basis provide the firm an opportunity
to discover gaps in existing crisis plans and weaknesses in its continuity plans. One investment bank
undertakes a triage approach to test its plans by which it suddenly makes certain critical staff
unavailable, and then has the remaining employees try to run their continuity plans. While a number
of firms we interviewed indicated they undertook these exercises, the level of involvement from the
top management and line employees varies widely. Some exercises were conducted by small team in
a crisis room for several hours; others involved a large number of employees, including the top
management of the organization for a full day- or two-day-long exercise; significant brainstorming
occurred afterwards to capture lessons learned and integrate them into the firm’s risk management
strategy.
Back-up sites provide continuity should a severe adverse event occur. Measures include establishing
alternative worksites or manufacturing facilities, diversifying sites so that no single event impacts all
of them and facilitating the ability for employees to work remotely. A parts distributor created an
offsite back-up location for their IT systems since their main headquarters was located in an
earthquake-prone area. A bank in the financial services sector diversifies the location of its business
groups so that if two are out of commission, a third can continue to perform functions that are critical
to the firm’s financial infrastructure. Another bank maintains sites throughout the world where the
business can be quickly moved in the event of a crisis elsewhere. A health care company maintains
two mobile satellite ground stations that enable it to set up call centers with voice and data in the
event of a telecommunications outage.
Crisis Management
Most firms we interviewed highlighted the importance of preparing for a crisis in advance and have
clearly defined structure of roles during a crisis for all parts of the company. This allows the firm to
practice emergency procedures in advance to improve their thinking when a crisis occurs.
To know who the key leaders are in a crisis, firms need procedures to define the relevant decision
makers. The leader is normally someone who has specific knowledge of the crisis and hence may not
be the CEO. There was a general consensus among our interviewees that as a crisis grows more
serious, the situation must be brought to the attention of top management. Following the 2011 Japan
earthquake, one firm in the financial industry with significant operations in Japan held a series of
crisis management team meetings where the most senior level of the business actively engaged in
designing a strategy for going forward.
An important finding from our interviews is that top management feels it cannot be too involved in
crisis management, so that it has to define the roles that others in the firm will play should an extreme
event occur. This is especially true for multi-national corporations operating in many countries
around the world where the number of crises the firm has to manage on a yearly basis is large. In
these cases, the local business leader needs to be the senior management line of defense before the
crisis management process is escalated to worldwide headquarters. Several firms we talked to
17
expressed mixed feelings by the CEO about not wanting to be the person managing the crisis given
that he or she might not be the most qualified person to do so. Clearly defining when the CEO will
be informed of the crisis, and what his or her role will be depending on its nature, are two key elements
in developing a crisis management strategy. While some local crises are unlikely to require the CEO’s
involvement, other crises will require him or her to play an active role.
The most common crisis management strategy on the operational side is business continuity planning
(BCP). It refers to a variety of organizational capabilities, pre-approved by senior management, to
continue operations at a pre-defined level during and after a catastrophe occurs. BCP was mentioned
more than twice as often as other strategies such as preventing losses (i.e., insuring, hedging,
retaining, or shedding specific risks), internal and external communication measures or accountability
measures. The interview data suggests that continuity planning consists of three different types of
activities:
Past event specific plans are designed so the firm has the strategic capability to respond to
specific adverse events that the firm has previously experienced. The plans incorporate
lessons that the firm has learned from dealing with the situation in the past. Firms in the
consumer discretionary, utilities and energy sectors (e.g., hotels, retail outlets, energy
companies, etc.) show the greatest reliance on these types of plans as they face continuous
exposure to predictable types of risks either due to geography (for example, retail chains with
business concentration in hurricane prone areas) or the nature of their business (for example,
energy companies maintaining large power grids).
Could happen scenarios plans are used for the types of events the firm has not yet
experienced, but that could potentially happen in the future. These plans are designed for
events where it is difficult to quantify the probability of occurrence so the firm can respond
to them. These unanticipated, high-risk event perils arise in environments characterized by
interdependencies, complexity, and rapid change such as financial crises, political unrest,
supply chain disruptions and terrorism. Our interviews revealed that firms in the financial
sector demonstrate the largest reliance on such scenario planning since they face exposure to
risks that are not easily foreseen on the basis of past experience.
General crisis plans manage a variety of events that could impact any key operation. They
focus on general resilience by creating redundancies so that the firm can continue operating
in spite of the loss of mission critical processes. Key features of these plans include
determining which operations are critical to maintain in the event of a crisis, and developing
predefined strategies for a variety of different crisis situations. Financial, health care and
information technology firms are the ones most likely to develop general crisis plans,
presumably because their industries have faced severe risks in recent years (e.g., the financial
crisis, pandemics, cyber risks).
18
Overall, the firms we interviewed are actively developing their risk analysis and risk management
strategies. The level of detail, sophistication and involvement of the senior management varies across
firms, as one would expect. Still, the strategies we discussed above can often be replicated across
industry sectors and produce significant benefits. Some policies are more technical in nature while
others build on leadership at the top and rely on altering the ways that risk management is perceived
by the organization.
2.3. Approaching Risk Analysis and Management via Intuitive and Deliberative Thinking
Our preliminary analyses reveal that while many firms use quantitative tools to assess and manage
their risks, there is a large range of situations where it is difficult to determine the likelihood of
extreme events that could adversely affect the activities of the firm. While many interviewees
recognized the need for a systematic approach to catastrophe risk management, almost all of them
shared situations with us describing instances when very important risk management decisions were
made without carefully thinking through their long-term impacts on the firm. It soon became clear to
us from comments made during the interviews that the psychology of catastrophic risk management
was a critical dimension we needed to integrate into the analysis.
A large body of cognitive psychology and behavioral decision research conducted during the past 30
years has indeed revealed that individuals, small groups and organizations often make decisions under
risk and uncertainty by undertaking processes that can be characterized as intuitive thinking which
can be distinguished from deliberative thinking. These are two different systems of collecting and
processing information that have been labelled System 1 and System 2, respectively, in the literature.
In his thought provoking recent book Thinking, Fast and Slow, Nobel Laureate Daniel Kahneman has
characterized the differences between these two systems of thinking as summarized in Box 2.18.
NOTE: In developing risk management strategies, it is important to link intuitive and
deliberative thinking.
BOX 2.1. INTUITIVE AND DELIBERATIVE DECISION MAKING
Intuitive Thinking, System 1:
- Operates automatically and quickly, with little or no effort and no voluntary control.
- Uses simple and concrete associations, including emotional reactions or simple rules of conduct
that have been acquired by personal experience with events and their consequences.
Deliberative Thinking, System 2:
- Initiates and executes effortful and intentional abstract cognitive operations when needed.
- Cognitive operations include complex computations and formal logic.
19
Decisions made intuitively are often characterized by emotional reactions and opinions based on
personal experience. There is a tendency to misjudge probability, focus on short time horizons, utilize
simplified rules in choosing between alternatives, and selectively attend to subsets of goals and
objectives. Intuitive thinking works well when decision makers have extensive data on the outcomes
of different decisions and when recent experience is a meaningful guide for the future. These
processes are problematic for low-probability, high-consequence events where the decision maker
has limited experience and/or circumstances have significantly changed. Reliance on intuitive
processes will often lead to maintaining the status quo—that is, a decision to do nothing differently.
The negative consequences of changing current behavior are weighted much more heavily than the
potential gains, often leading the decision maker not to take action, referred to as the status quo bias.9
Deliberative thinking often involves the use of formal methods and decision aids to evaluate
alternative options and make choices in a systematic manner even when probabilities are difficult to
characterize and/or outcomes are uncertain. These methodologies often focus attention to potential
short- and long-term consequences and evaluate a wide range of options in an even manner rather
than deciding to maintain the status quo. The relevance of these methodologies and decision aids for
making more informed choices depends on how the problem is formulated and framed, the nature of
the institutional arrangements and the interactions between the relevant interested parties involved in
the risk management process.
Catastrophic risk management offers many examples where decision makers focus their attention on
the consequences of a recent disaster without considering the likelihood of a similar event occurring
again. A large retailer reacted to the H5N1 (avian flu) outbreak by preparing for another outbreak of
an H5 type virus. But when the next influenza outbreak hit a couple of years later, it took the form of
the H1 strain, so the H5 plan wasn’t applicable. As a top executive from this firm says:
A lesson coming out of that was that, number one, you can spend a lot of time building out
intricate plans for different scenarios, but the odds are what you’re actually going to face is
not going to be exact. So your planning, to some sense, while it can be specific, also has to
have more of generic elements to it that you can then modify and tailor to the specific event.
More broadly, the General Counsel of a large real estate investment firm highlighted the challenges
he faces in dealing with low-probability, high-consequences events:
The thing that worries me the most is a large-style, BP-style casualty. I mean, we build high-
rises over subway stations, and what if a building were to crash down and the people die and
the subway station is shut for a year and it’s just a mess? You’ve never had a casualty so you
don’t do anything about the situation. You think you’re so brilliant, and some terrible
casualty happens and when you peel back the onion you find you weren’t as smart as you
thought you were. That’s the thing that I worry about.
Firms also face problems of interdependencies since the risks they manage depend not only on their
own choices but also on those of others. One weak link in the supply chain network can undermine
the risk mitigation actions of all others in the system. Making global supply chains less vulnerable
20
may require coordination across the network. To deal with these interdependencies, some firms have
designed options to more effectively cope with disasters both before and after they occur in the spirit
of deliberative thinking. For example, as noted earlier, some firms maintain a diversified supply chain
and an extra stock of critical supplies in the event of a crisis. Another example is a pharmaceutical
company that makes contractual agreements with their customers to maintain continuity because they
feel they have a moral obligation to provide products to critically ill customers.
Deliberative thinking focuses attention on both short- and long-term events and their likelihood of
occurrence. It normally leads to a more even-handed evaluation of options under consideration rather
than relying on recent past experience or assuming that the disaster will not happen to them. As a
senior executive in a large energy company put it:
So, the chances of that actually happening again are fairly low, but the consequences are very
high. Even though this may be classified as a black swan event, we are willing to assess the
risk and try to mitigate the risk as far as it makes sense to take these steps. The one thing that
we’ve learned over the years is those high-consequence, low-likelihood events will happen,
and therefore people absolutely have to plan for them. They have to practice on how they’re
going to deal with those kinds of events
Today, many of the firms we interviewed are engaging in more deliberative thinking when
developing risk management strategies so that they reduce the potential damage from these low-
probability, high-consequence events and are better prepared for dealing with crises should they
occur. The CRO of a financial institution highlighted the role that deliberative thinking plays in its
current risk management process with the following comment:
We have discovered that the models that are retrospective in nature don’t always accurately
predict the future. What we were missing was a component that asks what if something
changes from the past. By adding stress testing and scenario analysis to our models, we ask
questions such as what bad things could happen this calamity occurs or if this economic
scenario happens to take place.
There are many risks for which determining the exact probability of occurrence could be extremely
difficult. Rather than doing nothing about these risks, firms should focus on “what if” scenarios first,
then try to evaluate the relative likelihood of these events and be able to continuously monitor those
risks so when the business environment changes one can trigger the alarm. As the chief risk officer
of a large insurance company says:
Sometimes I find probabilities very difficult to quantify. Severities are much easier to quantify
in my mind. I can tell you how much equity linked exposure I have and I can tell you what
happens if the equity market fell to 0, if it fell by 90, 80, 70, 60, 50, 40, 30, 20, 10. It’s very
hard to predict obviously what the probability of the S&P reaching those levels is precisely,
or validating it. And so for a CRO, thinking of all the key risks, worrying about severity first,
worrying about perfectly assessing the severity first and then perfectly assessing the
probability is how I would approach the order of operations because, as I said, it’s very easy
psychologically to be convinced that various things are okay, things are fine, the probability
of that event is remote. And so getting that balance right is the key part of my job.
We now turn to the preliminary findings from our interviews.
21
Section 3. Twelve Preliminary Findings from the Interviews
This section highlights findings that have emerged from the 100 interviews from the S&P 500 firms
that relate to the framework for understanding and managing catastrophic risks in firms. The findings
also reveal the nature of intuitive thinking by some firms prior to a disaster and how more deliberative
thinking following a catastrophic event has improved their performance in the wake of these events.
These findings will be examined more carefully in a later phase of the study, the using quantitative
and qualitative data from 10Ks, stock prices and other sources of information to supplement the
interview data we have collected.
3.1. Findings Related to Risk Identification
Under- and Over-Reacting to Catastrophes
Individuals have a tendency to focus on the recent past in making decisions with respect to extreme
events. People’s intuitive assessment of the likelihood of an uncertain event is often based on the ease
with which instances of its occurrence can be brought to mind, a mechanism called availability.10
Availability is influenced by recent personal experience and can lead to an underestimation of the
likelihood of a disaster before it occurs. After a catastrophic event, availability causes an
overestimation of likelihood of similar events, often triggered by emotions such as fear and anxiety.
In line with the availability bias, prior to experiencing a disaster there is a tendency for firms to focus
on the low probability of its occurrence and treat the possibility of a catastrophic loss as below their
threshold level of concern that put it in the category of “It will not happen to us.” Following a
catastrophe, there is a tendency to focus on the consequences of the event and take steps to reduce
the likelihood and outcomes from future disasters of this type. This behavior that reflects intuitive
thinking can be illustrated by the following findings:
Finding 1: Prior to a catastrophic event, firms often focus on the low-probability of its
occurrence. This estimate tends to be below the threshold of concern for many executives and
directors.
Finding 2: Following a catastrophic event, firms focus on worst-case scenarios of a repeat of
the event, but ignore the low likelihood of their occurrence in the future.
Comments from many of the interviews we conducted with S&P 500 firms provide support for these
two findings. A CRO from a financial firm highlighted the process he felt most firms in his industry
exhibited when he noted that prior to the financial crisis very few financial institutions had a defined
risk appetite, which is like sailing in the Atlantic Ocean without a rudder. “Unless you have a rudder
to direct you, you never know where you’re going to wind up until it’s too late. The CRO from an
insurance firm noted that a lot of people are anchored to scenarios and events that have occurred
and not the ones that they haven’t personally experienced. He felt it was important to take the position
that you can never know what will happen and need to think that way in developing risk management
strategies.
22
An enterprise risk manager from an energy firm explicitly noted the role that threshold models play
a role in the firm’s decision-making process. More specifically, senior management defines certain
thresholds above which risks are elevated for review. So for example, a $100 million loss event is
one that typically is elevated to regional leadership. Anything that could, we believe, plausibly result
in a fatality has to be explicitly elevated to the overall leadership team.
The senior vice president from an IT firm noted that it took a disaster for them to pay attention to the
design of their plants. The firm could not imagine more than one or two production lines going down
in an earthquake so didn’t plan for what actually happened—all seven production lines in the plant
not functioning. After the Japanese earthquake/tsunami, the firm invested $400 million in specialized
equipment in their manufacturing plants in Japan, and did structural design work so that the plants
could withstand higher shocks.
It took the 9/11 disaster for the CRO of an investment bank to highlight the importance of undertaking
deliberative thinking by taking “black swan” events far more seriously than before. The head of
operational risks indicated that before the terrorist attacks there was a sense that things happen in
places like Nigeria, but they don't happen in places like New York City. In the same spirit, another
investment bank indicated that one should not chop off the tails of the probability distribution because
of a perception that gold markets spiking, or liquidity dissipating will not occur in your lifetime. You
are doomed if you think this way because you know that these events could happen to you.
Avoiding the Next Disaster
An organization can often benefit from its past history by considering near misses (for example,
planes that almost crashed) as object lessons and learning experiences. In an article with the thought-
provoking title, Learning from Samples of One or Fewer, March, Sproull, and Tamuz provide
examples as to how historical events that are sufficiently similar to the hazard in question provide
insight as to how the firm can reduce their risks in the future.11
Some organizations might ignore the data and interpret past successes as evidence of its competence
rather than carefully examining whether it was just fortunate that some adverse event did not happen.
The case of the Challenger accident illustrates this point. Considerable evidence from previous flights
indicated that the O-rings presented potential problems. NASA and Thiokol personnel ignored the
evidence because no failure had occurred.12 This behavior suggests the following finding:
Finding 3. Firms that learn from near misses and catastrophic losses by doing post-mortems
are likely to be proactive in managing catastrophe risks.
The following comments from our interviews show that firms that have learned from previous
disasters and near misses are likely to be better prepared for the next one. A risk control manager
from an energy company indicated that the mistakes they made during Hurricane Rita in 2005 helped
them to prepare for Hurricane Ike in 2008. The firm inadvertently sent all of the repair crews to one
area during Rita, resulting in a bottleneck, which made it look to the media like they were doing
nothing. Following the Japan earthquake of 2011, the CEO of a retailer that experienced severe
23
damage to its facilities buildings had every building inspected structurally to make sure each one was
earthquake proof.
Hurricane Katrina was a wake-up call for several firms we interviewed. One firm that lost a number
of its stores in the disaster due to a lack of preparation took several steps to get their stores up and
running more quickly than the competition after a hurricane by working out a special arrangement
with their insurance carrier that allows them to adjust their own claims, rather than waiting for an
adjustor to come out to evaluate the damage. A chemical company that did a post-mortem after
Katrina can now obtain supplies and equipment much more quickly by working with local authorities
to get trucks through police barricades in the event of a natural-disaster.
A manufacturer that has plants throughout the world indicated that they learned from the Telecom
Crash of 2002 not to combine financial risk with operating risk. After the 2008 financial crisis, the
CRO of an investment bank created a formal process to define the firm’s risk appetite, and made
changes in risk governance. The vice president for corporate strategy of an auto parts supplier
indicated that watching what happened at Enron and WorldCom, they decided to look at enterprise
risk management in a different way.
Sometimes, however, actions taken in response to one disaster may not enable the firm to deal with
a catastrophe that takes a different form. The visceral memories of their building in downtown
Bangkok being burnt to the ground in the context of political unrest in Thailand, led a firm in the
service industry to build a contingency office near the airport, and provide their workers with laptops
so that they could work remotely. But when the 2011 Thailand floods occurred they couldn’t use their
office and their workers’ homes were underwater, so they had to house them in hotels with free
bandwidth.
3.2. Findings Related to Risk Assessment
Analyzing Catastrophic Risk in a Systematic Manner
The availability bias also suggests that paying attention to the outcomes of events will focus people’s
attention on what steps to take to reduce the likelihood of the reoccurrence of the event in the future.
One can first examine the impacts of a catastrophe and then focus on the likelihood of these events
occurring. This implies the following two findings:
Finding 4: Creating worst-case scenarios helps senior management and employees focus on
ways to manage catastrophic risks before they occur.
Finding 5: While some firms use quantitative tools for estimating the likelihood of specific
scenarios, some firms simply focus on the severity of the scenario and what to do about it,
disregarding the probability of it happening.
24
Supporting these two findings, we learned that some firms have teams from each of their divisions
undertaking risk assessments while others do a strategic risk assessment of their top risks.
One publishing firm exposes senior management to different worst-case scenarios each quarter so it
can determine what changes are required. The vice president of safety and environment in an energy
firm highlighted the importance of undertaking more systematic risk assessments by noting that they
have learned over the years that high-consequence, low-likelihood events will happen, and therefore
the firm has to plan for them.
Prioritizing Risks
Given the number of potentially severe adverse events that can impact a firm, it is important for the
firm to prioritize their risks so that they can devote attention to those that really matter. Decision
makers that undertake this type of activity in a systematic manner are likely to be prepared for the
relevant risks that their organization faces in the future. This behavior implies the following finding:
Finding 6: If the firm’s management can prioritize the risks that they face and develop plans
that are modular so they can triage their activities, they will be better prepared for the next
catastrophe than decision makers who do not follow this procedure.
Several firms indicated the importance of prioritizing their risks to see where they are vulnerable.
The CEO of a retailer indicated his firm picked 15 or 20 items that are really important and made
sure that everybody is involved and understands their role in controlling the risk. An investment bank
makes plans modular for dealing with a disaster. Should the crisis occur, the management team can
either rearrange the modules or pick and choose within the modules.
3.3. Findings Related to Risk Management
Learning from Others
The literature on organizational behavior points out the importance of gaining insight from other
firms with respect to developing strategies for improving performance. By developing formal and
informal channels of communication with competitors facing similar challenges, there is an
opportunity to learn about other approaches for taking steps to reduce the likelihood and
consequences of the next disaster and develop recovery plans should the event occur.
In the uncertain or ambiguous climate that characterizes the management of catastrophic risks, firms
frequently look to their competitors to provide guidance for their own behavior and to help determine
their core competencies. There is also a tendency to imitate what others have done well by
transporting these concepts to their own organizations and avoiding actions that could be costly.
Where there is substantial commonality in experience, such influence has been labeled mimetic
behavior.13 Such learning is a major mechanism for diffusion of information across firms.14
25
As an illustration of this behavior, executives in a chemical firm stated that one reason for selling one
of their businesses was that current industry practice is to produce the raw materials and the finished
goods at the same location. This approach obviates having to ship potentially dangerous materials,
even if the chance of a transportation accident is estimated to be extremely low. The firm sold the
business to a competitor that followed this practice.15 This behavior implies the following finding:
Finding 7: Firms that systematically learn from the catastrophic losses of others are likely to
improve their own operations.
Here are some actions that firms have taken in this regard that suggest they will improve their risk
management strategy: One firm in the energy industry looked to investment banks following the
financial crisis of 2008 to understand how they view risk and determine whether their firm has some
blind spots. The BP oil spill caused many firms to think a lot more about operational risk. Following
the Japan earthquake, a publishing firm began thinking about what could happen to the nearby nuclear
power plant if an earthquake occurred. The firm recognized that the probability of having an
earthquake at this location was less than 1 in 10,000, but felt it was something that could happen. As
one senior executive noted, after any catastrophe the firm needs to take a look and ask, Am I okay
with the status quo? Do I know what’s happening? How can I determine what I should do differently?
Comprehensive Management of Catastrophic Risk
Firms are now striving to manage catastrophic risk in a more comprehensive fashion by focusing on
enterprise risk management rather than decentralizing their analysis by divisions or departments. In
firms that effectively manage catastrophic risk using ERM, a chief risk officer normally reports to
the board on a range of activities for dealing with extreme events. The organization has transparent
metrics in place to measure investment in catastrophic risk management and output. It interacts with
a range of outside agencies and organizations on issues of catastrophic risk. This behavior implies
the following finding:
Finding 8: Firms that have had active dialogue among their board of directors, company
leaders, and government officials about managing exceptionally adverse risks are likely to be
more aware of the diverse risks that can impact them. They prepare for these adverse events
more systematically than companies without such dialogues and interactions.
Those proactive firms recognize that there are risks they will not be able to handle by themselves
should they occur. Establishing an open dialogue across the organization and with other firms is a
key step to creating trust, an essential element during a crisis. The following comments from our
interviews provide qualitative support for this finding. A firm in the financial industry utilizes their
committees to make people in their company more aware of how they are currently and should be
making decisions. Another firm in the same industry indicated that it needed to have a very strong
line of communication both within the company as well as with their customers. The head of
corporate and information security in an energy company emphasized the importance of interacting
with the public sector, indicating that one cannot develop a plan if one doesn’t know where the threat
26
vectors are. This means having good liaisons with the federal, state and local government and law
enforcement. The CRO of an information technology company noted that his firm has developed a
methodology for identifying top risks by establishing a risk infrastructure and governance structure
within the company in collaboration with the board of directors and other members of executive
management so that there is a well-defined risk universe shared with everyone in the organization.
Dealing with Interdependencies
Firms face challenges in dealing with a catastrophic events if others in their network have not taken
steps to reduce the risks they face. Following the Fukushima, Japan earthquake of 2011 there were
supply chain interruptions that caused shutdowns of plants in other parts of the world. To illustrate
this point, car manufacturers in Detroit utilized automotive microcontroller chips from Renesas, a
company north of Tokyo that was heavily damaged by the earthquake. With no alternative suppliers
of these chips, car production temporarily shut down.16 This behavior implies the following finding:
Finding 9: Firms are now recognizing that they must better appreciate risk interdependencies
as part of their overall risk management strategy. These interdependencies can emerge across
the world, across industry sectors, across divisions within the firm and may only become
apparent over time.
An executive from an investment bank that operates internationally commented that contagion across
borders and across businesses is much higher and faster than it used to be. Several firms noted that
the loss of a facility in the global supply chain would be catastrophic for them.
3.4. Findings Related to Crisis Management
Firms must make sure that when they are thinking and acting fast, they are doing so with deliberative
and systematic activity in advance of the crisis. They must develop well-articulated plans, designate
the structure for managing the crisis and specify information-gathering techniques to avoid falling
into intuitive traps. Firms emphasized that during a crisis, it is important to ensure that fast thinking
is high quality thinking. In order to make good decisions, in the moment, many firms we interviewed
indicated that they needed to have a concrete plan that included clearly defined roles and
communication procedures, such as emergency plans and business continuity. This behavior implies
the following finding:
Finding 10: Firms that have invested time, human resources and money into preparing for
catastrophic situations are likely to bounce back quickly and enhance their reputations.
Firms, particularly those in banking and in the retail/service industries emphasized the importance of
identifying the most crucial roles during the crisis and focusing on individuals within the company
having these responsibilities. One bank ranked critical areas by tiers, recognizing the importance of
making sure their core operations units were functional as soon as possible. Another consumer
services firm felt their customer agents had to be up and running within an hour.
27
3.5. Findings Related to the Role of the Board
The board of directors can provide input to the firm from a neutral but concerned perspective with
respect to dealing with catastrophic risks. The increase in extreme events in recent years has put
catastrophic risk management high on their agendas. This behavior implies the following finding:
Finding 11: Many more boards of directors are becoming proactive at overseeing risk management
activities. This trend is fairly recent and the level of involvement still varies widely.
An overwhelming majority of those we interviewed reported increase in involvement over the past
ten years by the board of directors; firm’s risk management activities are depicted in Figure 3.1. Some
firms cited specific events such as the financial crisis, 9/11, Hurricane Katrina as instigating board
changes. Risk managers noted that board members may serve on multiple boards, and thus have
often experienced a crisis first-hand in some capacity. However, they also cautioned that board
members who do not have risk management expertise may engage in primarily intuitive thinking,
such as focusing unduly on recent events, rather than thinking deliberately about possible long-term
challenges that firms face. They pointed out that it is the job of the risk managers to guide the board
towards more deliberative thinking.
FIGURE 3.1: HOW MANY YEARS AGO DID THE BOARD BECOME MORE INVOLVED IN RISK
MANAGEMENT IN YOUR FIRM?
0 to 3 years
(30%)
4 to 7 years
(35%)
8+ years
(35%)
28
There seems to be a continuum of levels of board involvement, rather than discrete categories.
Different boards participate in the process to different levels, based not only on the company but also
on characteristics of the industry and background of board members. Over time board involvement
in catastrophe and crisis management seems to have increased from simply relying on the audit
committee to set broad risk management goals to overseeing and being involved in in the decision
making process of the firm with respect to taking steps in advance to reduce the risks of future adverse
events.
An insurance firm indicated that there is a part of the Board that focuses on risk management where
in the past it was part of an audit committee. It took the BP oil spill in 2010 for another firm in the
oil industry to spend time with their Board running through all of their risk-management practices for
both upstream, downstream and company reputational risk to make sure that they were comfortable
with what they were doing.
Finding 12. More senior executives in top management want the Board to work with them in
defining the risk appetite of the firm by sharing information and responsibility for their actions
in this regard.
As the risk landscape is widening and more companies expand their activities outside of the U.S. the
top management often expects directors to support a specific risk appetite and to be aware of the
catastrophe risks that could seriously impact the firm. This is a way for senior management to more
systematically include directors in risk taking decisions and also to share responsibility when a crisis
occurs.
We now turn to our analysis of the 10K risk section of the annual reports of the firms that we have
interviewed. These reports reflect key risks these firms consider today and show how they have
evolved over time.
29
Section 4. Preliminary Findings from our Analysis of 10K Risk Sections
4.1. Methodology and Data
Another source of data we used as part of our analysis is the risk factor disclosure section of firm’s
Form 10K annual reports. Firms are required to disclose risks that could negatively impact their
activities. One can observe how the ranking of the top risks evolved over time in firms’ 10Ks and
across the ten S&P 500 industry sectors specified in Table 4.1.
TABLE 4.1: TEN S&P 500 INDUSTRY SECTORS (ALPHABETICAL ORDER)
We selected 21 risk categories building on previous work in the field,17 to facilitate comparisons of
risk factor disclosures across industry sectors. Our research team coded the sample set of 10Ks of the
firms we interviewed by utilizing these risk categories. (In this context, “coding” means reading and
manually tagging the text relevant to a specific risk factor based on a set of definitions and keywords
for each of the risk factors listed in Table 4.2.)
Given that the sample of interviewed firms is representative of the entire S&P 500 we feel that the
results discussed below apply more generally. To capture variation in the risk factors over time and
between industry sectors, we coded the 10Ks these firms submitted in 2007 and in 2011 using the
qualitative data analysis software program NVIVO, a relational database developed by QSR
International. After completing the coding, we calculated the industry-wide variation in coverage of
each risk factor. Risk coverage was identified for both (a) the number of risk factor mentions; and (b)
percentage distribution of text dedicated to the discussion of a particular risk factor in a given 10K
risk factor section.
Industry
Consumer Discretionary
Consumer Staples
Energy
Financials
Healthcare
Industrials
Information Technology
Materials
Telecommunications
Utilities
30
TABLE 4.2. DEFINITION OF KEY RISK FACTORS; ILLUSTRATIVE EXAMPLES AND KEYWORDS
Risk Factor Definition Example Keywords
Accounting Change in accounting regulations that can
affect the financial standing of the company.
We must comply with generally accepted accounting principles
established by the Financial Accounting Standards Board
Accounting, accounting practices, books,
auditor, audit, accounting irregularities,
financial statements, disclose
Acquisition Risk associated with all phases of acquisition
(pre, during, post) that may result in business
value loss (e.g., unmet synergy, operational
disruption, changes in management).
The integration of firm A and other acquired businesses may
present significant challenges to us.
Acquisitions, acquire, divest, sell unit,
sale, merger, merger agreement, joint
venture, synergies, spin off, split,
buyout, alliance, offer, bid, restructuring,
hostile takeover
Capital
Expenditure
Investment in a company’s business
requiring substantial funds for items such as
facilities, equipment, fixed assets, R&D or
new product development
We are developing new products that complement our traditional
memory products or leverage their underlying design or process
technology.
Debt, cash position, credit rating,
covenants, highly levered, refinancing,
interest rates, commercial paper, lines of
credit, credit line, junk status, equity, financing, equity offering, dilute shares,
share dilution, lenders, buyback, raise
capital, bonds, loan
Capital
Structure
The debt to equity ratio on a firm's balance
sheet. The debt/equity ratio affects the firm's
stock price
“We are subject to the risks associated with debt financing,
including the risk that our cash flow will be insufficient to meet
required payments of principal and interest.”
Plant expenditures, plant expansion,
capital investment, plant closing costs,
capital-spending expenses.
Catastrophes Environmental conditions/terrorist activities/acts of wars/pandemics. Cyber risk
is also coded in this category.
“Extreme weather conditions in the areas in which the Company's stores are located could adversely affect the Company's business.”
oil spill, terrorism, September 11, hurricane, weather, war, disaster,
catastrophe, storms, tornado, tsunami,
tropical storm
Competition Potential disadvantage in the market as a
direct result of the competitors’ activity or a
business’s strategic mishap.
Increased competition could result in fewer submissions, lower
premium rates and less favorable policy terms and conditions,
which could reduce our margins.
Competition, competitor, competing
product, decreased market share,
increased market share, strategic
advantage
Credit Risk Risk's related to not receiving payment for
delivered goods or services; the risk of
companies defaulting on payments
“EME's operations are exposed to the risk that counterparties will
not perform their obligations.”
Credit risk (this one is extremely similar
to "capital structure" and all of the terms
are nearly identical)
Customer
Concentration
Growth in specific customer segments (by
geography, industry, large-players) that
creates an over-reliance on a small group of
clients, posing business risks.
Since we depend on a few brokers for a large portion of our
revenues, loss of business provided by any one of them could
adversely affect us.
Reliance on a small number of firms
Distribution Changes or unforeseen events during the
passing of goods from a business to its
external B2B or B2C customers.
In the event that commercial transportation is curtailed or
substantially delayed, our business may be adversely impacted, as
we may have difficulty shipping merchandise to our distribution
centers and stores.
Distribution, distribution channels
Government Governmental acts and regulations that
affect the way a company conducts its
business.
We are subject to extensive government regulation and
supervision, including regulation and supervision in non-U.S.
jurisdictions, which may limit our ability to pay dividends or
make other capital distributions and violations of which could
have a material adverse effect on our business, financial condition and results of operations.
Government, Congress, Supreme Court,
regulation, SEC, Securities and
Exchange Commission, President,
Obamacare, healthcare plan, government
contract, economic stimulus, bailout, troubled asset relief program, TARP,
US Treasury, Regulation, oversight.
31
Industry Industry risks not only affect the company,
but also other players in the industry.
“The payments industry is highly competitive and includes, in
addition to credit card networks, evolving alternative payment
mechanisms and systems.”
Industry risks
Intellectual
Property
Risk associated with security of or changes
to the sustained advantage from the
business’s intellectual property. Any threats
to IP.
With respect to patents and patent applications we have licensed-
in, there can be no assurance that additional patents will be issued
to any of the third parties from whom we have licensed patent
rights
Patents
International Currency fluctuations in a company’s
international business operations. Any risks
associated with operations abroad
(government/legal).
“The enactment of provincial legislation or regulations in Canada
to lower pharmaceutical product pricing and service fees may
adversely affect our pharmaceutical distribution business in
Canada, including the profitability of that business.”
Foreign currencies, foreign currency
changes, exchange rate, currency
translations, strong US dollar,
international economies
Investments Pension/retirement benefits and any capital
put into other firms.
“Our pension plans are underfunded, and may require significant
future contributions, which could have an adverse impact on our
business.”
Pension liability, pension liabilities,
investment
Key
Personnel
The loss of potential key executives in the
company that may result in adverse effects.
Reliance of a company’s success on key
executives.
There is substantial competition for qualified personnel in the real
estate industry, and the loss of several of our key personnel could
adversely affect the Company.”
resigned, fired, CEO, COO, CFO, board
member; deaths; injured
Labor Recruiting and retaining employees, errors
that employees may incur.
“Our businesses require the retention and recruitment of a skilled
workforce and the loss of employees could result in the failure to
implement our business plans.”
Legal The possibility that legal action will be taken
because of a corporation's actions, inactions,
products, services or other events.
Potential/ongoing lawsuits that will affect
the company adversely.
“We are involved in numerous legal proceedings arising out of the
conduct of our business, including litigation with customers,
employment-related lawsuits, class actions, purported class
actions, and actions brought by governmental authorities.”
Lawsuit, legal proceedings, court, sued,
suing, damages, litigation, ruling, judge,
penalties, hearing, appeal, evidence,
legal costs, liability, allegations,
defendant, plaintiff, lawyers, trial, federal panel, jurisdiction
Macro Activities happening in the aggregate
economy that affect the operations of the company; demand for its products/services.
Demand contraction; low economic
growth
Marketing Any risks related to the firm’s brand,
reputation, image, product pricing, and
market share.
“The success of our branded products relies in large part on the
favorable image they enjoy with consumers.”
Marketing, reputation, market share,
market expansion, customer focus,
segmenting, brand, image, product mix,
pricing
Operations Risk associated with mismanaged or
unforeseen activities in the internal operation
of a business, e.g., production,
manufacturing, etc.
The size and complexity of our computer systems make them
potentially vulnerable to breakdown, malicious intrusion and
random attack.
Quality control, product quality, product
launch (this one is too broad/requires a
lot of human intuition to determine
whether an event falls under it)
Suppliers Variations in the supply delivery processes
that pose business risks; and changes in the
bargaining power of suppliers driven by
supply availability.
In order to sustain and grow its business, the Company must
successfully replace the crude oil and natural gas it produces with
additional reserves.
Suppliers, supplies, input costs, raw
material costs, high oil prices, high fuel
costs, fuel expenses, smaller margin
Sources: Authors
32
4.2. Number of Risk Factor Mentions in the 2007 and 2011 10Ks of the Interviewed Firms
Figure 4.1 compares the number of risk factor mentions between 2007 and 2011 across the 21 risk
factors we studied for the 100 firms we interviewed. “Risk factor mentions” refers to the number of
times one of the risk factors described above is discussed in the firms’ annual reports.
FIGURE 4.1: NUMBER OF 10K RISK MENTIONS ACROSS INDUSTRY SECTORS
Several interesting results emerge from the analysis:
Finding 13: There is an increase in the number of risk factor mentions in the 10K sections
between 2007 and 2011.
This confirms the finding from our interviews that firms are more concerned about a large number of
risks today and provide much more detail in the way a specific risk category can affect its operation
and its shareholders. The top risks in 2007 remain the same in 2011: government-related risks (e.g.,
a new regulation that may adversely affect future firm revenue), legal risks, marketing and
international markets.
We found that four out of five firms have increased the number of risk mentions in their 2011 annual
reports compared to 2007. This trend is not specific to any industry sector. At one extreme, a firm
which is not a financial institution, increased the number of risk factor mentions tenfold between
2007 (4 mentions) and 2011 (40 mentions). The highest number of risk factor mentions across all
firms that we interviewed was 92.
0
100
200
300
400
500
600
700
800
2007 2011
33
Finding 14: According to the 10Ks, Government is perceived as the most critical risk to almost
all firms and industry sectors.
While government was already ranked top risk in 2007 (354 risk factor mentions across all firms we
interviewed), the number of mentions in the risk section of the 10K reports has risen sharply in 2011,
with 674 mentions.
The fact that firms in the financial sector consider risks related to government decisions as one of the
key risks they face in the aftermath of the financial crisis and the new regulations that have emerged
is not surprising. However, our analysis reveals that this is not just a concern of the financial
sector. Government is the top risk in all the industry sectors (except for consumer staples where
it ranks second, and telecommunications where it ranks third). (See Appendix 2A for the distribution
of the top risks for each of the ten industry sectors in the S&P 500).
We also coded the portion of each 10K risk section devoted to a discussion of a specific risk factor.
Figure 4.2 depicts this distribution over all 21 risk factors by aggregating all 10Ks (in 2007 and 2011)
of the 100 firms we have interviewed in the S&P 500.
FIGURE 4.2: PERCENTAGE OF THE 10K RISK SECTION DEVOTED TO A SPECIFIC RISK FACTOR; 2007 & 2011
Sources: Authors - Based on the S&P 500 firms interviewed by the research team
0%
5%
10%
15%
20%
25%
30%
35%
2007 2011
34
Note here again the prevalence of government-related risk actions: one-third of the discussion of risk
in the 10K reports was devoted to this risk factor in 2011. Legal issues were ranked second with 13%
of the 10K report devoted to this risk factor, followed by risks related to international operations (e.g.,
currency risks). Across all firms, only 3% of the 10K reports are devoted to catastrophes such as
terrorism, natural disasters and technological accidents, perhaps because most firms feel they have
the appropriate risk management practices in place to deal with these risks and/or are not highly
exposed to them.
The analysis of the 10K reveals that firms need to manage a large number of risks to avoid future
crises and the possibility of losing market share to their competitor in a fast changing environment
where government actions such as new regulations are becoming the number one concern of the
business community. We now turn to our analysis of the stock market prices of those publicly-traded
companies that confirms this finding more quantitatively.
35
Section 5. Preliminary Findings from our Analysis of S&P 500 Stock Prices
The earlier part of this report focuses on what we learned from the interviews of the 100 firms
conducted by the research team and our studies of their 10Ks. In both cases the firms provided the
information and data for us to undertake these analyses.
We also wanted to have a more neutral view of the impact of risks with potential catastrophic
consequences on their performance and, at the same time, enlarge our sample to the entire S&P 500.
While many indicators could be examined, we decided to first look at the stock price of these firms
over time. Since the overall study focuses on catastrophe risks we were interested in testing whether
events that are traditionally seen as catastrophic (natural disasters, terrorist attacks, pandemics; cyber-
attacks, etc.) triggered significant stock price declines and if so, how large they were and for what
firm/industry. We were also interested in evaluating how these events compared to other factors that
may have been responsible for significant drops in stock prices.
To this end, we built a dedicated algorithm that determined 20% changes in stock price for individual
companies over a 10-day period relative to changes in the industry average. As an example, if the
industry average price dropped 5% during a 10-day period, then any firm in the industry whose stock
price dropped 25% or more during the same period would be put in this category. For any publicly-
traded company, losing 20% of its market value relative to its competitors over such a short period
of time would be considered a serious event. (See Appendix 3 for the methodology.)
During the period 2000-2011 there were more than fifteen hundred such events of interest. We could
then determine the sensitivity of each industry sector to specific types of events and measure the
resilience of firms to price declines by determining how long it took for the stock to recover to its
pre-drop level. As shown below, firms in some industry sectors are much more likely to bounce back
in a few months while others may take several years.
NOTE: This first phase is descriptive in nature and does not analyze the specific characteristics
of the S&P 500 firms that may have been partially responsible for causing the stock price
changes. We know that two firms of similar size can manage the crisis and recovery from an
exogenous shock very differently due to their financial situation (e.g., their debt ratio) and their
leadership in the C-suite and at the Board level. The second phase of the project (2014-2015)
will examine these elements in more details. The findings discussed here are a starting point for
this type of analysis.
The section is organized as follows. Section 5.1 introduces the data and methodology. Section 5.2
presents the findings on the significant event analysis focusing on significant drops: What types of
events triggered a large drop among the entire S&P 500 over the 11 years covered by our analysis?
What types of events are more likely to do so in your industry sector? What industry sectors have
been more affected by a given type of risk?
36
In section 5.3 we discuss the issue of resilience to shocks by examining how long it took for a firm’s
stock to return to the level it was before dropping at least 20% over 10 days compared to its industry
competitors. Are specific industry sectors more likely to bounce back more quickly than others? Are
specific risk categories more likely to trigger a longer recovery time across industry sectors, or just
for specific ones?
5.1. Data
We used daily trading stock returns for all firms in the S&P 500 over the period January 1, 2000 to
December 31, 2011; we focused on the S&P 500 group of firms as of December 31, 2011 and also
included a few other firms of interest (e.g., BP, given the 2010 oil spill). In total, we studied 503
firms. Stock price data came from the Center for Research in Security Prices (CRSP) to which
Wharton has a subscription access.18 We then split all companies into their corresponding industries
(as defined by Standard & Poor’s) (Table 5.1).
TABLE 5.1. DISTRIBUTION OF THE FIRMS COVERED BY THE STUDY ACROSS INDUSTRIES
Industry # of Companies
Consumer Discretionary 84
Financials 82
Information Technology 71
Industrials 61
Healthcare 53
Energy 41
Consumer Staples 40
Utilities 35
Materials 29
Telecommunications 7
Sources: Standard and Poor’s
We then used the same 21 risk factor categories introduced in the previous section on our 10K
analysis. Table 5.2 provides a summary of keywords and illustrative examples for the stock analysis.
A number of stock price drops were related to the announcement of quarterly or annual earnings
without necessarily be linked explicitly to a given risk factor. We thus created a new category called
“earnings” as well. The methodology for undertaking our analysis is detailed in Appendix 3.
37
TABLE 5.2. DEFINITION OF THE RISK FACTOR CATEGORIES USED IN THE STOCK ANALYSIS
Category Definition Keywords Example
Accounting/Release
of Quarterly results
Change in accounting regulations that can affect
financial standing of the company, anything related
to accounting
accounting control, accounting standards,
accounting fraud; accounting errors;
Company Y was involved in an accounting fraud
case
Acquisition Management, financial or accounting risks related
to two companies becoming one
acquisitions, cost savings, joint ventures,
merger benefits, restructuring
Company X acquired one of its main competitors
in a deal many perceived as a very risky decision.
Catastrophes Natural disasters, terrorism or war, and calamities natural disasters, terrorism / war, weather,
fatalities
Hurricane X has hit the oil refinery of Company Y.
Capital Expenditure
Investment in the company’s business – facilities,
equipment, fixed assets, R&D
capital expenditures, R&D Company X has invested $30 million into a key
R&D project, which is in its 4th stage of approval
from USDA and this was denied.
Capital Structure
Debt to equity ratio – how companies are financed, which affects stock price
assets: liens, capital availability, credit rating, debt: additional, debt: covenants,
debt: highly levered, debt: refinancing,
interest rates, restructuring charges
Company X was not able to refinance its debts given a recent downgrade of its bond rating by
rating agencies
Competition
Competitive gain or loss of market share to a
specific competitor
competition, competition: lower prices,
substitute products
Company X recently posted their market share
report, indicting a drop of 30% of their electronic
products – mostly to their rival Company ABC.
Credit Risk Not receiving payment for delivered goods or
services
credit risk, cash flow Company X was not able to receive payments from
Company Y which filed for bankruptcy.
Customer
Concentration
Firm revenue is dependent on a few large
customers or a high concentration of customers
within a region
customer concentration, regional
dependency
Company X’s recent quarterly report indicates a
drop in their sales due to low demands in the
southwest region of the US
Distribution
Outward flow of goods or services from the
company to the customer through different channels (online, in-store)
distribution channels, transportation,
supply chain, distribution partners
80% of all department stores have stopped selling
Company X’s products due to pricing conflicts.
Earnings earnings, estimated earnings, sales
subscriptions that explicitly affect earnings
Company X recently released their quarterly
earnings – a 40% decrease in sales.
Government
Actions taken by government, external to the firm,
which have an influence on the operations of the
firm
regulation, law, government oversight Government’s recent scrutiny on hiring practices
of Company X has triggered a change of
management.
Industry
Broad shifts in an industry-specific environment
which impacts how all players act
industry changes, industry condition, trend
change
Company X and four of its competitors have
suffered from customers’ switch to a new type of
technology
Intellectual Property
Threat to the security or value of intellectual
property and costs associated with protecting and
maintaining it
IP, legal defense, value, patents, copyright Company X lost a lawsuit concerning their
product’s design and how it closely resembled one
of their rival’s products.
International
Any risk associated with the challenge of doing
business in non-domestic settings
currency / exchange rates, international
(non-US) risk, international markets (challenges)
Company X’s huge investment in Country ABC
and the country’s recent announcement of inflation has triggered a spike in Company X’s cost of
operations.
Investments
Pension/retirement benefits and any capital put into
other firms, capital withdrawn from other firms,
named individuals that buy or sell shares en masse
(usually triggered by specific company event or
trend)
liquidity / investments, pension /
retirement benefits
Company X’s bankruptcy claim affects its parent
company, Company ABC who invested 300 MM
into the company 10 years ago.
Key Personnel Recruitment and retention of essential management
positions; references to specific names or positions
key personnel, key personnel: insurance,
new management
Company X’s CEO Joe Smith has recently been
arrested for insider trading and fraud.
Labor
The workforce required to maintain daily
operations in terms of quantity and quality
unions / labor, salary, hiring trend Company X’s labor union has gone on strike, and
the company’s inability to hire new employees in time adversely affects their operations.
Legal Liability, litigation and legal proceedings legal, lawsuit Company X recently lost their lawsuit against
Company Y.
Macro Uncontrollable or unpredictable changes in the
aggregate market
recession, trend, global trend Company X’s large did not allow it to survive the
recession.
Marketing
Firm’s reputation, image, pricing, and presence in
the market;
brand, brand concentration, consumer
preferences, market acceptance, market
share, marketing effectiveness, pricing,
reputation, scandal, analyst
recommendations
Company X’s series of product recall due to death-
related accidents have made the company’s brand
equity drop 30% and its perception plummet
among consumers.
Operations
Uncertainty and challenges associated with
production, development and implementation for
goods and services
leases, manufacturing / technical, new
products, new stores, operating risk,
product quality, production delay, single product, technological change, technology:
unproven, working capital
A firm did not make the necessary investments to
move to a new technology and was outpaced by its
competitors
Suppliers
The rise in costs or scarcity of necessary materials
for production of goods or services either for the
company or companies to which the company
supplies materials
energy prices, raw materials availability,
raw materials prices, suppliers:
concentration, suppliers: promotions,
supply chain, supply chain: foreign
Recently failing to reach a deal with the
government of Country A, Company X was unable
to monopolize the manufacturing capacity of
electronic equipment, and was outcompeted by its
rival, Company Z, in the supply chain.
38
5.2. Results
The research team then undertook a large-scale study to identify the most likely drivers of the 2,119
events through public documents searches on the Internet, Factiva and LexisNexis.i Firms
announcing negative news on earnings were by far the largest source of significant drops of the stock
price over a short period of time, with a total of 599 events (or 28% of all negative events) in this
category. We now consider the distribution of the 21 risk factors when one excludes these earnings-
related events over the 1,520 drops (Table 5.3).
TABLE 5.3. SUMMARY OF SIGNIFICANT PRICE DROPS ACROSS 21 RISK FACTOR CATEGORIES
2000-2011 – FULL S&P 500
Risk Factors Total Percentage
Marketing 192 12.6%
Operations 186 12.2%
Acquisition 150 9.9%
Legal 119 7.8%
Industry 108 7.1%
Key Personnel 102 6.7%
Capital Structure 100 6.6%
Macro 97 6.4%
Government 80 5.3%
Labor 66 4.3%
Competition 64 4.2%
Credit Risk 60 3.9%
Capital Expenditure 56 3.7%
International 38 2.5%
Investments 30 2.0%
Catastrophes 19 1.3%
Suppliers 14 0.9%
Accounting 13 0.9%
Distribution 12 0.8%
Intellectual Property 10 0.7%
Customer Concentration 4 0.3% Note: N= 1,520
i Some events have multiple drivers behind a stock price changes, and can be categorized with more than one risk category. Note also
that in several cases it was not necessarily clear whether an event had been driven by a specific risk factor.
39
Finding 15: The top risk factors that have led to the highest number of significant negative
stock price drops in the S&P 500 over the period 2000-2011 are Marketing (12.6%), Operations
(12.2%), and Acquisitions (9.9%) (See Definitions in Table 5.2).
We are also interested in seeing what risk factors drove more stock drops in recent years. Since our
analysis of the 10K used 2007 as a first reference point, we re-did the analysis for the entire S&P 500
firms by looking at two time periods: [2000-2006] and [2007-2011]. Table 5.4 shows for each risk
factor the number of negative drops across the full S&P 500 for each of the two periods and the
percentage change over time.
TABLE 5.4. SIGNIFICANT PRICE DROPS RELATED TO 21 RISK FACTOR CATEGORIES. FULL S&P 500
Risk Factors 01/2000-
12/2006
01/ 2007-
12/2011 Total Drops
Percentage change between
2001-2006 and 2007-2011
Credit Risk 22 38 60 73%
Macro 38 59 97 55%
Capital Structure 42 58 100 38%
Government 34 46 80 35%
Labor 31 35 66 13%
Suppliers 7 7 14 0%
Industry 56 52 108 -7%
Catastrophes 11 8 19 -27%
Distribution 7 5 12 -29%
Operations 110 76 186 -31%
Acquisition 89 61 150 -31%
International 23 15 38 -35%
Key Personnel 62 40 102 -35%
Legal 75 44 119 -41%
Investments 19 11 30 -42%
Marketing 126 66 192 -48%
Capital Expenditure 39 17 56 -56%
Competition 46 18 64 -61%
Accounting 11 2 13 -82%
Customer Concentration 4 0 4 -100%
Intellectual Property 10 0 10 -100% Note: Total events: 1,520. Percentage numbers are rounded. Significant price drop is defined as a 20% change or more in stock
price for individual companies over a 10-day period relative to changes in the industry average.
Not surprisingly, Credit Risk has the greatest increase in stock price drops between the two periods
(+72%) reflecting the financial crisis. The percentage increase in Macro (+55%) reflects the negative
impact of the economic recession on a number of firms. The percentage increase in Government
(+33%) confirms what we learned from the 10K risk section analysis in Section 4 of this report. It
appears that many firms rank this factor as their top risk in their annual reports to shareholders not
40
only because more stringent regulatory systems negatively impact their business, but also as a
reflection as to how they feel government actions can impact on their stock prices.
To gain more insight into the impact of the government risk factor on stock price drops, we undertook
a similar stock analysis on the sample of firms that took part of our interview process. We analyzed
their 10K risk reports where there was a significant increase in risk factor mentions of government
between 2007 and 2011. As Figure 5.1 reveals, this increasing concern about government seems
understandable if one looks at the significant percentage increase (367%) stock price drops that can
be attributed to government activities over the [2007-2011] period compared to [2000-2006] for the
100 firms that we interviewed.
FIGURE 5.1. PERCENTAGE INCREASE IN SIGNIFICANT STOCK PRICE DROPS.
2007-2011 VERSUS 2000-2006 FOR 100 S&P 500 FIRMS INTERVIEWED
Finding 16: For the publicly-traded firms we interviewed, the most significant percentage change
in the number of stock price drops in 2007-2011 compared to 2000-2006 was Government
(+367%), followed by Credit Risk (+200%) and Capital Structure (+190%).
5.3. Focus on Sudden Catastrophe Events as Drivers of Significant Stock Price Drops
The stock analysis shows that events that often come to mind when thinking of catastrophes (e.g.,
natural disasters, terrorist attacks, war, fatalities) represent only a very small portion of the risks that
have led to significant stock price drops (that is, a drop of at least 20% over a period of 10 trading
days, compared to the industry average).
-100%
-50%
0%
50%
100%
150%
200%
250%
300%
350%
400%
41
In fact we find that the Catastrophes risk factor (defined as including natural disasters, terrorist
attacks, technological accidents) ranked only 16th out of 21 risk factors in the number of severe stock
price drops over the period 2000-2011 in the entire S&P 500 (Table 5.1).
There are examples where the stock of the firm dropped at least 20% in the wake of a catastrophe as
reported in these media articles:
“In the wake of 9/11 transportation shares were hit hardest and Firm X in the transportation
part business was no exception. On this day, more than 80 percent of all stocks lost ground,
but transportation-related companies fared the worst among Northwest companies. The steep
declines on the first day of trading since terrorist attacks closed the markets a week prior
showed how nervous investors felt about companies that depend on travel or consumer
spending.” (September, 2001; trigger: 9/11 terrorist attacks)
“Analysts speculated that the financial devastation that hit the airline industry following the 9-
11 terrorist attacks the week prior would envelop Firm X, an online booking company. An
analyst lowered the company’s projected profit from 22 cents a share pre-attack to 10 cents a
share. X’s business involves customers bidding on airline tickets, but since the attacks, the
nation’s leading airlines had lost $1 billion due to diminished demand of nervous travelers, a
costly two-day shutdown of the airways, and higher security expenses. Analysts said X’s other
problem was that travelers who were skittish about flying would not know the airline or routing
details of their flight such as time of day they will fly when they buy the tickets online until
their bid was accepted and the transaction completed, which did not make the process feel any
more secure.” (September 2001; trigger: 9/11 terrorist attacks)
“Firm X settled asbestos injury claims for $2.7 billion and took a charge against earnings of
about $500 million. The manufacturing company and at least three-dozen insurers paid the
settlement over the next 21 years. X’s chief executive officer said most of the asbestos claims
were the result of the company's 50 percent ownership position in firm X, a company that
made asbestos pipe insulation before it filed for Chapter 11 bankruptcy protection in April
2000.” (2002; trigger: the asbestos crisis)
“Firm Z announced the alert it declared at the Susquehanna nuclear power plant in
Pennsylvania due to low oxygen levels in a pump room did not pose any danger to the public.
The alert was triggered when plant personnel working on a pipe that required the monitoring
of oxygen levels, detected low oxygen levels and immediately left the area. Operators
declared an alert as a matter of procedure.” (2008; trigger: perception of a possible nuclear
incident)
42
“On this day, the food company X pulled fresh ground beef from all of its stores in the second
E. coli outbreak linked to Nebraska Beef in as many months. The meat X recalled came from
Y, which unbeknownst to X had processed it at Nebraska Beef of Omaha. One of the nation's
largest meatpackers, Nebraska Beef has a history of food-safety and other violations” (2008;
trigger: product recall due to food disease)
“On this day, shares of Bank A plummeted and traded at more than 17-year lows after a report
that the firm will need a fresh cash infusion – up to $20 billion – from the federal government
to keep going after its acquisition of Y. The news came amidst growing popular concern over
the health of the banking sector, after a slew of other government bailouts.” (2009; trigger:
2008-2009 financial crisis)
“Firm X and Y Corporation, with a combined 90 percent stake in a ruptured Gulf of Mexico
oil well, could handle up to $35 billion in costs from the spill, independent research service
CreditSights said on this day. X and its partners Y and Z will be responsible for spill clean-
up costs and related damages, according to their leasing contract with the U.S. Minerals
Management Service and a drilling contract with K, the analysts said.” (2010: trigger: oil
spill in the Gulf of Mexico)
It is worth noting that of none of the stock price drops appears to have been triggered by a natural
disaster. Maybe it is because S&P 500 firms tend to be fairly diversified geographically, so even
though some of their operations were affected by a hurricane or earthquake for a short period of time,
the market did not view this disruption as a long term threat to the performance of the firm. We also
learned from our interviews that many more firms had prepared themselves to deal with natural
disasters through asset reallocation, protective measures, business continuity plan, insurance
(property and business interruption) in recent years.ii As such, investors in the financial markets
could expect these companies to bounce back fairly rapidly even following a severe natural disaster
such as Hurricane Katrina and the Japan earthquake of 2011.
Note that a stock price drop model with different parameters (e.g., 10% rather than 20% drop; 4 weeks
rather than 10 days) might yield different findings regarding events associated with the change in
price. For example, a large insurance company which did not drop 20% in the 10 day period
immediately after Katrina still lost 10.6% of its market cap within a month after the disaster. It took
that firm an entire year for its stock to recover to a pre-Katrina level.
A company in the energy sector saw its stock first increase 5% (as oil prices rose) but then its stock
dropped 13.1% during the month of October 2005. In our interview with the firm, it indicated that
return to normal operations following damage caused by Hurricane Katrina at our Louisiana facility
ii It might also be the case that a firm’s stock does not drop more than 20%, compared to their industry peers, in just 10 days, and thus
do not appear in the algorithm we have created.
43
was more complex and time consuming than anticipated. It took this firm nine months for its stock
to bounce back. In these two instances the financial impact was severe but those two events would
have not been captured by our algorithm. These two events had obviously serious economic impact
on those firms.
5.4. Bouncing Back: A Measure of Stock Price’s Resilience
Important questions to address with respect to the resilience of a firm to adverse events are:
What happens to the stock of these firms once the price drops significantly?
How long does it take to bounce back to the level it was before the price drop?
How does this resilience factor vary across industry sectors?
Are specific types of events more likely to require longer recovery time?
To answer these questions we looked at all the events that led to at least a 20% drop over a 10-day
period (including some related to earnings reports) across the entire S&P 500 over the period 2000
to 2011. The algorithm is continuously looped until the stock price returns to where it was just before
the 20% price drop. The difference between the “ending” date and the “starting” date is measured in
weeks, and classified as duration. It is then possible to calculate the mean, standard deviation and
min/max of this time period across industry sectors and risk type events.
Table 5.5 shows for each industry sector the mean recovery time in weeks over the 1,520 events of
interest. The Materials and Financial sectors had the shortest durations (mean of 34 and 61 weeks,
respectively). The longest recovery time is in the IT sector with 132 weeks duration (over 2½ years)
on average, followed by Utilities (131 weeks) and Healthcare (102 weeks). As one can see in Table
5.5, some recoveries have been fairly quick in all sectors (the minimum being two weeks) while
others have been extremely long, up to nearly ten years.
TABLE 5.5. STOCK PRICE RECOVERY TIME OF FIRMS ACROSS INDUSTRY SECTORS
AFTER A 20% DROP RELATIVE TO INDUSTRY
Industry
Number
of
Firms
Number
of Firms
Impacted
Number
of
Events
Mean
Recovery
Time (weeks)
Standard
Deviation
(weeks)
Max
(weeks)
Min
(weeks)
Information Technology 71 63 494 132 200 598 2
Utilities 35 13 54 131 148 581 2
Healthcare 53 38 143 102 171 596 2
Consumer Staples 40 18 53 84 105 500 4
Industrials 61 32 79 83 124 599 3
Energy 41 21 77 74 115 505 2
Consumer Discretionary 84 63 329 73 128 596 2
Telecommunications 7 2 13 66 81 230 2
Financials 82 68 264 61 89 564 2
Materials 29 20 47 34 41 169 2
44
Finding 17: The mean stock price recovery time for companies across the full S&P 500 after
the stock dropped 20% over a 10-day period compared to its industry peers is more than one
year for firms in all industry sectors except Materials.
Table 5.6 looks at the data in a different way by focusing on event types. As one would expect,
changes in Industry trends and Competition lead to the longest recovery time, indicating a shift in
investors’ view of the firm and of its capacity to produce as much value as before the price change.
Interestingly, the mean recovery time related to Government events is over one year (61 weeks),
confirming the importance for firms to integrate this external factor into their risk identification and
prioritization process as part of their risk analysis and management process described in Section 2 of
this report. In the 19 instances where the stock of a firm dropped more than 20% as a result of a
Catastrophe, the mean recovery time was just over one year (58 weeks). TABLE 5.6. STOCK PRICE RECOVERY TIME ACROSS RISK FACTORS
AFTER A 20% DROP RELATIVE TO INDUSTRY
Risk Factor Number of
Events
Mean
Recovery
Time (weeks)
Standard
Deviation
(weeks)
Max
(weeks)
Min
(weeks)
Competition 62 162 210 598 2
Industry 105 137 204 589 2
Acquisition 135 121 181 599 2
Investments 29 117 141 489 2
Operations 162 102 167 590 2
Macro 97 99 160 589 2
Legal 110 94 156 596 2
Earnings 546 93 147 589 2
Labor 62 90 162 569 2
Accounting 13 90 113 326 2
Marketing 164 80 144 596 2
Credit Risk 55 79 108 364 2
Capital Expenditure 49 78 128 584 2
Key Personnel 92 72 141 575 2
Distribution 9 66 79 215 2
Government 74 61 133 584 2
Capital Structure 84 61 107 584 2
Catastrophes 19 58 77 238 2
Suppliers 13 55 42 128 3
Customer Concentrations 4 54 61 159 12
International 34 46 106 588 2
Intellectual Property 10 22 22 83 2
Finding 18: The longest recovery time is for events related to significant changes in Competition
(162 weeks), Industry trends (137) and (bad) Acquisitions (121 weeks). Drops related to the
Government risk factor and Catastrophes have a mean recovery time of 61 and 58 weeks, respectively.
45
We then analyzed how the mean recovery time in weeks varies across industry sectors and risk
factors. Table 5.7 shows that not all risk factors event types affect firms in a given industry sector in
the same way. We will explore reasons why this is the case in the next phase of the research project.
TABLE 5.7. MEAN RECOVERY TIME ACROSS RISK FACTORS AND INDUSTRY SECTOR (IN WEEKS)
C
on
sum
er
Dis
cret
ion
ary
Fin
an
cia
ls
Tel
eco
mm
un
i
cati
on
s
Info
rma
tio
n
Tec
hn
olo
gy
Co
nsu
mer
Sta
ple
s
En
erg
y
Hea
lth
care
Ma
teria
ls
Uti
liti
es
Ind
ust
ria
ls
Av
era
ge
Accounting 28 - - 6 - - - 169 178 16 90
Acquisition 56 81 - 182 27 46 165 47 75 230 121
Catastrophes 8 109 - 75 51 20 - - 109 110 58
Capital Expenditure 48 41 - 145 - 18 100 - 66 126 78
Capital Structure 31 45 - 144 77 60 76 2 154 31 61
Competition 154 178 67 203 88 - 126 71 14 - 162
Credit Risk 48 77 - 5 - 6 4 20 188 18 79
Customer
Concentration 23 - - 12 - - - - 159 - 54
Distribution 5 2 - 96 41 - - - 215 - 66
Earnings 61 52 121 132 105 84 122 39 67 85 93
Government 23 31 23 172 - 22 25 31 51 13 61
Industry 56 47 114 217 7 21 99 5 303 16 137
Intellectual Property 8 - - 30 - - 15 - - - 22
International 49 17 - 58 28 - 82 14 87 34 46
Investments 255 99 - 10 5 74 84 - 329 - 117
Key Personnel 85 64 - 73 88 178 15 33 - 8 72
Labor 50 17 2 177 185 20 36 9 59 19 90
Legal 89 60 10 103 28 89 104 9 291 47 94
Macro 60 67 120 190 88 45 - 32 219 31 99
Marketing 82 65 73 93 56 - 59 56 - 45 80
Operations 74 38 4 141 55 123 88 20 219 57 102
Suppliers 30 - - 3 88 71 - 39 - - 55
Average 73 61 66 132 84 74 102 34 131 83
46
5.5. Conclusions of the Preliminary Stock Price Analysis
This quantitative analysis of how events of different natures can negatively impact the stock prices
of S&P 500 firms sheds new light on events that have led to massive drop in stock prices. There are
several lessons that can be gleaned from our findings.
While one often thinks of catastrophes as those triggered by sudden events such as natural disasters,
terrorism or industrial accidents, many other types of events were associated a firm’s stock price
drops of 20% or more over a 10-day period compared to its competitors. In the sample of firms we’ve
interviewed, the Government risk factor was by far the one that triggered the largest percentage
increase in the number of severe stock price drops over the period 2007-2011 relative to 2000-2006.
This may explain why so many of these firms are so concerned about government risk in their recent
10K reports.
Certain industry sectors are much more volatile in their stock price drops than others (and take longer
to recovery to bounce back to their pre-drop level. The mean recovery time for all industry sectors
(except Materials) is greater than one year. The recovery time will also vary with the risk factor
triggering the stock price decline.
In the next phase of our analysis of these data, we will consider factors that make firms more resilient
to adverse events, such as their financial characteristics (e.g. revenue, debt level, liquidity level) as
well as the adoption of good risk management practices and leadership. In this regard we will also
consider differences in how firms assess and communicate their risks internally and to the outside
world. The classification given by rating agencies may also be an indicator of a firm’s resilience after
its stock price declines significantly.
47
Section 6. Overcoming Challenges through the Development of Long-term Strategies
This section provides guidelines for firms to develop long-term strategies for managing crises and
catastrophic risks. As a starting point, firms should have a clear understanding of the nature of the
risk and uncertainties associated with events that could have a significant impact on their activities
and profitability in the short- and long-term. Given the importance of intuitive thinking in guiding
firms’ decision making processes, it is important to consider the relevant biases and heuristics that
managers make in designing their current programs for dealing with catastrophic risks. They also
need to take into account the role that government is likely to play in monitoring and controlling their
activities. Below we focus on a set of risk management strategies that link intuitive and deliberative
thinking processes so as to increase their acceptability by the relevant stakeholders and hence their
implementation.
Reframing the Time Horizon
One way to encourage firms to be better prepared to manage catastrophic risk is to reframe the
likelihood of a disaster so that it is above the key decision makers’ threshold level of concern.
Research shows that simply adjusting the time frame can have a significant impact on individuals’
perception of the risk. For example, people were more willing to buckle their seatbelts when they are
told they had a one-in-three chance of an accident over a 50-year lifetime of driving, rather than a
.00001 chance each trip.19 Similarly, a firm which has its facilities in a hurricane-prone area is far
more likely to take the risks of storm-surge and wind damage to its property more seriously if instead
of being told the chance of a flood is 1 in 100 in any given year, they are told that it has a greater than
one-in-five chance of happening in the next 25 years.20
Similarly, if directors and C-suite executives were provided with data on the likelihood of a severe
event over the next 10 years rather than focusing on the annual probability, or what could happen the
next quarter, they would be more likely to consider taking steps now to reduce these risks. Extending
this time horizon is also important for risks where it is difficult to estimate a probability
mathematically, as is the case for a number of risks we consider in this report. For instance, while a
firm might think that the probability of suffering from a cyber-attack will be extremely low in the
coming six months, it is likely to be significant in the coming 5 to 10 years given recent trends that
show an increasing number of attacks across many different types of firms.
Spreading Upfront Costs over Time
Extending the time horizon is also important to evaluate the return on investment of specific risk
reduction measures when the upfront cost is offset by losses avoided over a long period of time. To
take a simple example, the cost of installing air bags in an automobile would not be justified by
calculating the expected loss on a daily or weekly basis but is likely to be cost-effective in reducing
the consequences of severe injuries from an accident to the driver and passengers over the normal
length of time that families keeps their cars.
48
Firms operate on an annual cycle when it comes to bonuses, budgeting and financial statements. For
this reason it is understandable that decision makers are likely to focus on short-term horizons when
making their decisions, particularly if it involves large expenditures. To encourage managers to invest
in protective measures to reduce the likelihood and/or consequences of future catastrophic losses it
would be useful to spread the costs of these measures over time with short-term benefits to encourage
firms to adopt them.
One way to address this issue would be to amortize the upfront costs of the measure over a number
of years so the annual costs that appear on the firm’s balance sheet is relatively low. The firm may
be able to negotiate a lower annual insurance premium with the provider of coverage to reflect the
reduction in expected losses from a future catastrophe. If cost effective, the expected annual benefits
from a reduction in the price of insurance will then be higher than the annual cost of the investment
in reducing catastrophic risk.
Focusing on Salient Events
Calling attention to the benefits of investing in protective measures by focusing on the reduction in
losses from a specific storm, such as Sandy or Katrina, is likely to attract more concern than a general
message framed in terms of reducing damage from future hurricanes. Focusing on a well-known
scenario is also more likely to trigger attention by the firm. The data from the interviews highlighted
the importance of specific crises in getting firms to pay attention. Controlled experiments undertaken
before 9/11 revealed that consumers in the United States were willing to pay more for insurance
against a plane crash caused by terrorists than for flight insurance due to any cause, a finding that is
counterintuitive since, by definition, “any cause” includes a terrorist attack.21
Establishing a Level Playing Field
Well-enforced government regulations and standards may help establish a level playing field across
firms and lead them to take steps to reduce the risks of extreme events in future years. The Sarbanes–
Oxley Act of 2002 set new or enhanced standards for all U.S. boards of directors, management and
public accounting firms following the corporate scandals involving Enron, WorldCom and other
companies. Similarly the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010
brought the most significant changes to financial regulation in the United States since the regulatory
reform that followed the Great Depression of the 1930s. It involves all federal financial regulatory
agencies and has affected the nation's financial services industry.
In one interview, a CRO from a financial institution made the following comments regarding the role
of regulatory agencies in guiding firm behavior regarding catastrophic risks:
The regulators have really been pushing to raise the bar on risk governance and made many
mistakes themselves just like the industry did. In the process, they are doing some things that
are really good and other things that are really bad. They are trying to feel their way through
this and have a very important role to play in governance of the industry.
49
In another of our interviews, a CEO from a retail firm made the following positive comments
regarding the role that Sarbanes-Oxley has played in the firm’s operations: of regulatory agencies in
guiding firm behavior regarding catastrophic risks:
Like most people in business, I shuddered when Sarbanes-Oxley came out. But I have to tell
you that in the final analysis it has made us a better company. It forced us to think about those
items that were on the border of becoming a material weakness or, if they weren’t now, might
be in two or three years. It made us a much better company and made us all much more aware
of risk. As much of a critic as I was about Sarbanes-Oxley, I think the essential parts of it
probably made us better as a company.
When we asked the treasurer of a parts distributor: Are there any risks that keep you up at night? he
responded by saying:
Compliance. Just making sure we are crossing our ‘T’s and dotting the ‘I’s. In today’s
Sarbanes-Oxley world, it compliance is such a big deal. Just keeping everyone informed of
everything that could possibly be going on is a major challenge.
The enterprise risk officer of an IT company we interviewed was very concerned with the impact that
unexpected legislation would have on its operations as highlighted by the following comments:
The bill was designed to introduce new competition contrary to the way we’d been running the
business to date and to hamstring us on many of our competitive advantages. Regulators had
been given the authority to implement the law, which had many ambiguities and contradictions.
So we organized an effort to educate them, hoping they would adopt reasonable approaches
that would minimize the impact on our business. We thought that would be better policy. There
was also a lobbying effort to delay the implementation of the rules, which failed. For the last
year we’ve been engaged in a strategic exercise to figure out how to compete effectively in this
completely revamped business environment. And out of that exercise has fallen a lot of different
technology and processing and other marketing and contract projects.
Regulators are subject to the same behavioral biases as other decision makers; government agencies
and legislators often overreact following a crisis or catastrophic event. New regulations may have a
significant impact on an entire industry in ways that do not take into account the companies that have
invested heavily in risk management strategies and have much lower risk than the firm(s) responsible
for the catastrophe or crisis.
We should also note that for most of the events discussed in this report that could trigger catastrophic
consequences, firms are not always in a position to manage these impacts on their own. Partnering
with other companies and public sector organizations, leading research institutions and the public
sector to better assess and manage risks and crisis is also a critical element in designing and
implementing effective long-term catastrophic risk management strategies.
50
Section 7. Open Questions for the Next Phase of the Project
As we move into the next phase of this research project, we propose a few questions for readers to
reflect and comment on after reading this report:
Is the proposed framework an appropriate one for structuring our analysis of firm behavior with
respect to catastrophic risk? Are there other elements that should be incorporated in the
framework?
What data are available from publications and public documents to determine how firms’ roles
have changed over time and the factors that have influenced this process? Are there internal
documents and data from your own organization that you could share with us under a confidential
agreement?
What type of data analyses can we undertake to examine factors that may impact on catastrophe
risk management so we can specify additional findings? How can we test in a rigorous manner
the degree to which these findings are confirmed with available data from public documents and
interviews and other sources?
Are there specific case studies that we might undertake for a more in-depth analysis as to how
certain firms deal with catastrophic risks that could complement the interviews, reports and public
data that we are utilizing in this study?
What criteria would you propose for specifying benchmarks for providing guidelines to improve
firms’ catastrophe risk management?
What suggestions do you have for incorporating the role that public sector can play to encourage
firms to undertake protective measures prior to future crises to reduce their losses and those of
others?
What positive roles can the public sector play in making the recovery following a disaster a more
equitable and efficient process than it is currently?
51
Appendices
52
Appendix 1. Statistics on the 100 Firms Interviewed
As discussed in the introduction of the report, the distributions of the 100 firms we’ve interviewed
across industry sectors is fairly representative of the entire S&P 500. Below we also provide a
comparison on an annual revenue basis and number of employees, which confirm that the sample is
representative of the full S&P 500 group.
Number of Employees
1 to 5,000
16%
5,000 to 10,000
18%
10,000 to
20,000
19%
20,000 to
100,000
35%
>100,000
12%
S&P 500
1 to 5,000
11%
5,000 to 10,000
15%
10,000 to
20,000
23%
20,000 to
100,000
39%
>100,000
12%
Interviewed Companies
53
Annual Revenue (2010)
$1-to-$5 Billion
35%
$5-to-$10 Billion
23%
$10-to-$20
Billion
19%
$20-to-$100
Billion
20%
> $100 Billion
3%
S&P 500
$1-to-$5 Billion
28%
$5-to-$10 Billion
18%
$10-to-$20 Billion
18%
$20 –to-$100
Billion
33%
> $100 Billion
3%
Interviewed Companies
54
Appendix 2A. 10K Risk Factor Mentions across Industry Sectors
It is also interesting to compare Risk Factor mentions for each industry sector individually; that
analysis reveals important heterogeneity as one would expect.iii
FIGURE 2A. COMPARISON RISK FACTOR MENTIONS IN 10K OF SP500 INTERVIEWED FIRMS BY SECTOR
iii The number of interviewed firms varies by industry sector: consumer discretionary (17), consumer staples (6), energy
(7), financials (22), health care (11), industrials (6) information technology (14), materials (4), telecommunications (1)
and utilities (5).
55
0
10
20
30
40
50
Industrials
2007
2011
56
0
20
40
60
80
100
Information Technology
2007
2011
0
2
4
6
8
10
12
14
16
Materials
2007
2011
0
1
2
3
4
5
6
7
8
Telecommunications
2007
2011
0
5
10
15
20
25
Utilities
2007
2011
57
Appendix 2B. Percentage of the 10Ks Discussing Specific Risks (across sectors)
We combined the 2007 and 2011 10Ks and generated the ranking of the top 10 risk factors discussed
by firms for each industry sector.
FIGURE 2B. TOP TEN RISKS (AS PROPORTION OF THE 10K DISCUSSING THAT RISK FACTOR)
(2007 AND 2011 COMBINED)
58
59
Appendix 3. Methodology for Analyzing Stock Price Changes
Given our broader interest in events that lead to a significant change in stock return, we did not only
look at how stocks evolved one day to the next (since the market can overreact to a sudden event but
come back rapidly in just a few days) but developed an algorithm covering periods of 10-trading
days.
Let us consider the following example. Firm A had the following daily stock return for the period
October 27-November 7:
On a given day we can calculate the 10-day (forward) adjusted stock return. Let’s say the stock is X
on October 26. The 10-day return (for October 27 to November 5) is 32.6% in this example (X*1.05
* 0.92 * 1.02 * 1.03 * 1.08 * 1.09 * 1.07 * 0.98 * 1.08 * 0.98). The 10-day adjusted return for the
stock of firm A for October 28 is 30.2% (i.e. X*0.92 * 1.02 * 1.03 * 1.08 * 1.09 * 1.07 * 0.98% *
1.08 * 0.98 * 1.03), etc. This is then done for each one of the firms for all 251 trading days in a given
year (total of 2,761 trading days). In total we thus looked at 1.4 million trading-days/firm datapoints.
Adjusted 10-day Stock Return (10-day model)
5% -8% 2% 3% 8% 9% 7% -2% 8% -2% 3% 5%
10/27 10/28 10/29 10/30 10/31 11/1 11/2 11/3 11/4 11/5 11/6 11/7
10/27 10/28 10/29 10/30
32.6% 30.1% ? ?
60
We then control for industry-effects by calculating the difference between the 10-day adjusted stock
return for a specific firm and the industry average 10-day adjusted stockiv over the same 10-day
period. The algorithm then generates “events of interest” where this difference is higher than 20%
(up or down).
As a hypothetical illustration, let’s consider the month of October 2009 and four firms which compose
a given industry (or sub-category of that industry). For four consecutive trading days we calculate
the 10-day adjusted stock return for those firms (e.g., -19% for Firm A on October 27) and compare
it to the industry average, Δ measuring this difference. The algorithm then determines firmi/trading-
dayt where Δ is higher than 20 percentage points.
Illustrative example of event selection. 10-day adjusted stock return for firms and industry average.
Firm A Firm B Firm C Firm D Industry Average
10/27 -19% (Δ=-6.5) -22% (Δ=-9.5) -18% (Δ=-5.5) 9% (Δ=+21.5) -12.5%
10/26 3% (Δ=+1.75) 2% (Δ=+0.75) -4% (Δ=-5.25) 4% (Δ=+2.75) 1.25%
10/25 4% (Δ=-0.25) 6% (Δ=+1.75) 3% (Δ=-1.25) 4% (Δ=+0.25) 4.25%
10/24 10% (Δ=+8.5) 8% (Δ=+6.5) -20% (Δ=-21.5) 8% (Δ=+6.5) 1.5%
In this simple example, two events of interest would be selected: one “gain” for Firm D and one
“loss” for Firm C.
There were approximately 23,000 such events of interest that were picked up by the algorithm. Of
course since we look at a 10-day window it is likely that drop or gain events are related to the same
driver around this 10-day window. Another algorithm was thus built that clumps such events together:
If an event was less than 3 days away from the other events of interest, then it is clumped together as
one single event. We ended up with a total of 5,800 events that have moved the stock price of a given
company more than 20% than its competitors.
We then regrouped these events into a predefined set of categories called risk factors. The goal was
to better appreciate whether these events were mainly driven by specific risk factors, whether there
were noticeable patterns across industries in the S&P 500 and finally, whether firms were more likely
to bounce back after having seen their stock drop more than 20% in 10 trading days if this drop was
driven by specific types of risk. In other words, certain risk drivers might have more enduring effect
on the stock of these firms. In total there were 1,520 events of interest where the stock of a firm
dropped more than 20%. We analyze those 1,520 events in Section 5 of this report.
iv Industry average was calculated by averaging each 10-day number of all the companies in the industry.
61
Appendix 4. Leadership and Governance Lessons from Three Case Studies
As we conclude this preliminary report we would like to illustrate some key concepts with three concrete and
detailed cases of lessons of leadership at the top of organizations that had to go through significant crises in
recent years. Deutsche Bank—a German Bank operating worldwide—managed the 2011 Japan earthquake,
tsunami and nuclear accident. This case was written in collaboration with Deutsche Bank’s senior management
who gave us permission to include number of details and names. The other two cases are based on interactions
with firms we interviewed as part of our S&P 500 study. For this reason no names of individuals or the
companies are mentioned.
CASE A1. Deutsche Bank: An Unprecedented Disaster on the Other Side of the Planet
On Friday, March 11, 2011, the largest earthquake in Japanese history shook much of the country at 2:46 p.m.
Tokyo time. At 9.0 magnitude on the Richter scale, the Tōhoku earthquake was the fourth largest earthquake
to occur anywhere on Earth within the past century. By contrast, the Haiti earthquake on January 12, 2010,
which killed an estimated 300,000 people and injured another 300,000, registered only 7.0 magnitude.22
During the 6-minute Tōhoku earthquake, more than 200 miles of the Japanese coastline dropped 2 feet, Japan
moved 7.9 feet closer to North America, the Earth shifted its axis by 10 inches, and the globe’s rotation slowed
by 1.8 microseconds. Building damage was extensive, despite Japan’s tough earthquake-resistant building
codes. But, far more devastating – what indeed would prove catastrophic – was the earthquake’s after-effect
felt approximately 15 to 20 minutes later.
Just 45 miles off the peninsula of Tōhoku, a 10-foot upward thrust of the sea floor created an enormous outflow
of water in all directions. The resulting tsunami rose 30 feet above normal sea level in many coastal regions,
sweeping inland as much as 6 miles along Japan’s northeast shoreline, destroying almost everything in its path.
The Japanese government estimated that more than 15,000 people perished in the earthquake and resulting
tsunami and approximately 9,300 people were missing or injured, almost all in the country’s northeast.
Deutsche Bank AG, one of the world’s largest banks with offices in countries spanning the globe, had a
significant presence in Japan, concentrated mainly in Tokyo where most of its 1,500 staff was located when
the disaster struck. Within 24 hours of the event, Victor Meyer, the bank’s global head of Corporate Security
and Business Continuity (CSBC), confirmed that all of the bank’s employees were safe and secure. Though a
great relief in itself, this would provide only momentary respite for Meyer and the firm.
Minutes after the earthquake, an enormous wall of water swept down along the northeast coast of Japan toward
the Fukushima Daiichi nuclear power plant, one of the world’s 15 largest atomic power complexes with 6
nuclear reactors at the water’s edge. Japan is a famously active seismic area and protection from hazards
associated with seismic events had been engineered into the Fukushima plant. Under government regulatory
oversight, Tokyo Electric Power Company Incorporated (TEPCO), the plant’s owner/operator, had constructed
a water barrier to defend against a tsunami resulting from an 8.0-magnitude earthquake. But, the Japanese
earthquake, at 9.0-magnitude, was approximately 30 times more powerful. The Tōhoku earthquake sent a 45-
foot wave crashing over the plant’s 20-foot barrier, flooding a set of backup generators that were programmed
to kick in if the plant’s power supply was interrupted and if several hours of reserve battery power were also
exhausted. The tsunami cut off external power to the plant, and although the reserve batteries worked as
62
designed, they quickly reached their designed time limit, and without the backup generators, the plant’s main
water pumps were soon without power to cool the reactors’ cores and spent fuel rods nearby.23
In the ensuing days, three of the Fukushima plant’s reactor cores melted, three sets of spent fuel rods exploded,
and blasts ripped off two of the reactors’ outer containment structures, resulting in the spewing of significant
amounts of radiation into the air and water that would linger for weeks. The government first ordered
evacuation of all residents within 12 miles of the reactors and then expanded the evacuation zone out to 18
miles. As the crisis continued and seemed to worsen, a voluntary or even mandatory evacuation seemed
conceivable for a much larger region. An evacuation could have been extended to Tokyo, just 140 miles to the
southwest, with a regional concentration of approximately 35 million residents who had so far escaped the
effects of the tsunami.24
Victor Meyer started preparing for the worst-case scenario.
Global Director of Corporate Security and Business Continuity
Deutsche Bank was a full-service provider with offices in more than 70 countries around the world. The largest
financial institution incorporated in Europe, the bank employed more than 100,000 people, and, in 2010,
generated US$43 billion in annual revenue, ranking just behind Citigroup and ahead of HSBC Holdings. The
Tokyo operation served customers in Japan, the world’s third largest economy after the U.S. and the People’s
Republic of China.25 It also served as the franchise hub in northern Asia, managing everything from corporate
credit lines to private banking for wealthy customers throughout the region.
When Meyer joined Deutsche Bank in 2004 as head of Corporate Security and Business Continuity, he was
already familiar with dire threats and large-scale disasters. A graduate of the U.S. Naval Academy, he had
served for more than 15 years as a U.S. Navy SEAL before attending business school. He was responsible for
security in the recovery of the USS Cole in Aden, Yemen, in 2000 and had risen to be chief of Counter-
Terrorism & Contingency Plans for the U.S. Navy for the European and African regions. Just prior to joining
the bank, he had served on a task force to track and seize terrorist finances.
Crisis Management Training and Capabilities
Well before the events of March in Japan, Meyer and his staff had built an extensive crisis management training
program which inculcated response actions into the firm’s DNA, not only for operational events like natural
disasters, but for financial risks as well. They focused on countries where the sovereign risk rating was weakest,
natural disasters most frequent, or headcount largest. The way in which the exercises were incorporated into
the Risk Division’s flagship development program for managing directors, the International Center for Risk
Management, was particularly distinctive.26 Its crisis management exercise component was designed to assess
candidates’ ability to make decisions under pressure and with incomplete information. Candidates participated
in a two-day crisis simulation formulating a response to major crises, such as a pandemic or hurricane passing
in close proximity to a major city. Senior observers from external companies and service providers were added
to enhance realism.
To prioritize delivery of the crisis management exercises by location, the company created a three-tier training
regimen. Tier 1, the most critical, consisted of operations whose annual revenue exceeded €500 million, the
workforce numbered more than 1,000 full-time-equivalent employees, and its country risk rating was high or
63
extreme. Tier 1 operations were required to undergo an annual crisis management exercise and train their most
critical employees in catastrophic risk response. Tier 2 operations were required to conduct the exercise every
other year and train critical employees. Operations in Tier 3, the least critical, did not conduct the simulation
but were required, nonetheless, to provide the training. Even with intensive exercises limited to Tier 1, Meyer
and his staff mounted 26 major crisis management exercises worldwide in 2011, with simulations entailing
responses to crises such as financial collapse, cyber-attack, flu pandemic, fiber optic break, and terrorist
assault.
Meyer built the company’s crisis management training program on several premises that had emerged from
recent company experience: specific plans will be of less use than an ability to develop an impromptu plan;
partnerships are essential for intelligence and resources, but partners will be pulled back by their own biases
and constraints in a crisis; and, while catastrophic risks are increasingly global by virtue of greater degrees of
interconnectedness, local response is also vital.
Though working in banking might appear to be a far more sedate existence than that of combating terrorism,
Meyer’s years at Deutsche Bank had proven anything but routine. The financial meltdown of 2008 through
2009 and a series of major disruptive events, from the Mumbai terror attacks in 2008 to the threatened H1N1
flu pandemic in 2009, had dramatically increased the importance of good crisis management across all risk
disciplines.
Deutsche Bank’s disciplined approach to risk management, built up over many years under the leadership of
Chief Risk Officer Hugo Banziger, had served the bank well, particularly when compared to most peers.27 But
now Meyer faced still another seemingly once-in-a-lifetime event, his third black swan in three years, a
potentially catastrophic event, the real implications of which were just beginning to emerge.28 It appeared
increasingly probable that the events they were witnessing constituted a trifecta in which an earthquake, a
tsunami, and a meltdown would cascade to create a severe disruptive threat to the bank’s operations in Japan.
Preparing for the Worst
Meyer was in Hong Kong on the afternoon of Friday, March 11, when he learned of the terrible events
unfolding in northeast Japan. He watched in horror as CNN repeatedly showed video clips of the tsunami
sweeping inland. Within three hours, he had confirmed that the earthquake and tsunami had not, so far,
destabilized the financial markets or damaged company networks. Furthermore, there were no reported missing
or injured employees. He anticipated modest aftershocks, but as he boarded a flight to London, it appeared
that, overall, there would be minimal impact on the bank and little danger to business as usual for the Monday
opening. For the global bank, it seemed that the events would constitute little more than a local disruption; the
most critical problem was to ensure that all stranded employees reached their homes safely. The bank had thus
far been fortunate.
By the time Meyer landed in London, reports from Japan had turned ominous, and he began to reassess the
enormity of the earthquake’s aftermath. Colleagues in Asia were evaluating the impact in a more
comprehensive way. He had received e-mail messages from them that pointed to potential future problems.
They warned, for example, of rolling blackouts that could disrupt the power supply to the bank’s data centers.
Meyer realized that he could not yet quantify the risks, but he understood intuitively the disruptive potential
of the crisis. Meyer devoted his time in preparing for the possibility that the earthquake’s aftermath could have
a serious longer-term impact on the bank’s staff and business. The damage directly related to the tsunami on
64
the northeast coast was devastating. Reports of thousands of deaths and thousands of missing people with
scenes of destruction from floods and fires raging out of control had been broadcast across the nation. Whole
seaside villages had been swept away. Yet, it did not appear that these effects, though widespread, could
cascade in a way that would disrupt a broader area, including the capital city.
By contrast, the loss of generating capacity from the Fukushima plant was already disrupting Japan’s electrical
grid, with some reports suggesting that there could be some form of meltdown and release of nuclear material.
If radioactive debris spread to Tokyo, the bank could conceivably be confronted with the prospect of a sudden
evacuation of its staff. At the least, it could cause the inability of much of the bank’s staff to access its main
premises and support its most vital operations in Tokyo, such as its main data center. Meyer had no real-time
information on the rapidly worsening condition in the Fukushima plant’s reactors, but the situation seemed to
be, at best, highly uncertain, and he began to compare it to one of the worst disasters in history: What if the
overheating nuclear complex degenerated into a situation similar to the Chernobyl disaster?29 He worked
nonstop to prepare for the worst, and he initiated a daily briefing of Deutsche Bank’s chief executive Josef
Ackermann and chief risk officer Hug Banziger.30
By March 17, six days after the earthquake, the Japanese government had ordered 200,000 people who resided
within 12 miles of the Fukushima plant to evacuate and the U.S. Department of Defense authorized family
members of military personnel who were stationed in Honshu – Japan’s largest island, the mainland where the
damaged power plants were located – to evacuate the entire island. The U.S. Department of Defense also
suspended travel of families of military personnel into Honshu.31
Meyer learned that CNN – which routinely reported on the ground from critical places worldwide – was pulling
out of Tokyo. It was rumored that Lufthansa Airlines flight crews were balking at landing in Tokyo. The
government of France recommended that its nationals leave Tokyo, and as Meyer noted to his colleagues, “The
French know a thing or two about nuclear reactors.” He began to wonder if they knew something he didn’t.
As daily reports from Tokyo offered increasingly apocalyptic scenarios for the nuclear power plants whose
cooling had now been completely compromised, Meyer considered what his immediate priorities should be,
in addition to the people with whom he should communicate as well as the method of communication he should
utilize. Because of the highly uncertain and possibly rapidly deteriorating conditions, Meyer escalated
management response to the highest level – Deutsche Bank’s Management Board. Meyer began briefing the
Board every day at 11 a.m. Eastern Standard Time. In London and Frankfurt, where most of the senior
executives operated, the daily briefing was held at 4 p.m. and 5 p.m. in local time. It was the first incident
since he had joined the bank that Meyer had confronted a disaster serious enough that it required daily crisis
briefings with the Board. Meyer also had to consider whether his team was ready for what was shaping up to
be a high-intensity, multiday crisis. And perhaps the most uncertain factor was whether the nuclear crisis would
spiral out of control, necessitating the rapid relocation of Deutsche Bank’s employees and their families at a
time when greater Tokyo’s some 35 million residents would all be trying to do the same thing. Meyer asked
himself, “Was he ready to order an evacuation, what should be the final trigger, and did he have a realistic,
executable plan?”
The Evacuation Decision
Six concerns dominated Meyer’s report to the Board on the sixth day after the earthquake. First, he paid close
attention to the announcements made by the Japanese government, and, at the moment, the government was
65
not recommending a widespread evacuation. As a supplement, Meyer also monitored what the U.S. Nuclear
Regulatory Commission (NRC) disclosed. It was initially reassuring that Japanese regulators were stressing
business as usual, but as NRC administrators and Japanese reporters began to suggest that the situation was
continuing to deteriorate, the government’s reticence became increasingly concerning.
Second, Meyer monitored activity on the Tokyo Stock Exchange since he was concerned that it might suddenly
be shut down, though authorities were, thus far, silent about this possibility. Third, he considered a scenario
where power and other critical infrastructure in Tokyo would be disrupted, severely affecting the bank’s ability
to operate. Fourth, he tracked the status of the compromised Fukushima plant’s containment vessels and
monitored the weather, as the direction of the winds could potentially send any radioactive release toward
Tokyo. Fifth, he was concerned that the German media would confront the Board about the bank’s actions to
protect its employees in Japan, especially as the crisis appeared to worsen by the hour.
And, sixth, while the German media was likely to focus on the bank’s 38 German nationals in Tokyo, the
Japanese media would be concerned about the bank’s locally hired staff. Meyer believed that the bank’s
expatriates and locals would have to be supported equitably, but also distinctly, particularly because their needs
differed. The bank knew that local staff would be reluctant to leave extended family members behind if it
offered relocation options and the expatriate staff would likely be eager to leave.
After conferring with the bank’s regional management in Tokyo, the Board decided to authorize temporary
relocation of any expatriate families who opted to evacuate. It also authorized the Tokyo office to book hotel
rooms in southern Japan for local employees in the event of a mass evacuation. Meanwhile, as a precaution,
the bank was already moving staff members and their families who were critical to the management of the
firm’s risk positions abroad, dispersing the bank’s Tokyo traders to Singapore, Hong Kong, Mumbai, Sydney,
and London, and its operations staff to Manila.
All of these actions required moving quickly within a network of constraints. Visas were required for many to
work elsewhere, as well as regulatory approval to trade in new jurisdictions. And, bringing emergency supplies
into Japan – food, batteries, sleeping bags, and satellite phones – created their own time-consuming hurdles.
At the time, Japan did not allow the import of food with preservatives or batteries, and customs officials and
other regulators did not ease these rules in the face of the unprecedented conditions.
Some contingency planning proved expensive. Deutsche Bank rented 600 hotel rooms in various cities in
southern Japan. Fukuoka, one of the largest Japanese cities most distant from Tokyo, was the destination
preferred by planners at several companies, and Deutsche Bank found itself competing not only with other
firms but also with a local sport tournament. Even when it offered US$100,000 to one hotel for the option of
reserving all its rooms over the next 20 days, the request was denied. Chartering a Boeing 747 aircraft to fly
employees and their families from Tokyo to Hong Kong would have cost approximately US$1.3 million per
trip – a price that fluctuated daily, and sometimes hourly, as both charter companies and potential buyers
monitored the media coverage.
Loss of Trading
Given the high volume of the bank’s Japan-based sales and trading, Meyer knew that the business flow could
not be interrupted without dire consequences. “If we lose a trading floor for an extended time,” Meyer said,
“we are in a worst-case scenario that requires activation of our secondary trading floor, redeployment of staff,
and dynamic management of open risk positions.” Worldwide, the company executed more than one million
66
transactions per day and cleared more than US$1 trillion in euro/dollar exchanges, the lifeblood of the bank.
A Japanese regulatory authority had deemed Deutsche Bank to be one of the most systemically important
banks in the world. If its Tokyo operations were suspended, it could disrupt sales and trading in Hong Kong,
Seoul, and other capital centers.
Deutsche Bank’s primary trading floor was adjacent to the Imperial Palace in Tokyo, and Meyer reasoned that
it was least likely to suffer blackouts if power supplies fluctuated or were compromised altogether. But other
centers did not enjoy the same protective geography. Meyer concluded, “We may have to move some trading
and operations activities out of Japan,” and he and his staff had to be ready to brief the decision makers in the
various business lines about this contingency.
As Meyer and his colleagues were escalating their crisis management activities, by the second week of the
crisis at the Fukushima plant, they had concluded that they had to raise decision making up to the highest level
in the risk hierarchy. This required making an independent appraisal of whether the disaster at the Fukushima
plant complex could spin further out of control as the core meltdowns deteriorated. Though it was a highly
technical issue, Meyer had become skeptical of appraisals coming from TEPCO. He began to draw upon his
own indicators: Were the crews battling to stabilize the stricken plant on-site or had they been evacuated due
to excessive radiation levels? How low were the water levels in the reactors and over the fuel rods? What were
the forecasts by independent experts? Could a fire in one of the damaged reactors waft radioactive isotopes
into the atmosphere? Which way were winds likely to prevail in the days ahead? When would electrical power
be established to the cooling pumps, and how badly had they been damaged by the tsunami? The unreliability
and variability of reports from external sources forced Meyer and his team to quickly gather primary
information from a network of experts in nuclear safety and management of nuclear accidents and then to draw
their own conclusions on which to base risk management decisions.
Key Risk Indicators
Meyer established a set of key risk indicators (KRIs) which he and his team carefully monitored for any
movement. “When we put these KRIs in place,” he said, “we would start every morning by going through our
intelligence, culling that information, going risk by risk, and talking about each. Is it getting better? Is it getting
worse? Is there no change?” Then, when he briefed the Board later in the day, he relied on his own trend data.
He began the briefing with what had occurred the night before. “This is what happened overnight,” he
explained. “This indicator is trending up, this indicator is trending down. This is why we take this view, this
is what we don’t know, and here are the gaps in our information.”
Information provided by competitors was one source that proved especially valuable. Meyer participated in
regular conference calls with his counterparts at rival banks where he learned that their public declarations
were not always in accord with their private actions. While some banks were publicly asserting that they were
operating as business as usual, Meyer learned that they were covertly evacuating employees out of Tokyo and
had booked hotel rooms in southern Japan.
Because of the bank’s global footprint, Meyer sustained his intelligence gathering around the clock. As night
fell in Japan, the process continued in Singapore, then Frankfurt, and then New York. In the morning, Meyer
received a summary of the night’s developments which he used for his daily briefing. In one of these briefings,
he reported great uncertainty and complexity: the Fukushima plant had suffered explosions resulting in
radiation leakage and the evacuation of nearby residents; the Japanese government had urged companies to
stay while the German government had recommended the opposite.
67
Global Strategy and Local Action
Though the bank was headquartered in Frankfurt, Meyer had decided to devolve as much of the crisis decision
making as possible to management in the local region. He depended heavily on the local CEO and COO, who
held formal roles as crisis managers in the bank’s Crisis Management organization. A chief of security,
Operational Risk/Business Continuity Management for the region, reporting to Meyer, was based in Tokyo.32
Meyer had built a risk team around him in Japan, including a corps of first responders who could render aid
and stage a rescue within one hour if necessary. This local network made sense because local managers were
better positioned to appraise the risks on the ground. It was their own operations that would be affected, as
well as their own health and safety. They had the greatest stake in making optimal decisions. Since this was a
crisis with global consequences for the company, strategic oversight from headquarters was required, but
Meyer ran the tactical-level crisis management from Tokyo.
Despite the evident advantages of a local approach, Meyer was aware that the crisis managers on the scene
would need help and that they would be heavily influenced by the local situation. As fatigue set in, their
decisions would require independent oversight. The Japanese government appeared to be downplaying the
crisis and its direction, suggesting that the power plants were under control while other factors suggested the
contrary. Meyer wondered if local managers were being affected by calls for patriotic stoicism and thus not
accurately assessing the situation. Local managers were also eager to get back to business as usual. Since the
company policy was to apply most of the costs of the crisis to the budgets of the affected local business units,
a less severe crisis would entail fewer costs for these units. Accordingly, Meyer warned the local risk managers,
“not to go native, succumb to groupthink, or give in to stress and fatigue.”
The German government recommended that companies evacuate their German staff from Tokyo, and the
German reporters asked the chief risk officer and regional managers whether they would do so. Meyer and his
team decided to respond in a limited way: three expatriate German managers were evacuated; non-German
expatriate staff were given the option to move their families out of Japan; and 30 foreign employees who had
been in Japan on business travel were extricated. In all, 100 bank employees were moved offshore.
For the bank employees who remained in the country, all Japanese nationals, Meyer considered the
contingencies: If a mass evacuation of Tokyo were desirable, or even required, could the company obtain the
aircraft, the supplies, and the hotel rooms that would be required at a time when millions of others might be
vying for the same resources?
Epilogue
By the end of March, TEPCO was gradually gaining control over the leakage of the Fukushima plant’s reactors,
and though modest levels of radiation continued to spread across the region and into the food chain, it became
evident to Meyer that a mass evacuation and business closure in Tokyo was unlikely. The company had
suffered from rolling blackouts at some of its facilities and fear-fueled distraction had been widespread among
both employees and customers. Meyer estimated that productivity at its nadir was down to about one-third of
what was considered normal, but was now climbing back to pre-crisis levels.
Meyer suspended the daily briefings with the Board, and the company dispatched a Board member to visit the
Japanese operations, signifying that inbound traffic was once again safe enough to authorize. “We’re
committed to the franchise,” Meyer paraphrased the Board’s message to the Tokyo staff. “This has been a
traumatic event, but it’s time to look forward. The best way to put this behind us is to get out there and generate
more business.”
68
Crisis Preparedness
There was much to be learned from these events. Not even a week into the unfolding calamity, Meyer began
taking mental notes for future reference. The Risk Division’s planning for catastrophe had proven effective for
managing the unexpected. Meyer’s daily briefings with the Board had proved to be invaluable, mainly for the
two-way exchange of information, though far less useful for directives from the Board or requests from
himself.
After these events, Meyer knew he had to more aggressively prepare for the worst-case scenario in the future.
“If anybody had told us to anticipate the collapse of the [World Trade Center’s] Twin Towers or a meltdown
of four reactors,” he said, “I would not have worried about it before, but now I do.” He had no catastrophic
plans to execute. If he had wanted to prepare blueprints before these events, Meyer felt that his supervisors
would have responded with, in Meyer’s words, “You’re out of your mind.” After the events of March 2011 in
Japan, Meyer knew that he would have to prepare for the most extreme crises.
He also better appreciated how difficult it could be to obtain reliable and actionable information in the middle
of a crisis. Much of the essential real-time technical data on the evolving conditions at the Fukushima plant
was either not released to the public or was altered to appear less disastrous. Securing the kind of information
that was vital for the biggest decision that he faced – whether to evacuate all bank employees and their families
from Tokyo – was difficult, and the information he had obtained depended on preexisting relationships. The
media had overstated the risks and provoked anxieties while the information released by the government
downplayed the risks. Both elicited distrust. Meyer learned that it was critical for managers to provide informed
and accurate appraisals of their own. And, anticipating and responding to employees’ fears and concerns were
an important part of risk management.
Meyer also knew that, for future crisis leadership, he had to factor that Deutsche Bank, like most financial
institutions, was sensitive to market and regulatory perceptions and conscious of the interests and concerns of
policy makers. Taking actions that suggested that the government of Japan was being less than forthcoming in
its reporting on the crisis could only be conducted covertly.
A final lesson of the Fukushima plant experience for Meyer was the importance of global dependency; though
the bank was headquartered in Germany, an earthquake on the other side of the globe had sent Meyer, his
team, and senior management into crisis mode for more than one month. He knew that intercontinental
dependency was likely to become even more prominent in the future. The bank’s footprint would be more
extended, including more offshore staff and satellite operations that would be more vulnerable to disruption.
Even before the Japanese crisis of March 2011, Deutsche Bank had been moving toward greater catastrophic
risk preparedness. In the wake of the Indian Ocean tsunami of 2004, the 2010 Haiti and Chile earthquakes, and
the 2010 Pakistan floods, the company, in the words of an internal planning document, “became convinced of
the need to better clarify the bank’s response to catastrophic events in locations with a presence and/or
travelers.” The agenda, the company stated, was to, “better define the bank’s legal, reputational, operational,
and ethical responsibilities during a large-scale catastrophic event.” This meant emphasizing the firm’s
commitment to each of its country operations; constructing a command and control system all the way from
front-line managers to Board members; placing a priority on the security of employees; ensuring uninterrupted
clearing, settlement, and payment services; adjusting liquidity; and creating a global coordination group that
had the ability to make well-informed decisions during a crisis.
69
Looking Ahead for Leadership during the Next Crisis
The Tōhoku trifecta served as a real-life stress test of the catastrophic risk management system that Meyer and
his staff had built. Like all such trials, it reinforced current practices, such as training simulations for extreme
risks, and defined new ones, such as creating a means for better intelligence gathering during a crisis. It also
reinforced Meyer’s long-standing emphasis on strategic planning and tactical flexibility that allowed him to,
as he stated, “make decisions very, very quickly.”
While catastrophic risk management at Deutsche Bank was arguably stronger for having been put to a real
test, the tsunami’s calamitous breaching of the barriers at the Fukushima plant complex forced Meyer to look
back on the past month of crisis management and wonder what he could have done differently with the benefit
of hindsight: Had he sufficiently engaged the CEO and the Board? What else should he have put in place to
react rationally to the evolving disaster? Did the company have the mindset, the leadership, and the governance
in place to successfully handle the next low-probability, high-impact event? What were the most important
leadership and governance lessons from his experience during the crisis in Japan?
In answer to the last question – at the center of this study – we can extract several lessons from Deutsche
Bank’s experience in the wake of the earthquake and tsunami. They will certainly not be of universal value,
but we believe that they can usefully guide the leadership and governance of other large companies. Box A1
provides an extrapolated summary of the emergent leadership and governance principles from both Deutsche
Bank and Morgan Stanley.
70
Box A1. Leadership and Governance Principles from Deutsche Bank in Japan
Leadership
L1.1. Prepare for the worst-case scenario, as Victor Meyer did in the wake of initial indications that the
Fukushima meltdown could lead to a mass evacuation of the Tokyo region.
L1.2. Build a comprehensive crisis management training program well before a disaster strikes – as seen in
at Deutsche Bank’s International Center for Risk Management – that includes general managers, hands-on
simulations, and an appreciation for what can unexpectedly go wrong in management during a crisis, such as
tactical responses and biased decisions.
L1.3. Think deliberatively and act strategically, as evident in the bank’s cautious approach to evacuating
Tokyo when it appreciated the enduring damage that a precipitous exit could cause in its long-term relations
with the national government.
L1.4. Gather detailed real-time data on a prospective catastrophe from independent and reliable sources, as
Deutsche Bank did in asking nuclear experts and competitor banks for their reading on the power-plant
meltdown.
L1.5. Prepare for worst-case scenarios, and when it appeared that a Tokyo evacuation may be necessary, the
bank began dispersing key staff members abroad and arranged for hotel rooms in southern Japan, charter
flights to secure destinations, and possible disruptions in trading.
L1.6. Delegate decisions to local operations and first responders most affected by the crisis, but work
centrally to prevent local decisions biases that can stem from fatigue, stoicism, and group think, as seen in
Victor Meyer’s work with the Tokyo office.
L1.7. Create a company capacity for fast decisions that are both strategic in concept and tactically flexible,
as Victor Meyer had appreciated were essential from both this and prior experiences.
L1.8. Use each crisis moment to strengthen the next encounter, encoding past experience into active risk
management going forward. When Deutsche Bank’s New York operations were battered by Hurricane
Sandy in 2011, the principles in this box, now strengthened by their more salient understanding from the
Japanese experience, informed the bank’s response to Sandy, just as Morgan Stanley had learned from the
1993 World Trade Center bombing.
Governance
G1. When it appears that a mild crisis could escalate into a catastrophic event, take the issues and decisions
up to top management and even the board of directors – as Victor Meyer did in the wake of CNN’s
withdrawal from Tokyo and flight crews’ unwillingness to land in Tokyo.
G2. Define, monitor, and repeatedly communicate key risk indicators to executives and directors, as
Deutsche Bank’s management did as the problems with Fukushima escalated.
G3. Disengage executives and directors at the crisis subsides, as seen in Victor Meyer’s de-escalation of
their involvement once TEPCO brought the nuclear crisis under better control.
G4. Develop metrics of global interdependency that can alert risk managers, company executives, and board
directors about local and regional developments that can place the firm’s operations at risk, as seen in
Deutsche Bank before and during the Japanese crisis.
G5. Institute a crisis command-and-control system from front-line employees to the board of directors for
reacting to catastrophic risks before they emerge, as Deutsche Bank had come to stress.
71
CASE A2. Disaster Salience at a Major Retailer
In completing our interviews with managers, executives, and directors of companies included in the Standard
and Poor’s 500 – America’s 500 largest firms by market capital – we have identified a number of firms that
had adopted a range of practices that we believe will enhance a readiness for catastrophic risks. Many of their
practices are evident in what we have already seen at Deutsche Bank, but they are not identical, and by looking
at these companies, we see still additional leadership and governance principles in action. We have also
identified several firms whose practices are more limited. To appreciate the difference, we first offer a brief
account of one of the firms with an extensive set of catastrophic practices – and then by contrast a firm with
less risk readiness.
The first enterprise is a major retailer with 37,000 employees and 2012 revenue of more than $8 billion.
Founded more than 30 years ago, it operates more than 5,000 stores, almost entirely in the U.S. The company
had not faced a catastrophic threat of the scale that confronted Deutsche Bank in Japan, but it has encountered
a number of significant threats, topped by the impact of Hurricane Katina on a number of outlets in the New
Orleans region. The loss was less than $15 million altogether, little more than rounding error for an $8-billion
firm, but the storm affected so many stores that a number of senior managers became exercised about the losses
and more committed to building resilience before the next super-storm.
Though still without a personally-experienced catastrophic experience to learn from, the company had
nonetheless created a host of risk defenses, including:
Insertion of risk recognition and mitigation into all management functions and levels.
Continuous refinement of the risk-protection devices from on-going experience.
Pinpointing responsibility for risk in the company the audit function and the board’s audit committee
– but as the same time holding all managers responsible for risk in their own arena.
Periodic reporting of top company risks to the board of directors.
As described by a senior manager at the company, “from our perspective everybody in this corporation has
responsibility for risk mitigation – identifying and mitigating that risk.” That’s a “broad statement,” said the
executive, “but it’s really true here.” The internal audit committee took the lead, compiling data on the 50
greatest risks to the company – some major, most minor – and reporting the ten gravest to the board every
quarter. But management of the risks was not confined to that office. The firm mandated hazard identification
and mitigation all the way down from divisional vice presidents down to front-line employees.
The retailer insisted that store managers play an inductive role in foreseeing emergent threats. A company
task force annually worked to identify ways of cutting costs, for example, and it deemed major risks a
significant source of loss. The task force reached down to store managers for what they saw, and then
aggregated their front-line experiences up the chain. The executive characterized the process as “bottoms up,”
with every front-line unit required to identify its risks and ways of reducing them. The company initiated the
annual “bubble-up process” in the fall and brought it to a head by February.
By way of one example, the company learned that a competitor had been hit by significant legal losses from
its misallocation and misuse of vendor funds. Aware that the same could happen in the decentralized
operations of this company, internal audit instituted a set of procedures to guard against what it had not
previously anticipated but now feared. The auditors would likely not have seen this from their functional
72
perch, but lower levels in marketing and merchandising brought it up to their attention. In response, the
company created a training program to ensure that the risks here did not become material.
By way of a second example, mid-level employees came to worry about a loss of the company’s information
backbone. The primary location for its hardware happened to be in an earthquake-prone region, and
management as a result set up an expensive backup system in case the main system was lost. Human factors
mattered as much as their machines. To avoid disruption of the information system failed, the firm instituted
an incident command system in which responsible parties were pre-identified and solution protocols pre-
approved.
Besides extending down to the front-lines, the audit function reached upward as well, with staff annually
interviewing at least the top three layers of senior management about what they saw as the firm’s greatest
threats. The company then targeted two or three of the year’s greatest hazards for reduction. To build risk
into woodwork, the company also required that every division’s annual operating plan address the major risks
that it faced.
The directors jumped into the issue matrix as well. The board for instance, became worried about the firm’s
aging inventory, potentially tying up or destroying its capital as customers bypassed older products for newer
items.
The governing board explicitly came to make management responsible for executing its risk mandates. Board
materials came to carry a summary of risk-reduction actions that management had taken as of the prior meeting,
and new actions since then. In the summary words of one executive who worked with the board, directors are
“very active and preemptive in everything,” constantly raising “what-if” scenarios with the executive team.
At one board meeting, for instance, the directors asked about terrorist threats to the company’s distribution
centers whose disruption could result in huge losses to the company. If one of the company’s half-dozen
shipping centers were closed by a bomb or fire, its just-in-time resupply systems could force a closing of
dozens of stores, the lifeblood of the company. In response to the board’s anxiety, management created a
protocol for creation of a temporary distribution center if need be. And it took the more tangible step of
building still another distribution center, not yet dictated by business needs but wise to have for buffering risk.
The new center would bring some savings in logistics, but it was also seen, reported the executive, as an
“offset” to “what we felt was a material risk if something were to happen.”
Directors pressed executives both to better understand the likelihood and target of terrorist threats and what
the company should be doing to prevent such threats. They have been “very preemptive about making sure
that [executives] understand that risk,” reported the executive. They are “not here just to collect a board of
directors check. They really want to perform a really good corporate governance role for us.”
As the center of the directors and executives’ engagement – and wiring that center together – were the
company’s top executives. Without their consistent insistence that catastrophic risk be center stage, it would
have been. At the very top, reported the company’s former chief executive, “getting it on the agenda has to
come from a leader, and it either has to come from a concerned board member or a CEO or somebody at that
level.” A lower-level manager, as senior as she or he might be in the firm, could never garner the attention
required. “Unless it’s inherently believed-in,” warned the ex-CEO, by “the very top, as a CFO, the CEO, or a
couple of key board members, it will be ignored.” It must be “a never-ending commitment” by the top ranks.
One reason for the importance of that senior commitment was the ceaseless daily demand that all managers
feel to reach quarterly goals and deliver annual results. That goes with the territory, but this company
73
recognized that it could also push the cat-risk agenda aside. One executive warned, as a result, “the fact that
you get so focused on day-to-day business” meant that “you find a year or a year-and-a-half goes by and you
haven’t had the conversation about risks.” You “tend to be involved in your sales, the trends, and your expense
trends, and your profitability trends, and the short-term, and you get so wrapped up in that, that frankly, the
issue of catastrophic risks or risks in general, business risks, does not come up enough at the board level” or
even the business level without high-level prodding to make it evident.
By way of one example of visibility, mindful of the extra risks that expansion in foreign markets can bring,
the directors and executives built on their one foray outside the U.S. by requiring extremely high hurdles for
entering still another off-shore market. On-shore stores achieved close to a 10-percent average rate of return,
but the company would require investments in its newest foreign market to deliver a 15-percent rate of return.
The firm, affirmed the executive “is a very risk adverse company that goes extremely slowly and wants to
prove things first.”
Box A2 provides an extrapolated summary of the emergent leadership and governance principles from both
this large retail company.
Box A2. Leadership and Governance Principles from a Large Retailer
Leadership
L2.1. Insert risk recognition and mitigation into all management functions and levels.
L2.2. Refine risk-protection devices from on-going experience.
L2.3. Pinpoint responsibility for catastrophic risk but hold all managers responsible for risk in their own
arena.
L2.4. Ask both senior managers and front-line employees to identify emergent risks through direct
interviews.
L2.5. Establish an incident command system that fixes responsible parties and response protocols before
disaster strikes.
L2.6. Institutionalize risk concern by requiring operating divisions to annual identify their gravest threats.
L2.7. Top management – including the chief executive and other officers – force a focus on low-probability
but high-impact hazards to overcome management focus on quarterly and annual business results.
Governance
G2.1. Recurrently report gravest risks to the company to the board – and what management has done to
reduce those risks since the prior board meeting.
G2.2. Directors make management responsible for executing the board’s risk mandates.
G2.3. Directors take an active and preemptive role in referencing catastrophic risk management.
74
CASE A3. Not All Firms Have Developed the Same Risk Management Capability – The Case
of a Media Enterprise
Company vary greatly in not only the methods they use for catastrophic-risk management but also in the
extensiveness of their methods. We have learned much from Deutsche Bank, the major retailer, and host of
other major companies in our study at the upper end of the extensiveness spectrum. Yet can also be equally
instructive to study companies at the lower end. What is arguably missing in their case can suggest what
should be present in the best case.
Our second enterprise lacks many of the features in boxes 1 and 2 above, despite its more than 200-year history.
With more than 15,000 employees, $5 billion in annual revenue, it had become one of America’s premier
media properties, but it had incorporated few of the leadership or governance principles so evident at the other
enterprises.
An executive reported that the company had faced no catastrophic event in its very long history, though like
so many other firms in our sample, the cataclysm of 9/11 had deeply affected its operations. The firm prepared
to anticipate the prospect of further terrorist attacks, instituting emergency evacuation protocols, and
stockpiling emergency kits for those who might be stranded or obligated to remain on duty.
Only recently had the company explicitly turned to enterprise risk management, focusing mainly on business
continuity, and even then it remained little concerned with extreme risks. It had neither assigned nor hired
individuals with risk management in their job description or personal expertise. In fact, the company had come
into it sideways, building a disaster-recovery capacity for its information technology – no surprise given IT’s
centrality to an essentially information company – and then working to migrate that capacity into other parts
of the enterprise.
Still, the firm had finally hired a full-time manager to consolidate its business-continuity planning. The new
manager ran a risk-management simulation with top executives and set about identifying where the greatest
management gaps remained. But changes were still coming in “bite-size chunks,” in the words of the newly-
appointed manager, one modest step at a time. With other companies having focused on catastrophic risks for
years, producing complex multi-faceted methods, this firm stood in stark contrast – thought to seek to have
many of the rudiments in place within several years.
Even then, it would be uphill, in part because of the absence of any top-level support for the initiative that was
so evident at Deutsche Bank and the major retailer. Leadership principle L2.7 captured what was missing
here: “Top management – including the chief executive and other officers – force a focus on low-probability
but high-impact hazards to overcome management focus on quarterly and annual business results.” The media-
company’s manager found himself campaigning for what should have been coming from the top echelon.
“We need this,” he pressed, yet he found that many were still wondering what exactly “this” was. The manager
argued for acceptance of more comprehensive practices but also found he was carrying the flame largely on
his own.
Given the absence of any top-down direction, it is unsurprising that overarching responsibility for risk had not
been assigned or delegated. This stands in stark contrast to the L2.3 directive for pinpointing responsibility
75
and holding all managers responsible for risk in their own arena. The risk manager and top executive occupied
offices in the same building, but otherwise found little common ground. One person had been tasked with
continuity and risk issues, and his only leverage came through volunteers.
Little was taken up to the governing board, nor did much come down from the directors. The disconnect
proved disconcerting and even disheartening. “You cannot have a business continuity plan unless it's driven
from the top,” the risk manager warned. “I can't drive this at my level. You have to drive [business continuity]
from the very top: Say it’s important, mean it, and demonstrate that it's important by doing the testing, doing
the communication, and making sure that the company knows this is an important part of our risk
management.” You “have to have buy-in at the very top,” the manager concluded, “or it doesn’t work.” He
had previously worked at an organization that had gone under during the financial crisis that came with
Lehman’s failure, and he noted that the absence of top management commitment to risk management had
proven fatal there. “You did a piece of paper” outlining big risks facing that company, he recalled, but you
“struck it up on your cabinet and nobody looked at it.”
Box A3 draws on this experience to identify several additional leadership and governance principles, only
these have been derived from what the company had largely not done. And the company’s fate would prove
un-providential for a host of reasons unrelated to extreme risk management but possibly a product of not having
appreciated the growing hazards of the digital era. After struggling with declining income for a number of
years because of the rise of the Internet, the owners sold a major portion of the company to another firm not
long after our interview with the company was concluded.
Box A3. Leadership and Governance Principles from a Media Enterprise
Leadership
L3.1. Build a dedicated staff for facilitating the identification of major hazards from throughout the firm and
construct a company-wide capacity to surmount them.
L3.2. Institute an extensive set of extreme-risk practices.
L3.3. Secure the backing of top management, not just that of those dedicated to business continuity, in the
face of dis-continuity threats.
Governance
G3.1. Prompt the board chair or lead director to move the directors into active engagement with and
preemptive guidance of high-risk issues at the company.
76
NOTES 1 “Leadership on 9/11: Morgan Stanley’s Challenge,” http://hbswk.hbs.edu/archive/2690.html; James B. Stewart, Heart of a Soldier;
Amanda Ripley, Unthinkable: Who Survives When Disaster Strikes—and Why.
2 Michael Useem, “Developing Leadership to Avert and Mitigate Disasters,” in Learning from Catastrophes: Strategies for Reaction
and Response, Howard Kunreuther and Michael Useem, eds., Wharton Publishing-Pearson, 2010.
3 See, for instance, Cynthia D. McCauley, D. Scott DeRue, Paul R. Yost , and Sylvester Taylor, Experience-Driven Leader
Development: Models, Tools, Best Practices, and Advice for On-the-Job Development, Jossey-Bass, 2013.
4 Michael Useem, “John Chambers: Whether Up or Down, Always Innovating,” U.S. News and World Report, November, 2009.
5 See for instance, Erwann Michel-Kerjan and Paul Slovic. The Irrational Economist. Making Decisions in a Dangerous World (2010;
Public Affairs); Howard Kunreuther and Mike Useem. Learning from Catastrophes (2011; Wharton School Publishing-Pearson).
6 See Howard Kunreuther and Erwann Michel-Kerjan. At War With the Weather. Managing Large-Scale Risks in A New Era of
Catastrophes (2011; MIT Press).
7 PwC 2013 CEO survey.
8 Daniel Kahneman. Thinking Fast and Slow (2011; Farrar, Straus and Giroux).
9 Samuelson, William and Richard Zeckhauser (1988). Status quo bias in decision making. Journal of Risk and Uncertainty, 1.1, 7-59.
10 Amos Tversky and Daniel. Kahneman (1973). Availability: A heuristic for judging frequency and probability. Cognitive Psychology 5, 207–232.
11 James March, L.S. Sproull, and M.T. Tamuz (1991), "Learning from Samples of One or Fewer," Organization Science, 2, 1-13.
12 William Starbuck and F. J. Milliken (1988), “Challenger: Fine Tuning the Odds Until Something Breaks,” Journal of Management
Studies, 24, 319-340.
13 Paul J. DiMaggio and Walter W. Powell (1983), "The Iron Cage Revisited: Institutional Isomorphism and Collective Rationality in
Organizational Fields," American Sociological Review, 48, pp. 117-160.
14 Barbara Levitt and James March (1988), “Organizational Learning,” American Review of Sociology, 14, 319-340.
15 Howard Kunreuther and Edward Bowman (1997) “A Dynamic Model Of Organizational Decision Making: Chemco Revisited Six
Years After Bhopal” Organization Science 8 (4): 404–413.
16 World Economic Forum. Global Risk Report 2012.
17 Mirakhur et al. (2011) originally developed a list of 29 categories based on the Item 1A filings for a random sample of 122 firms,
resulting in an initial list of 116, relatively specific, categories (e.g. supplier concentration, supplier promotions, etc.). We reduced
this to 21 risk factors.
18 The reason we used daily stock return rates instead of the actual raw stock prices is that stock splits caused too much disruption in
our model. Our model had no way of recognizing whether a huge drop in the stock price (e.g., $60 to $30) was because of an actual
catastrophic event or a stock split. By using the daily stock return rates – which eliminated the stock split problem, we were able to
create two models, a 10-day model and the regular model (both of them are explained in later sections).
19 Paul Slovic, Baruch Fischhoff, and Sarah Lichtenstein, S. (1978) “Accident Probabilities and Seat Belt Usage: A Psychological
Perspective” Accident Analysis and Prevention 10: 281:285.
20 Neil Weinstein, Kolb, K., and Goldstein, B. (1996) “Using Time intervals Between Expected Events to Communicate Risk
Magnitudes” Risk Analysis 16:305-308.
21 Eric Johnson, John Hershey, Jacqueline Meszaros and Howard Kunreuther (1992) “Framing, probability distortions and insurance
decisions” Journal of Risk and Uncertainty 7:35-51.
22 This section draws on Michael Useem and Herman (Dutch) B. Leonard Jr., Catastrophic Risk Management at Deutsche Bank,
Wharton School, University of Pennsylvania, 2012.
23 For information on nuclear reactor fuel rods, see Joe Palca, National Public Radio, “Explainer: What are Spent Fuel Rods?” March 15, 2011.
24 Population Census, “Preliminary Counts of the 2010 Population Census of Japan released,” May 11, 2011.
25 The World Bank Group, World Development Indicators, 2012.
26 Berlin Partner GmbH, “Berlin Business News,” March 2011.
27 Deutsche Bank AG, “Management,” 2012.
28 Nassim Nicholas Taleb, The Black Swan: The Impact of the Highly Improbable, Random House, 2010.
29 The accident that occurred on April 26, 1986 at the Chernobyl Nuclear Power Plant in Ukrainian SSR included an explosion and fire
that released large quantities of radioactive contamination that spread over western USSR and Europe.
30 Deutsche Bank AG, “Management,” 2012.
31 Chris Lawrence, Cable News Network, “Pentagon Clears Exit of Some Military Family Members from Japan,” March 17, 2011.
32 Deutsche Bank AG, “Deutsche Bank Careers: Operational Risk/Business Continuity Management Framework Specialist (m/f)
Frankfurt am Main,” January 5, 2012.
77
Study Directors
Howard Kunreuther is James G. Dinan Professor of Decision Sciences and Public Policy, and
Co-Director, Center for Risk Management and Decision Processes, Wharton School, University of
Pennsylvania, USA. He has a longstanding interest in ways that society can better manage low-probability,
high-consequence events related to technological and natural hazards. He is a Coordinating Lead Author on
the Intergovernmental Panel on Climate Change (AR5), a member of the OECD’s High Level Advisory Board
on Financial Management of Large-Scale Catastrophes, a fellow of the American Association for the
Advancement of Science (AAAS), and distinguished fellow of the Society for Risk Analysis, receiving the
Society’s Distinguished Achievement Award in 2001. He is the recipient of the Elizur Wright Award for the
publication that makes the most significant contribution to the literature of insurance.
See https://opimweb.wharton.upenn.edu/profile/37.
Erwann O. Michel-Kerjan is Managing Director of the Wharton School's Center for Risk
Management and Decision Processes, and teaches in Wharton School's graduate and executive programs. He
is also Chairman of the OECD Secretary-General Board on Financial Management of Catastrophes, which
advises its thirty-four OECD member countries on these issues. Dr. Michel-Kerjan was named a Young Global
Leader (YGL) by the World Economic Forum (Davos), an honor bestowed to recognize and acknowledge the
most extraordinary leaders of the world under the age of 40. He has worked extensively on improving corporate
strategy to extreme events and how to strengthen resilience. He has testified before the U.S. Congress on these
issues, recently addressed the G20 and currently advises several corporations, foundations and heads of state.
Dr. Michel-Kerjan is the author of several acclaimed books, including, most recently, The Irrational
Economist (PublicAffairs Books, with P. Slovic) and At War with the Weather (MIT Press, with H. Kunreuther)
which received the prestigious Kulp-Wright award for the most influential book on risk management. He is a
regular contributor in the media and has given over 150 public speeches. He studied at Ecole Polytechnique
(France), McGill and Harvard. See http://opim.wharton.upenn.edu/risk/faculty/michel-kerjan.htm.
Michael Useem is William and Jaclyn Egan Professor of Management and Director of the Center
for Leadership and Change Management at the Wharton School of the University of Pennsylvania, USA. His
university teaching includes MBA and executive-MBA courses on leadership and change, and he offers
programs on leadership, governance, and decision making for managers in the United States, Asia, Europe,
and Latin America. He also works on leadership development and governance with many companies and
organizations in the private, public, and non-profit sectors. He is the author of The Leadership Moment,
Investor Capitalism, The Go Point, and The Leader’s Checklist. He is also co-author and co-editor and co-
editor with Howard Kunreuther of Learning from Catastrophes, and co-author of The India Way and Boards
That Lead. See http://leadership.wharton.upenn.edu/l_change/Useem_Bíosketch.shtml.
78
For three decades, the Wharton Risk Management and Decision Processes Center
has been at the forefront of basic and applied research to promote effective corporate
and public policies for low-probability events with potentially catastrophic consequences,
integrating risk assessment and risk perception with risk management strategies under
various regulatory and market conditions. Providing expertise and a neutral environment
for discussion, the Center is also concerned with training decision makers and
promoting a dialogue among industry, government, interest groups and academics
through its research, publications and forums.
Wharton’s Center for Leadership and Change Management stimulates basic
research and practical application in the area of leadership and change, and fosters an
understanding of how to develop organizational leadership. The intensifying competition
for resources and demand for high performance are pressing firms to become more
flexible, more results-focused, and more fast-acting. Companies are finding that such
initiatives require able leadership; the challenge is to help build effective leadership
both in the next generation of managers and throughout the organization today. The
Center Leadership and Change Management was created to support these efforts.
The joint project, Effective Corporate Leadership and Governance Practices in Catastrophic Risk
Management examines the practices of large, publicly-traded companies to determine effective
strategies for detecting, preparing for and coping with catastrophic events.
Wharton Risk Management and Decision Processes Center www.wharton.upenn.edu/riskcenter
Wharton Center for Leadership and Change Management
http://wlp.wharton.upenn.edu
3730 Walnut Street, Jon M. Huntsman Hall Wharton School, University of Pennsylvania
Philadelphia, PA 19104