big sculpture of a question mark
PHOTO: Martin Pettitt

People talk about integrating risk management into strategy-setting and objective-setting, but I have yet to see any good guidance (and that includes from COSO) on the topic.

But should we be talking about risk and strategies (or objectives) or risk and purpose — or even be using the four-letter word that starts with R?

Risk Is Nothing But a 4-Letter Word

If you have been following my blog for a while, you would have seen multiple and often lengthy comments by Roger Estall and Grant Purdy. They are the authors of "Deciding: A Guide to Even Better Decision Making," a book I recommend.

Roger and Grant describe their book on Amazon: "This book is intended to help decision-makers of all types make even better decisions. The central thesis is that whether ‘Deciders’ realize it or not, all decisions are made using what the authors describe as ‘the universal method of decision-making.’ The adequacy of each decision therefore depends on how skillfully the method is applied, whether Deciders achieve ‘sufficient certainty’ about the outcomes that will flow from the decision and the contribution made by those outcomes to the organization’s Purpose."

Note their focus on Purpose and “sufficient certainty.”

They have also, in the book and in their comments on my posts, trashed the word risk and the idea that it is something to be managed.

The idea that we should avoid the work ‘risk’ is something I suggested earlier in "Risk Management in Plain English: A Guide for Executives: Enabling Success through Intelligent and Informed Risk-Taking." My introduction explains why success management more accurately explains our efforts: "Why is risk management so often a review of what might go wrong? Norman Marks suggests that this 'doom management' approach should be replaced with 'success management.' What might happen that could affect our success, both the good and bad? Is that OK? Now let's do something about it."

I suggest we use plain English instead of risk practitioner technobabble, because the four-letter word risk evokes a negative knee-jerk reaction from executives. They see risk management as something that prevents them from doing their job, a compliance exercise that makes little if any contribution to making quality business decisions and achieving their objectives. In addition, it is what I describe as “doom management” when we should be trying to make the informed and intelligent decisions that lead to taking the right risks for success.

The plain English way to talk about risk and opportunities, I suggest, is to talk about “what might happen.” Grant and Roger prefer to just forget about either the word or the concept it is supposed to represent.

Related Article: Stop Managing and Start Taking Risks

The Difference Between Purpose and Objectives

While I talk about “an acceptable likelihood of achieving enterprise objectives,” my friend Grant and his co-author Roger prefer to talk about “sufficient certainty about the outcomes that will flow from the decision and the contribution made by those outcomes to the organisation’s Purpose”.

We can quibble about the difference between “acceptable likelihood” and “sufficient certainty”. But I believe (and Roger or Grant will correct me if I am wrong) that these are essentially the same idea.

But there is a clear difference between purpose and objectives.

Here are some excerpts from "Risk Management for Success," including my attempt to help people integrate the consideration of ‘what might happen’ into business processes, from setting the direction of the organization to executing on it. My first drafts did not include a discussion of a Purpose statement, but Grant persuaded me that it was important to consider it; there is clearly a growing appreciation by leaders of its value.

It’s fair to say that pretty much every organization has a formal Mission or similar statement. A 2020 McKinsey Quarterly article, "Purpose: Shifting From Why to How," stated:

  • Only 7% of Fortune 500 CEOs believe their companies should mainly focus on making profits and not be distracted by social goals.
  • There is a growing recognition by CEOs and boards of the need to address expectations from the society within which they operate.
  • In an ideal world, that Mission or Purpose statement drives the longer term plans and goals for the entire organization.

McKinsey surveyed 1,000 people in US companies and found that:

  • 82% said purpose was important.
  • 62% said their organization had a purpose statement.
  • 42% believe the purpose statement had impact.

Related Article: Build Organizational Purpose Into Your Talent Systems

How Do Purpose Statements Relate to Decision Making?

However, in the majority of cases it is aspirational and only sets out principles that may or may not inform how the organization operates from period to period. It may or not affect how decisions are made on the ground.

For example, here is the Purpose statement from BHP Billiton, an international natural resources company based in Melbourne, Australia.

"We are BHP, a leading global resources company. Our purpose is to bring people and resources together to build a better world."

Growing Importance of Purpose Statements

I am sure many CEOs would agree that a Purpose statement is important and, in some way, guides the organization’s strategy and actions. But it doesn’t guide every tactical decision.

I can certainly see that such a statement is very important in nonprofit organizations.

In any organization, it may influence strategic planning and decisions, such as in deciding on strategic acquisitions, and through them the objectives that decisions are intended to achieve.

Bain & Co. states that: "By redefining their purpose and focusing on it, companies are better equipped to thrive in an ever-changing world. Consumer products company Mars has recently formulated its purpose as: 'The world we want tomorrow starts with how we do business today.' And this philosophy is reflected throughout the organization in many ways, including its $1 billion investment toward becoming sustainable within a generation. Such focus can help a company to attract key talent, engender consumer trust and gain access to important resources such as sustainable supply chains."

How does Mars’ Purpose statement of “The world we want tomorrow starts with how we do business today” affect decisions such as whether to delay the implementation of a new computer system, where to set prices for a new service, or how much to invest in compliance or cyber?

In a 2016 study, PwC surveyed US business leaders. While 79% said that “purpose is central to business success,” only 34% thought that it was consistently used “as a guidepost for decision-making.”

That percentage may be growing, especially if CEOs recognize that they need Purpose or Mission statements that are more meaningful to decision-makers down and across the extended enterprise.

Using Purpose as a Guidepost

For Mission or Purpose to be an effective guidepost, it has to be translated into objectives that the organization, its management and staff work to achieve each period.

The Mission or Purpose statement is something that should be considered in assessing risk management. Some organizations will see it as a higher priority than others. Where it connects with the running of the organization is that each period’s objectives and strategies should be consistent with and advance its purpose or mission.

Where Risk Management Fits In

How does risk management figure in setting the Mission or Purpose?

Understanding what might happen could but is unlikely to affect the setting of Mission or Purpose statements such as those above. However, it is an essential ingredient in setting longer-term strategic plans and then the objectives for each period so that the Mission can be achieved.

I see it as an optional element in assessing decision-making and risk management.

Where Objectives Come In 

Management and the board agree on objectives and compensate individuals based on performance against those objectives.

The objectives have to be aligned with the Mission and the Strategic Plan. In practice, enterprise objectives are proposed by executive management and reviewed (often approved) by the board.

While in an ideal world everybody has a long-range view and makes decisions that are right for the organization in the long-term, in practice most are driven by short-term goals and objectives — and their compensation.

Will Purpose Become Yet Another Aspirational Statement?

Grant pointed me to the McKinsey piece I quoted in the book. More recently, McKinsey has repeated its advice. In January, the firm published "Organizing for the Future: 9 Keys to Becoming a Future-Ready Company," which states: "Top-performing organizations know that purpose is both a differentiating factor and a must-have. A strongly held sense of corporate purpose is a company’s unique affirmation of its identity — the why of work —and embodies everything the organization stands for from a historical, emotional, social, and practical point of view.

"Future-ready companies recognize that purpose helps attract people to join an organization, remain there, and thrive. Investors understand why this is valuable, and factor purpose into their decision making: the rise of environmental, social, and governance (ESG)–related funds is just one of the ways they acknowledge that purpose links to value creation in tangible ways.

"Nonetheless, few companies harness purpose fully. In a McKinsey survey of employees at US companies, 82% said organizational purpose is important, but only half that number said their purpose drove impact." [The same survey quoted in its earlier piece.]

A December 2020 piece reinforced my and McKinsey’s observation that while Purpose is a great idea, it drives very few tactical or even strategic decisions.

The concept of “corporate purpose” is at risk of becoming a vague aspirational statement like “mission” and “vision” were years ago. These statements were put on boardroom walls, but they didn’t really change the way companies conducted business.

There are no rules of thumb that companies can follow in making these decisions. However, defining a clear corporate purpose and rigorously paying attention to long-term value creation can help executives make the difficult choices.

Related Article: The Concept of Resilience: A New Buzzword

Wrapping it All Up

In summary:

  • Many organizations have Purpose or Mission statements that have been approved by the board and both the board and management profess to believe in them. (However, finding CEOs who will put achieving Purpose ahead of their bonus may be a challenge.)
  • If you have such statements, it is important that they are achieved — but that is a longer-term endeavor rather than something that is achieved this period.
  • Objectives, which in my experience every organization has established to measure and reward organization and management performance for the period, need to be designed to achieve any defined Purpose or Mission over time. Purpose is too aspirational and distanced from tactical and even most strategic decisions to be a major influence on daily decision-making.
  • Management is biased in their decision-making by how they will benefit. They know that they will be rewarded for achieving defined objectives.
  • It is far more practical to focus on the achievement of objectives than Purpose, especially when it comes to decision-making and the consideration of what might happen (risks and opportunities). Purpose statements (such as that referenced above from BHP) are typically aspirational and do not have the metrics associated with them that provide specificity and clarity about direction to decision-makers.
  • We cannot have certainty about either the achievement of Purpose or objectives, but we can strive for an acceptable likelihood of achieving objectives — and that will lead to the achievement, in time, of Purpose.
  • Objectives, though, need to be rooted in an understanding of what has happened, is happening, and might happen — and that is where ‘risk’ management can help (although I prefer the label of success management or even simply effective management).
  • In an ideal world, we would dispense with the four-letter word. But that is probably a step too far for most practitioners and almost certainly any regulator. However, we can change what we do so that it not only satisfies any compliance requirements but helps the organization succeed. That is what I recommend:
    • Comply with regulations first, but then
    • Extend your practice to help the organization and its people succeed.

I welcome your thoughts.