Internal Controls Design website by Matthew Leitch (tutor, researcher, author, & consultant)
New website, new perspective: www.WorkingInUncertainty.co.uk - Related articles - All articles - The author - Services

Beyond Budgeting GraphicRisk Management and Beyond Budgeting

by Matthew Leitch, 6 March 2003


Introduction: a sense of protection
Definitions
- Budgetary control
- Risk management
- The Beyond Budgeting model
Why budgetary control blocks risk management but Beyond Budgeting doesn't
- Technical problems with current risk management processes
- Uncertainty suppression
- Competition between budgetary control and risk management
Reforming risk management
- A new purpose
- Acceleration
- Explicit quantitive modeling of uncertainty
Where risk management fits in the Beyond Budgeting model
- Empowerment: what should we talk about?
- Action planning
- Forecasting: distributions not single points
The value of risk management within the Beyond Budgeting model
Summary of recommendations for Beyond Budgeting implementations

Introduction: a sense of protection

Business leaders want a sense of protection from the dangers of an uncertain future. Investors want to feel that Directors of companies they invest in know what is going on and what will happen. They want to feel that management are in control.

Budgetary control and similar systems of target setting and rewards have tried to provide that sense of comfort. However, if budgetary control really provided control in today's fast moving, complex, and turbulent world then companies whose budgetary control systems have been operated rigorously would not get nasty surprises, but they do.

On 3 December 2002 the Daily Telegraph reported on an embarrassment for BP, one of the world's most powerful and respected companies. Earlier that year BP had been forced to cut its growth targets on more than one occasion. The paper reported that Lord Browne had said he personally felt humiliated when the company scaled back its growth targets from 5.5pc for the year to 3pc. This humiliation was not just because the targets had been dropped. According to a spokesman "He was taken aback that we did not have a clear idea at the beginning of the [downgrading] process." BP had pledged to investigate fully why the directors did not have adequate information about the company's operations at hand earlier in the year when the sequence of production target downgrades forced the share price to a four-year low. Lord Browne said that middle-ranking executives had been asked to "step aside for a moment" (not literally as was later explained) while the company tried to assess what was going on at grass-roots level. The results of this review were expected along with the group's full-year results in February 2003 but in fact no explanation was given. Instead, Lord Browne explained that BP would be stating estimated ranges in future and that announcing single-point targets "...can distort the implementation of strategy."

BP is a much admired company and generally well run. It operates a conventional budgetary control system rigorously and in theory such surprises should not happen. Outsiders can only speculate as to what really happened. However, it is likely that they lost sight of their future because of their budgetary control system, rather than despite it.

This paper discusses the true contribution of budgetary control and the potential role of a reformed style of risk management within the Beyond Budgeting model.

The Beyond Budgeting model is a complete alternative to budgetary control, and its like, whose superior effectiveness has been demonstrated in practice. It was developed out of extensive case study research by Jeremy Hope, Robin Fraser, and Dr Peter Bunce of the Beyond Budgeting Round Table (sponsored over the last 5 years by some 60 leading companies).

Definitions

But first some definitions to explain terms and introduce the key concepts that distinguish alternative approaches to management control.

Budgetary control

In this paper budgetary control refers to any management approach that involves setting some kind of targets, regularly measuring variances between the original targets and actual outcomes, and motivating people to reduce those variances. This kind of control usually uses budgets, but these days the targets could be a mixture of financial and non-financial targets.

Companies are thought of as being controlled by a set of control loops, each one like the thermostat of a central heating system. In control theory these are called negative feedback control loops. (This is not because the feedback has a negative effect on people involved but because the feedback is used to reduce the variance. A positive feedback loop is one where the feedback increases the variance.)

Budgetary control attempts to deal with future uncertainties by reacting when the unexpected becomes evident through variances. The system always tries to get back to the original desired outcome.

This style of control has invaded almost every major company in the developed world and over-run many potentially interesting developments in management thinking. For example, the balanced scorecard was initially an interesting expansion of management information, but very soon the thermostat philosophy was added in an attempt to provide a more complete management system.

In many management textbooks, "management" and "management control" are defined in terms of setting targets and monitoring and managing variances. It's almost as if there are no alternatives.

In fact there are alternatives. Budgetary control is a 20th century invention linked to cybernetics and control theory. Its growth is probably the result of fascination with cybernetic ideas at a time when corporations were growing to astounding sizes.

Risk Management

Risk management is an activity where people anticipate and proactively manage potential future outcomes other than some benchmark outcome. The benchmark outcome is typically the planned outcome or most likely outcome. (The planned and most likely outcomes are not the same though they are often treated as such in budgetary control.)

For example, consider a loan made to a customer by a bank. There is a possibility that the customer will not pay back the loan. This is called the risk of default. This risk is a "downside risk" because the usual benchmark outcome is that the most likely thing will happen, and that the customer will pay back all the money.

Another example will illustrate the idea of "upside risk" and show what happens when there are many potential outcomes. Imagine a company runs a series of advertisements to boost sales. It has forecast the most likely amount by which sales will increase as a result, but the actual level could be more or less than this. There is a set of upside risks representing various levels of increase above the benchmark, and a set of risks representing various levels of increase below the benchmark.

The future is uncertain, but one thing we can be very nearly certain of is that the most likely outcome of a situation is not going to be the actual outcome. It's almost certain that the actual outcome will be something else. This being so it makes sense to think about, and try to manage, more than just the most likely outcome by:

Most companies have a formal risk management process to comply with corporate governance regulations, but also manage risk outside that formal process, informally and formally within other management systems.

Formal risk management is usually done in workshops or meetings and typically involves drawing up matrices of uncertainties, risks, and actions. Typically there is some form of rating to help prioritise actions and judge whether actions are sufficient. It is usual to start with an action plan then use risk management to modify it and add mitigation actions.

Risk management deals with future uncertainty by anticipation and action in advance.

The Beyond Budgeting model

The Beyond Budgeting model is an exciting initiative based on a number of case studies of large organisations that stopped using budgetary control. No such organisation has ever lost control of itself. Instead, these organisations have benefited immediately from saving time on budget arguments and reallocating it to more proactive and frequent adaptive planning.

Measurement and reward is based on performance compared to similar organisations or business units, and on performance under the conditions that actually transpired, rather than on absolute targets agreed at the start of a financial year. For more on the Beyond Budgeting model visit www.bbrt.org. Beyond Budgeting is also one of the examples of Dynamic Management cited in my paper "A new approach to management control: Dynamic Management".

Why budgetary control blocks risk management but Beyond Budgeting doesn't

Risk management has become increasingly important over the last couple of decades, particularly in financial services organisations. However, its full potential has not been reached. Budgetary control is one of the main reasons for that. Budgetary control has blocked risk management in the following ways:

By understanding these blocks in more detail we can begin to see how risk management could and should be reformed within the Beyond Budgeting model.

Technical problems with current risk management processes

The risk management processes in many companies are riddled with technical flaws, undermining their credibility and value. (For more information read my paper "The crisis in management control and corporate governance" which also contains a questionnaire to search for the most common flaws.)

However, the greatest flaw is the result of trying to make risk management support budgetary control by providing a means of achieving the original business objectives no matter what happens.

Most descriptions of risk management emphasise its role in helping organisations achieve their business objectives and of course this means their original objectives. Since the action if results turn out better than expected is simply to ease off, the entire focus of risk management is on outcomes worse than expected.

This in turn has made risk management negative and unpopular. A risk management workshop is typically a session where people sit round a conference table and talk about what could go wrong and what they're doing about it. This is not something people usually enjoy doing or do without special permission. If your boss proposes a plan and you reply with a list of things that could go wrong that could be taken badly. Risk managers are thought of as inherently cautious people who prefer to say "No".

In the last few years risk managers have begun to talk about the "upside" of risk, and about managing "risks and opportunities". Some have suggested calling risk management "uncertainty management" instead to show it refers to all alternative outcomes and not just the bad ones.

This is the future direction for risk management, but budgetary control stands in the way. It is hard enough to get people to discuss unexpectedly poor outcomes. It can be even harder to get them to talk about unexpectedly favourable outcomes within a budgetary control culture. People keep quiet rather than tempt their boss to raise the targets.

The Beyond Budgeting model sets risk management free from all this. It promotes a culture in which uncertainty is accepted and results can go up as well as down. Risk management - or uncertainty management to give it the new name - can become a balanced, popular process in which uncertainties are openly discussed and managed.

Uncertainty suppression

The unwillingness to discuss outcomes other than that planned is part of the wider phenomenon of uncertainty suppression. When leaders make it clear that they expect to see delivery of originally committed results according to original budgets and deadlines, and that they expect managers to be certain in their minds and actions, people generally respond by pretending to be more certain than they are, and by not talking about, thinking about, or managing uncertainty. They can be pushed into making premature commitments to overly specific targets, and when things go badly they keep it secret, hoping to recover. If this doesn't happen then eventually the bad news will come out - often too late for anything to be done.

Leaders should make it clear that they are looking for excellent risk management and planning, and should encourage people to be open about uncertainties, discuss them realistically, and manage them.

Budgetary control sends the wrong messages and causes uncertainty suppression. This is the most likely explanation for BP's problems, though the full details will probably never be known. However, another famous company that suffered uncertainty suppression has made the details public.

Boo.com was one of the most hyped Internet retailers of the Internet gold rush. After its failure, Ernst Malmsten, CEO and one of the founders of the business, wrote a book called "Boo Hoo" that described in detail exactly what happened. Having chosen an inherently ambitious and risky business model, Ernst initially struggled to get funding. However, as interest in the Internet increased, this problem was overcome and the company moved at full speed towards global launch. Unfortunately, full speed was not fast enough in the IT department. Ernst was concerned and various commitments were sought, obtained, and broken. The technology manager was suppressing his uncertainty and Ernst unwittingly encouraged him to do so.

Finally, Ernst sought an independent opinion from some e-business consultants who made their enquiries and reported a serious lack of basic risk management activities in that area. (Although serious these were not unusual weaknesses.) Ernst realised his mistake and explains it candidly in his book.

"I was beginning to wonder how we had ever believed we were only a few weeks away from launch. It was a mass delusion. We either hadn't seen, or had simply closed our eyes to, all the warning signs. So who was to blame? Was it the technology companies for making promises they couldn't deliver? Partly. Of course it would be easy to blame Steven Bennett [boo's technology manager], but when it finally came down to it, I realized with a sinking feeling, I had to take responsibility. As the CEO, my neck was on the line, anyway. I was the one that everyone would blame if the company didn't launch. But I knew that they'd be right too. Instead of focusing single-mindedly on just getting the website up and running, I had tried to implement an immensely complex and ambitious vision in its entireity. Our online magazine, the rollout of the overseas offices, the development of new product lines to sell on our site - these were all things that could have waited until the site was in operation. But I had wanted to build utopia instantly. It had taken eleven Apollo missions to land on the moon; I had wanted to do it all in one."

"Nor had I taken into account the huge pressure that this vision created. It was far ahead of the infrastructure we had to support it, but I'd banned all talk of failure or delays as defeatist. The result was that rather than reveal their worries people had preferred to ride blindly into the guns."

Following this shock the company rallied very strongly but it was not enough.

Competition between budgetary control and risk management

Both budgetary control and risk management offer to help managers deal with uncertainty about the future. However, budgetary control has four fundamental weaknesses in this role:

Although budgetary control is not very effective, it was adopted first and its position is entrenched. In most companies budgetary control influences status, pay, and promotions. In some companies budgetary control meetings are among the most highly charged and stressful. These are the meetings where business leaders assert their dominance. By comparison, formal risk management tends to be an exercise done to comply with corporate governance regulations, while informal risk management is too often haphazard.

The Beyond Budgeting model emphasises proactive, adaptive planning, frequently repeated. It accepts that the future is uncertain and flexes with conditions. It provides incentives to keep pouring on the effort even if you are having great success. This is like driving a car with your eyes looking forward at the road ahead. Risk management naturally fits into this as the process whereby potential openings in the traffic and potential dangers are anticipated, searched for, prepared for, and dealt with.

Reforming risk management

If an organisation's formal risk management processes are to support the Beyond Budgeting model instead of undermining it, they will almost certainly need to be revised. Reforms will probably fall into three types:

  1. A new purpose for risk management.

  2. Quicker, easier techniques for more widespread use.

  3. More sophisticated quantification of risks in big decisions.

A new purpose

Instead of being a way to achieve original objectives, no matter what, risk management must become a way to get people to think about the full range of potential future outcomes, and manage them by advance action where appropriate.

This also means that instead of just considering things that could go "wrong", people should be considering outcomes both better and worse than expected.

It would help to rename the process "Risk and opportunity management" or just "uncertainty management", though the phrase "risk management" would have to be retained for external statements about corporate governance.

Having removed the negativity of conventional risk management the process will be more attractive and there will be less resistance to doing more of it.

Acceleration

Risk/uncertainty management should be a normal part of most management deliberations so it must be possible to do it quickly and conveniently. If the top team has to spend half a day off site with flipcharts every time to get it done that is not going to be practical. There are a number of techniques for accelerating the process but the most important is to be able to work at a higher level.

The usual style of risk management tries to work at the level of individual risks. Each risk is identified and then rated to help with prioritisation. Typically there are two separate ratings: likelihood and impact. Actions listed are usually described as "mitigation" or as "controls".

Working at this level is often useful but it can be laborious and there are certain risks that people often want to consider that cannot be dealt with like this. We need to be able to work at the level of sets of risks, otherwise known as "areas of uncertainty", or just as "uncertainties".

Examples

Area of uncertainty/set of risks

Individual risks

Impact of litigation this year.

We lose our case against Grumpy plc.

Fire damage this year.

Our data centre is destroyed by fire this year.

Market growth in the next two years.

Market growth in the next two years is exactly 1.0% less than expected.

Market growth in the next two years is exactly 1.1% less than expected.

Market growth in the next two years is exactly 1.2% less than expected.

etc

Demand for our new product in the first 6 months.

Demand is 5% above our best estimate.

Demand is 10% above our best estimate.

Demand is 15% above our best estimate.

Demand is 20% above our best estimate.

etc

The most common technical flaw in today's risk registers is that the "risk" column is almost always used for sets of risks, but the ratings are framed for individual risks. For example, you might be able to estimate the likelihood of "Loss of market share" but what is the impact? Obviously, it depends on how much market share is lost. The risk "Loss of market share" is really an infinite set of risks, one for each possible level of loss.

Correctly rating such sets of risks requires a probability distribution (or probability density distribution for continuous variation) of impact. This can be done by, for example, gathering a sequence of ratings for the likelihood of impact levels being in various ranges.

A rough approximation to this which can be done quickly and easily is to ask for ratings in two stages:

  1. What is the likely range for this variable? (Perhaps defined as the smallest range for which you are x% certain the value will be in the range.)

  2. What is the variation in impact over that range?

For example, "What is the likely range for total market growth over the next year?" then "What is the difference in impact for us between the best and the worst?"

The mitigation assumed must be carefully defined. This can be done by assuming a particular set of mitigation actions, or by assuming a range of mitigation actions so that you can see the best and worst results that might be achievable under all identified possible mitigation strategies.

Working at the level of areas of uncertainty it is often not necessary to make ratings at all. If an uncertainty is obviously important there is no need for ratings unless acting on it is also costly and a difficult judgment is needed.

Very often, the first and most important actions in uncertainty management are to find out more, or at least put in place monitoring so that more can be learned over time. This again does not have to be at the level of individual risks.

Here is an illustration of a simple table design that accommodates high level reasoning about uncertainty:

Table for fast and easy uncertainty management

Area of uncertainty/ set of risks

Impact

Monitoring/ research actions

Mitigation/exploitation

Impact of litigation this year.

Huge. Three cases outstanding. Uncertain outcomes with range of impact around 100m.

Weekly briefings with legal team.

Get second opinion on Grumpy plc case urgently.

Health and Safety compliance audit.

Investigate insurance cover options.

Fire damage this year.

Fire precautions well established. Slight possibility of terrorist attack and that would be serious as it is outside current provisions.

Check progress on BCP project.

Get risk team to give us a briefing on terrorism risks.

We are moving from Docklands to Baskingstoke - should be lower risk.

Review of fire precautions in new offices.

Market growth in the next two years.

70% sure it will be between -7% and +13%. Impact huge.

Improve analysis of sales figures to find highest growth areas more quickly.

Commission new analysis of economic indicators and update monthly.

Revise activity model to show warnings of demand outside existing capability.

Look for a more flexible warehousing approach.

Demand for our new product in the first 6 months.

Very uncertain and impact huge because this is our big new hope.

Pilot launch.

Conjoint analysis study.

Buy market survey from research company.

Introduce portfolio management of products and ditch budgets urgently.

With simple techniques like this it is possible for everyone to practice managing uncertainty better, all the time.

Explicit quantitive modeling of uncertainty

Just about every major company says it considers risks when making major business decisions. In the UK, the wording that appears in their corporate governance report usually says their procedures include something like this:

"...the consideration of risks and the appropriate action plans, when appraising and approving all major capital and revenue projects and change programmes."

At present that consideration does not usually extend to quantifying uncertainty in the financial models that underlie these major decisions. As a result, the financial models can be highly misleading. Not only do they suggest greater certainty than they should, but even the "best estimate" is likely to be incorrect due to the Flaw of Averages and other effects.

This Flaw is the tendency to assume that average (or "best estimate") inputs will lead to average outputs, so it is not necessary to consider other possible inputs in working out the output result. In fact this is only the case if the model is linear, which most such models are not.

For example, imagine a company that organises conferences. Before deciding to go ahead with advertising a conference and booking a venue it estimates the attendance at the conference and puts its best guess into a financial model to decide if the conference is worthwhile. There is a chance that too few people will be interested in a conference and that it will have to be cancelled, saving most costs but not the non-refundable deposit on the venue, which is usually quite large. However, in most cases the impact of cancellation, including the non-refundable deposit, is not considered at all in the model because the most likely attendance is enough to avoid cancellation. This is clearly incorrect. The correct valuation should be lower to reflect the impact of potential cancellation.

Another reason that best guess models tend to be wrong is that they assume all decisions are made by the company at the outset. There is no opportunity to respond to events so the value of these options is not considered. New techniques now becoming popular combine discounted cash flow models with decision trees to give a more realistic valuation.

Where risk management fits in the Beyond Budgeting model

Risk management can contribute to the Beyond Budgeting model in three places: empowerment, action planning, and forecasting.

Empowerment: what should we talk about?

Even under radical decentralisation the top management team in a company still has a legitimate interest in the decisions and action plans of the business units to whom they have given power. When they meet the business unit managers what should they talk about?

This is a dangerous encounter. Here is where central control could try to reassert itself as Directors follow their natural instinct to dominate and direct. A discussion of performance to date against targets would be wrong and crush empowerment, so it is vital to be clear about the rules of these conversations and avoid allowing old habits to insinuate themselves.

In the June 2002 version of the "Beyond Budgeting White Paper" there is a section on empowerment that says of companies who have gone Beyond Budgeting that:

"They have challenged local strategies and action plans to ensure they are sufficiently ambitious but at the same time that they are robust and that risks are appropriate."

The budgetary control interpretation of these words is that senior management have challenged targets to ensure they are ambitious yet achievable. This is not the correct interpretation.

The risk/uncertainty management interpretation is that senior management have challenged to see that local management have thought properly about the full range of possible outcomes, and that their plans include steps towards very good outcomes as well as steps designed to cut the risk of poor outcomes.

This can be broken into two elements:

The format of an effective risk management workshop could be adapted to this purpose, providing a form that clearly discourages target setting behaviour. Risk management concepts can provide a common language to keep these conversations honest.

Furthermore, these meetings can be described to investors as a demonstration of good corporate governance and to reassure them that their investment is safe.

Action planning

Risk management can also be added to action planning to improve plans. Ideally, it should be an integrated part of action planning so that plans are shaped from the first by risk assessments and risk management heuristics.

There are already hints of this in some Beyond Budgeting publications. For example, in "Beyond Budgeting", an article for Strategic Finance October 2000, by Jeremy Hope and Robin Fraser, the section on performance management includes the recommendation for:

"An investment management process that forces managers to build flexibility and "exit routes" into their forecasts and in which execution is made at the latest possible time."

In "Beyond Budgeting ... building a new management model for the information age" in Management Accounting January 1999 Jeremy and Robin wrote:

"The new emphasis is on looking ahead and being in a position to take advantage of new opportunities and counter potential threats by using an advanced information system to make decisions early."

And also:

"By monitoring the key business value drivers and especially the leading indicators that tell us something about future performance, we are in a much stronger position to take action before potential problems translate into negative numbers."

They quoted Ole Johannesson, VP finance of Volvo Cars, as saying:

"Today we need a process that enables us to react not only immediately but even beforehand."

Both these comments show that Beyond Budgeting aims to go beyond even instant responses to events. How can this be achieved if not by anticipating potential outcomes and acting in advance to modify their likelihood and impact?

The hints are there but, based on publications to January 2003, there is scope for adding a lot more to the risk management element of the Beyond Budgeting model.

Forecasting: distributions not single points

References to rolling forecasts are too numerous to mention in Beyond Budgeting publications. What form should those forecasts take?

The most common form for forecasts is one that states the most likely outcome only. e.g. "the NPV of this project is x", or "free cash of y", or "operating profit of z on turnover of x". This is not very helpful to action planning and does not help people to appreciate the full range of potential outcomes and their relative likelihoods. Uncertainty is suppressed.

A much more useful forecast is one that states the probability distribution of whatever is being forecast. Uncertainty is explicitly represented, discouraging uncertainty suppression. This is more helpful for action planning. One can ask questions like "What is the likelihood that the NPV of this project is negative?", "On current funding plans, what is the probability that our free cash flow will be less than the amount we need to maintain dividends at last year's level?", "What is the likelihood that demand for this product will require warehouse capacity greater than our current planned levels?"

This is not as difficult to do as most people think.

It is common to offer a single-point best estimate and an optimistic and pessimistic range. If "optimistic" and "pessimistic" are defined in probability terms this is a form of probability distribution. (If you can do this you are very close to being able to show the whole distribution in a graph too.) If these terms are not defined then the range is still helpful as a reminder that uncertainty exists, but is not as useful.

Even so, forecasting outcomes as probability distributions is more difficult than single-point forecasting and certainly less familiar for most accountants and business analysts. There are many alternative techniques, some of which are hard to understand and implement.

Though forecasting with probability distributions may seem unfamiliar and complex now, in years to come it will be as familiar as discounted cash flow models are today. Forecasting distributions is a tangible expression of commitment to keep uncertainty in mind and not make the mistake of assuming one future. It also puts business leaders in a position to say something specific to analysts and investors without actual stating a single-point forecast or target.

The value of risk management within the Beyond Budgeting model

The sense of control, and protection against future uncertainties, that business leaders and investors want does not have to be provided by "command and control" leadership, where decisions are made centrally, and where original objectives are the yardstick of success.

Beyond Budgeting offers a welcome alternative based on:

Adding Risk/Uncertainty management to that list would further strengthen the sense of comfort. It would also allow business leaders to make more detailed statements about the future to analysts, if they wanted to, without stating targets.

Summary of recommendations for Beyond Budgeting implementations

Companies planning to manage their performance better by moving to the Beyond Budgeting model should:




If you have any ideas, questions, or concerns please feel free to contact me at matthew@internalcontrolsdesign.co.uk. I normally reply within a couple of days.



© 2003 Matthew Leitch
New website, new perspective: www.WorkingInUncertainty.co.uk - Related articles - All articles - The author - Services

If you found any of these points relevant to you or your organisation please feel free to contact me to talk about them, pass links or extracts on to colleagues, or just let me know what you think. I can sometimes respond immediately, but usually respond within a few days. Contact details

Matthew Leitch - Author

About the author: Matthew Leitch is a tutor, researcher, author, and independent consultant specialising in internal control and risk management. He is also the author of the new website, www.WorkingInUncertainty.co.uk, and has written two breakthrough books. Intelligent internal control and risk management is a powerful and original approach including 60 controls that most organizations should use more. A pocket guide to risk mathematics: Key concepts every auditor should know is the first to provide a strong conceptual understanding of mathematics to auditors who are not mathematicians, without the need to wade through mathematical symbols. Matthew is a Chartered Accountant with a degree in psychology whose past career includes software development, marketing, auditing, accounting, and consulting. He spent 7 years as a controls specialist with PricewaterhouseCoopers, where he pioneered new methods for designing internal control systems for large scale business and financial processes, through projects for internationally known clients. Today he is well known as an expert in uncertainty and how to deal with it, and an increasingly sought after tutor (i.e. one-to-one teacher). more

Please share:            Share on Tumblr