Enterprise Risk-Based Performance Management

Author and strategist Gary Cokins wrote the following:

"Classic managerial methods of past decades, such as total quality management, are now giving way to a trend of management by data. I would caution that extensively analyzing historical data is not sufficient without complementing descriptive data with predictive information. The absence of reliable foresight explains why companies seem invulnerable one minute and aimless the next. An important competence that will be key to an organization’s performance is a combination of forecasting and risk management incorporated into a business analytics framework that offers a firm’s management timely information they can act upon with confidence."

Hmmm... 'extensively analyzing historical data'... does that sound like a business you know? Few businesses boast as much data as communication providers. They not only know what their customers purchase and when, but their business model is increasingly oriented about making money from what they know about their customers. After all, communication providers know where we are, for location-based services, know what we like, serving up adverts based on our web habits, and even know who our friends are, based on the numbers we dial and who is in our social networks. But with all that data, how often do communication providers genuinely look forward, make predictions, and then - just as importantly - use analytics to responsively determine if the predictions were on target or wide of the mark?

There is a rich history of communication providers being caught by surprise by products that overperform and others that underwhelm. SMS, WAP, and the iPhone - they all tell a story about how to predict what will sell and what will stall. However, management of risk is typically divorced from management of performance. This begs the question of what is left for risk management after performance has been managed separately. It is no wonder, then, that risk management gets relegated to risk silos and falls short of the holistic ideal. But Cokins argues that the performance management and risk management should be combined. Indeed, he observes that:

"The foundations of both ERM and performance management share two clear tenets:

1. The less uncertainty there is about the future, the better.
2. If you cannot measure it, you cannot manage it."

So what are the obstacles to combining risk management with performance management? There are many, but one initial hurdle stands out: the obsession with Key Performance Indicators (KPIs). There is nothing wrong with KPIs, and I love a good KPI pack as much as the next numerate person. But KPIs can enshrine the idea that management is about looking at what happened yesterday and reacting to it. To think forward, businesses need Key Risk Indicators (KRIs) too. This is where the TMF can play a role in helping communication providers. Sitting down in isolation and defining KRIs is bound to be a daunting task. Persuading execs and peers to take them seriously and contribute the resources and data needed to calculate the KRIs can be an even bigger challenge. But communication providers have risks in common, and that means they should also have KRIs in common. The TMF is all about improving the performance of communication providers. We should aim to make management of risks an indivisible feature of performance management.