Internal Controls Design Website by Matthew Leitch

7/28/2019 Internal Controls Design Website by Matthew Leitch

1/15

Internal Controls Design website by Matthew Leitch (consultant, author,educator, and researcher)

Related articles -All articles - The author- Services

Risk Management and BeyondBudgeting

by Matthew Leitch, 6 March 2003

Introduction: a sense of protection

Definitions

- Budgetary control- Risk management

- The Beyond Budgeting model

Why budgetary control blocks risk management but Beyond Budgeting doesn't

- Technical problems with current risk management processes

- Uncertainty suppression

- Competition between budgetary control and risk management

Reforming risk management

- A new purpose

- Acceleration

- Explicit quantitive modeling of uncertainty

Where risk management fits in the Beyond Budgeting model- Empowerment: what should we talk about?

- Action planning

- Forecasting: distributions not single points

The value of risk management within the Beyond Budgeting model

Summary of recommendations for Beyond Budgeting implementations

Introduction: a sense of protection

Business leaders want a sense of protection from the dangers of an uncertain future. Investors

want to feel that Directors of companies they invest in know what is going on and what willhappen. They want to feel that management are in control.

Budgetary control and similar systems of target setting and rewards have tried to provide that

sense of comfort. However, if budgetary control really provided control in today's fast

moving, complex, and turbulent world then companies whose budgetary control systems have

been operated rigorously would not get nasty surprises, but they do.

On 3 December 2002 the Daily Telegraph reported on an embarrassment for BP, one of the

world's most powerful and respected companies. Earlier that year BP had been forced to cut

its growth targets on more than one occasion. The paper reported that Lord Browne had said

he personally felt humiliated when the company scaled back its growth targets from 5.5pc forthe year to 3pc. This humiliation was not just because the targets had been dropped.
http://location.href%3D%27../index.shtml#'%20+%20document.mnu.related.value.substring(3,document.mnu.related.value.length-5);http://www.internalcontrolsdesign.co.uk/index.shtmlhttp://www.internalcontrolsdesign.co.uk/index.shtmlhttp://www.internalcontrolsdesign.co.uk/icdpicturepage.shtmlhttp://www.internalcontrolsdesign.co.uk/icdpicturepage.shtmlhttp://www.internalcontrolsdesign.co.uk/icdservices.shtmlhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Introhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Definitionshttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Budgetshttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#rmhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#bbhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Blockshttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Technicalhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Suppressionhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Competitionhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Reformshttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Purposehttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Accelerationhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Modelinghttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Wherehttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Empowermenthttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Actionhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Forecastinghttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Valuehttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Recommendationshttp://www.internalcontrolsdesign.co.uk/index.shtmlhttp://www.internalcontrolsdesign.co.uk/icdpicturepage.shtmlhttp://www.internalcontrolsdesign.co.uk/icdservices.shtmlhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Introhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Definitionshttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Budgetshttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#rmhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#bbhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Blockshttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Technicalhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Suppressionhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Competitionhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Reformshttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Purposehttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Accelerationhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Modelinghttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Wherehttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Empowermenthttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Actionhttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Forecastinghttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Valuehttp://www.internalcontrolsdesign.co.uk/RMandBB/index.shtml#Recommendationshttp://location.href%3D%27../index.shtml#'%20+%20document.mnu.related.value.substring(3,document.mnu.related.value.length-5);


2/15

According to a spokesman "He was taken aback that we did not have a clear idea at the

beginning of the [downgrading] process." BP had pledged to investigate fully why the

directors did not have adequate information about the company's operations at hand earlier in

the year when the sequence of production target downgrades forced the share price to a four-

year low. Lord Browne said that middle-ranking executives had been asked to "step aside for

a moment" (not literally as was later explained) while the company tried to assess what wasgoing on at grass-roots level. The results of this review were expected along with the group's

full-year results in February 2003 but in fact no explanation was given. Instead, Lord Browne

explained that BP would be stating estimated ranges in future and that announcing single-

point targets "...can distort the implementation of strategy."

BP is a much admired company and generally well run. It operates a conventional budgetary

control system rigorously and in theory such surprises should not happen. Outsiders can only

speculate as to what really happened. However, it is likely that they lost sight of their future

because of their budgetary control system, rather than despite it.

This paper discusses the true contribution of budgetary control and the potential role of areformed style of risk management within the Beyond Budgeting model.

The Beyond Budgeting model is a complete alternative to budgetary control, and its like,

whose superior effectiveness has been demonstrated in practice. It was developed out of

extensive case study research by Jeremy Hope, Robin Fraser, and Dr Peter Bunce of the

Beyond Budgeting Round Table (sponsored over the last 5 years by some 60 leading

companies).

Definitions

But first some definitions to explain terms and introduce the key concepts that distinguish

alternative approaches to management control.

Budgetary control

In this paper budgetary control refers to any management approach that involves setting some

kind of targets, regularly measuring variances between the original targets and actual

outcomes, and motivating people to reduce those variances. This kind of control usually uses

budgets, but these days the targets could be a mixture of financial and non-financial targets.

Companies are thought of as being controlled by a set of control loops, each one like the

thermostat of a central heating system. In control theory these are called negative feedback

control loops. (This is not because the feedback has a negative effect on people involved but

because the feedback is used to reduce the variance. A positive feedback loop is one where

the feedback increases the variance.)

Budgetary control attempts to deal with future uncertainties by reacting when the unexpected

becomes evident through variances. The system always tries to get back to the original

desired outcome.

This style of control has invaded almost every major company in the developed world andover-run many potentially interesting developments in management thinking. For example,


3/15

the balanced scorecard was initially an interesting expansion of management information, but

very soon the thermostat philosophy was added in an attempt to provide a more complete

management system.

In many management textbooks, "management" and "management control" are defined in

terms of setting targets and monitoring and managing variances. It's almost as if there are noalternatives.

In fact there are alternatives. Budgetary control is a 20th century invention linked to

cybernetics and control theory. Its growth is probably the result of fascination with cybernetic

ideas at a time when corporations were growing to astounding sizes.

Risk Management

Risk management is an activity where people anticipate and proactively manage potential

future outcomes other than some benchmark outcome. The benchmark outcome is typically

the planned outcome or most likely outcome. (The planned and most likely outcomes are not

the same though they are often treated as such in budgetary control.)

For example, consider a loan made to a customer by a bank. There is a possibility that the

customer will not pay back the loan. This is called the risk of default. This risk is a "downside

risk" because the usual benchmark outcome is that the most likely thing will happen, and that

the customer will pay back all the money.

Another example will illustrate the idea of "upside risk" and show what happens when there

are many potential outcomes. Imagine a company runs a series of advertisements to boost

sales. It has forecast the most likely amount by which sales will increase as a result, but theactual level could be more or less than this. There is a set of upside risks representing various

levels of increase above the benchmark, and a set of risks representing various levels of

increase below the benchmark.

The future is uncertain, but one thing we can be very nearly certain of is that the most likely

outcome of a situation is not going to be the actual outcome. It's almost certain that the actual

outcome will be something else. This being so it makes sense to think about, and try to

manage, more than just the most likely outcome by:

doing research and monitoring sources of information for further indications about the

future; making plans that reflect potential alternative outcomes;

doing things in advance to modify the impact of alternative outcomes, should they

occur; and

doing things to change the likelihoods of alternative outcomes.

Most companies have a formal risk management process to comply with corporate

governance regulations, but also manage risk outside that formal process, informally and

formally within other management systems.

Formal risk management is usually done in workshops or meetings and typically involves

drawing up matrices of uncertainties, risks, and actions. Typically there is some form of


4/15

rating to help prioritise actions and judge whether actions are sufficient. It is usual to start

with an action plan then use risk management to modify it and add mitigation actions.

Risk management deals with future uncertainty by anticipation and action in advance.

The Beyond Budgeting model

The Beyond Budgeting model is an exciting initiative based on a number of case studies of

large organisations that stopped using budgetary control. No such organisation has ever lost

control of itself. Instead, these organisations have benefited immediately from saving time on

budget arguments and reallocating it to more proactive and frequent adaptive planning.

Measurement and reward is based on performance compared to similar organisations or

business units, and on performance under the conditions that actually transpired, rather than

on absolute targets agreed at the start of a financial year. For more on the Beyond Budgeting

model visit www.bbrt.org. Beyond Budgeting is also one of the examples of Dynamic

Management cited in my paper"A new approach to management control:Dynamic

Management".

Why budgetary control blocks risk management but

Beyond Budgeting doesn't

Risk management has become increasingly important over the last couple of decades,

particularly in financial services organisations. However, its full potential has not been

reached. Budgetary control is one of the main reasons for that. Budgetary control has blocked

risk management in the following ways:

Risk management methods have been designed to support budgetary control, so

nearly all focus exclusively on bad things that might happen, creating a management

process that is negative and can be demotivating. This in turn has limited risk

management's appeal.

Budgetary control stimulates people to suppress uncertainty. They don't talk about it,

don't think about it, and so don't manage it as well as they could. This discourages

people from participating in risk management.

Both activities offer a means of dealing with an uncertain future, but budgetary

control is the entrenched competitor despite its limitations.

By understanding these blocks in more detail we can begin to see how risk management

could and should be reformed within the Beyond Budgeting model.

Technical problems with current risk management processes

The risk management processes in many companies are riddled with technical flaws,

undermining their credibility and value. (For more information read my paper "The crisis in

management control and corporate governance" which also contains a questionnaire to search

for the most common flaws.)
http://www.bbrt.org/http://www.internalcontrolsdesign.co.uk/dynamic/index.htmlhttp://www.internalcontrolsdesign.co.uk/dynamic/index.htmlhttp://www.internalcontrolsdesign.co.uk/dynamic/index.htmlhttp://www.internalcontrolsdesign.co.uk/dynamic/index.htmlhttp://www.internalcontrolsdesign.co.uk/dynamic/index.htmlhttp://www.internalcontrolsdesign.co.uk/crisis/index.htmlhttp://www.internalcontrolsdesign.co.uk/crisis/index.htmlhttp://www.bbrt.org/http://www.internalcontrolsdesign.co.uk/dynamic/index.htmlhttp://www.internalcontrolsdesign.co.uk/dynamic/index.htmlhttp://www.internalcontrolsdesign.co.uk/crisis/index.htmlhttp://www.internalcontrolsdesign.co.uk/crisis/index.html


5/15

However, the greatest flaw is the result of trying to make risk management support budgetary

control by providing a means of achieving the original business objectives no matter what

happens.

Most descriptions of risk management emphasise its role in helping organisations achieve

their business objectives and of course this means their original objectives. Since the action ifresults turn out better than expected is simply to ease off, the entire focus of risk management

is on outcomes worse than expected.

This in turn has made risk management negative and unpopular. A risk management

workshop is typically a session where people sit round a conference table and talk about what

could go wrong and what they're doing about it. This is not something people usually enjoy

doing or do without special permission. If your boss proposes a plan and you reply with a list

of things that could go wrong that could be taken badly. Risk managers are thought of as

inherently cautious people who prefer to say "No".

In the last few years risk managers have begun to talk about the "upside" of risk, and aboutmanaging "risks and opportunities". Some have suggested calling risk management

"uncertainty management" instead to show it refers to all alternative outcomes and not just

the bad ones.

This is the future direction for risk management, but budgetary control stands in the way. It is

hard enough to get people to discuss unexpectedly poor outcomes. It can be even harder to

get them to talk about unexpectedly favourable outcomes within a budgetary control culture.

People keep quiet rather than tempt their boss to raise the targets.

The Beyond Budgeting model sets risk management free from all this. It promotes a culture

in which uncertainty is accepted and results can go up as well as down. Risk management - or

uncertainty management to give it the new name - can become a balanced, popular process in

which uncertainties are openly discussed and managed.

Uncertainty suppression

The unwillingness to discuss outcomes other than that planned is part of the wider

phenomenon of uncertainty suppression. When leaders make it clear that they expect to see

delivery of originally committed results according to original budgets and deadlines, and that

they expect managers to be certain in their minds and actions, people generally respond by

pretending to be more certain than they are, and by not talking about, thinking about, ormanaging uncertainty. They can be pushed into making premature commitments to overly

specific targets, and when things go badly they keep it secret, hoping to recover. If this

doesn't happen then eventually the bad news will come out - often too late for anything to be

done.

Leaders should make it clear that they are looking for excellent risk management and

planning, and should encourage people to be open about uncertainties, discuss them

realistically, and manage them.

Budgetary control sends the wrong messages and causes uncertainty suppression. This is the

most likely explanation for BP's problems, though the full details will probably never be


6/15


7/15

There often is no action that will get the project/business back "on track".

Negative feedback loops seem like a perfect control mechanism until you remember

that they assume an action exists that can get you back on track. In practice, there

often isn't such an action. Business managers are normally constrained on resources,

elapsed time, and quality so there's nothing they can trade off. The fact that no action

is taken until results have already been damaged is another reason why a recoveryaction often does not exist. Bad news is more likely to mean more bad news in future

because it usually shows that conditions are less favourable than was expected.

The reaction to outcomes better than expected is to ease off. It seems absurd that a

business that is doing better than expected should ease up, but that is precisely what

happens under negative feedback control. Imagine a company with several new

products that applies budgetary control to them. Sensible product portfolio

management calls for detecting the products that are doing well and pouring it on,

while investigating products that are struggling and being prepared to cut losses by

killing the product. Budgetary control drives precisely the opposite behaviour as

people perform heroics trying to rescue the failures at the expense of the potentialrunaway successes.

It drives uncertainty suppression. This is the point discussed at length in the

previous sub-section.

Although budgetary control is not very effective, it was adopted first and its position is

entrenched. In most companies budgetary control influences status, pay, and promotions. In

some companies budgetary control meetings are among the most highly charged and

stressful. These are the meetings where business leaders assert their dominance. By

comparison, formal risk management tends to be an exercise done to comply with corporate

governance regulations, while informal risk management is too often haphazard.

The Beyond Budgeting model emphasises proactive, adaptive planning, frequently repeated.

It accepts that the future is uncertain and flexes with conditions. It provides incentives to keep

pouring on the effort even if you are having great success. This is like driving a car with your

eyes looking forward at the road ahead. Risk management naturally fits into this as the

process whereby potential openings in the traffic and potential dangers are anticipated,

searched for, prepared for, and dealt with.

Reforming risk management

If an organisation's formal risk management processes are to support the Beyond Budgeting

model instead of undermining it, they will almost certainly need to be revised. Reforms will

probably fall into three types:

1. A new purpose for risk management.

2. Quicker, easier techniques for more widespread use.

3. More sophisticated quantification of risks in big decisions.

A new purpose


8/15

Instead of being a way to achieve original objectives, no matter what, risk management must

become a way to get people to think about the full range of potential future outcomes, and

manage them by advance action where appropriate.

This also means that instead of just considering things that could go "wrong", people should

be considering outcomes both better and worse than expected.

It would help to rename the process "Risk and opportunity management" or just "uncertainty

management", though the phrase "risk management" would have to be retained for external

statements about corporate governance.

Having removed the negativity of conventional risk management the process will be more

attractive and there will be less resistance to doing more of it.

Acceleration

Risk/uncertainty management should be a normal part of most management deliberations so

it must be possible to do it quickly and conveniently. If the top team has to spend half a day

off site with flipcharts every time to get it done that is not going to be practical. There are a

number of techniques for accelerating the process but the most important is to be able to work

at a higher level.

The usual style of risk management tries to work at the level of individual risks. Each risk is

identified and then rated to help with prioritisation. Typically there are two separate ratings:

likelihood and impact. Actions listed are usually described as "mitigation" or as "controls".

Working at this level is often useful but it can be laborious and there are certain risks thatpeople often want to consider that cannot be dealt with like this. We need to be able to work

at the level of sets of risks, otherwise known as "areas of uncertainty", or just as

"uncertainties".

Examples

Area of uncertainty/set of risks Individual risks

Impact of litigation this year. We lose our case against Grumpy plc.

Fire damage this year. Our data centre is destroyed by fire this year.

Market growth in the next two years.

Market growth in the next two years is exactly 1.0%

less than expected.


less than expected.


less than expected.

etc

Demand for our new product in the first

6 months.

Demand is 5% above our best estimate.


9/15




etc

The most common technical flaw in today's risk registers is that the "risk" column is almost

always used for sets of risks, but the ratings are framed for individual risks. For example, you

might be able to estimate the likelihood of "Loss of market share" but what is the impact?

Obviously, it depends on how much market share is lost. The risk "Loss of market share" is

really an infinite set of risks, one for each possible level of loss.

Correctly rating such sets of risks requires a probability distribution (or probability densitydistribution for continuous variation) of impact. This can be done by, for example, gathering a

sequence of ratings for the likelihood of impact levels being in various ranges.

A rough approximation to this which can be done quickly and easily is to ask for ratings in

two stages:

1. What is the likely range for this variable? (Perhaps defined as the smallest range

for which you are x% certain the value will be in the range.)

2. What is the variation in impact over that range?

For example, "What is the likely range for total market growth over the next year?" then"What is the difference in impact for us between the best and the worst?"

The mitigation assumed must be carefully defined. This can be done by assuming a particular

set of mitigation actions, or by assuming a range of mitigation actions so that you can see the

best and worst results that might be achievable under all identified possible mitigation

strategies.

Working at the level of areas of uncertainty it is often not necessary to make ratings at all. If

an uncertainty is obviously important there is no need for ratings unless acting on it is also

costly and a difficult judgment is needed.

Very often, the first and most important actions in uncertainty management are to find out

more, or at least put in place monitoring so that more can be learned over time. This again

does not have to be at the level of individual risks.

Here is an illustration of a simple table design that accommodates high level reasoning about

uncertainty:

Table for fast and easy uncertainty management

Area of

uncertainty/set of risks

Impact Monitoring/research actions Mitigation/exploitation


10/15

Impact of

litigation this

year.

Huge. Three cases

outstanding. Uncertain

outcomes with range

of impact around

100m.

Weekly briefings with

legal team.

Get second opinion on

Grumpy plc case

urgently.

Health and Safety

compliance audit.

Investigate insurance cover

options.

Fire damage this

year.

Fire precautions well

established. Slight

possibility of terrorist

attack and that would

be serious as it is

outside current

provisions.

Check progress on

BCP project.

Get risk team to give

us a briefing on

terrorism risks.

We are moving from

Docklands to Baskingstoke -

should be lower risk.

Review of fire precautions in

new offices.

Market growth

in the next two

years.

70% sure it will be

between -7% and

+13%. Impact huge.

Improve analysis of

sales figures to find

highest growth areasmore quickly.

Commission new

analysis of economic

indicators and update

monthly.

Revise activity model

to show warnings of

demand outside

existing capability.

Look for a more flexible

warehousing approach.

Demand for our

new product in

the first 6

months.

Very uncertain and

impact huge because

this is our big new

hope.

Pilot launch.

Conjoint analysis

study.

Buy market survey

from research

company.

Introduce portfolio

management of products and

ditch budgets urgently.

With simple techniques like this it is possible for everyone to practice managing uncertaintybetter, all the time.

Explicit quantitive modeling of uncertainty

Just about every major company says it considers risks when making major business

decisions. In the UK, the wording that appears in their corporate governance report usually

says their procedures include something like this:

"...the consideration of risks and the appropriate action plans, when appraising and approving

all major capital and revenue projects and change programmes."


11/15

At present that consideration does not usually extend to quantifying uncertainty in the

financial models that underlie these major decisions. As a result, the financial models can be

highly misleading. Not only do they suggest greater certainty than they should, but even the

"best estimate" is likely to be incorrect due to the Flaw of Averages and other effects.

This Flaw is the tendency to assume that average (or "best estimate") inputs will lead toaverage outputs, so it is not necessary to consider other possible inputs in working out the

output result. In fact this is only the case if the model is linear, which most such models are

not.

For example, imagine a company that organises conferences. Before deciding to go ahead

with advertising a conference and booking a venue it estimates the attendance at the

conference and puts its best guess into a financial model to decide if the conference is

worthwhile. There is a chance that too few people will be interested in a conference and that

it will have to be cancelled, saving most costs but not the non-refundable deposit on the

venue, which is usually quite large. However, in most cases the impact of cancellation,

including the non-refundable deposit, is not considered at all in the model because the mostlikely attendance is enough to avoid cancellation. This is clearly incorrect. The correct

valuation should be lower to reflect the impact of potential cancellation.

Another reason that best guess models tend to be wrong is that they assume all decisions are

made by the company at the outset. There is no opportunity to respond to events so the value

of these options is not considered. New techniques now becoming popular combine

discounted cash flow models with decision trees to give a more realistic valuation.

Where risk management fits in the Beyond Budgeting

model

Risk management can contribute to the Beyond Budgeting model in three places:

empowerment, action planning, and forecasting.

Empowerment: what should we talk about?

Even under radical decentralisation the top management team in a company still has a

legitimate interest in the decisions and action plans of the business units to whom they have

given power. When they meet the business unit managers what should they talk about?

This is a dangerous encounter. Here is where central control could try to reassert itself as

Directors follow their natural instinct to dominate and direct. A discussion of performance to

date against targets would be wrong and crush empowerment, so it is vital to be clear about

the rules of these conversations and avoid allowing old habits to insinuate themselves.

In the June 2002 version of the "Beyond Budgeting White Paper" there is a section on

empowerment that says of companies who have gone Beyond Budgeting that:

"They have challenged local strategies and action plans to ensure they are sufficiently

ambitious but at the same time that they are robust and that risks are appropriate."


12/15

The budgetary control interpretation of these words is that senior management have

challenged targets to ensure they are ambitious yet achievable. This is not the correct

interpretation.

The risk/uncertainty management interpretation is that senior management have challenged to

see that local management have thought properly about the full range of possible outcomes,and that their plans include steps towards very good outcomes as well as steps designed to cut

the risk of poor outcomes.

This can be broken into two elements:

Are we comfortable with their thought process? Have local management followed

a good process and thought things through effectively? Do they seem to know what

they are doing? Do they have a command of the facts? Clear thoughts? Adequate

information to hand?

Are we comfortable with their current conclusions? Can their current conclusions

be improved on? Sometimes the senior team may be able to offer the benefit ofexperience and a different perspective to improve risk assessments and inject new

ideas into action planning. Clearly the senior team cannot expect the local team to

take their suggestions as instructions to be followed until the next meeting.

This element of challenge might be missing altogether where decentralisation is very

effective and local management highly competent.

The format of an effective risk management workshop could be adapted to this purpose,

providing a form that clearly discourages target setting behaviour. Risk management concepts

can provide a common language to keep these conversations honest.

Furthermore, these meetings can be described to investors as a demonstration of good

corporate governance and to reassure them that their investment is safe.

Action planning

Risk management can also be added to action planning to improve plans. Ideally, it should be

an integrated part of action planning so that plans are shaped from the first by risk

assessments and risk management heuristics.

There are already hints of this in some Beyond Budgeting publications. For example, in"Beyond Budgeting", an article for Strategic Finance October 2000, by Jeremy Hope and

Robin Fraser, the section on performance management includes the recommendation for:

"An investment management process that forces managers to build flexibility and "exit

routes" into their forecasts and in which execution is made at the latest possible time."

In "Beyond Budgeting ... building a new management model for the information age" in

Management Accounting January 1999 Jeremy and Robin wrote:

"The new emphasis is on looking ahead and being in a position to take advantage of new

opportunities and counter potential threats by using an advanced information system to makedecisions early."


13/15

And also:

"By monitoring the key business value drivers and especially the leading indicators that tell

us something about future performance, we are in a much stronger position to take action

before potential problems translate into negative numbers."

They quoted Ole Johannesson, VP finance of Volvo Cars, as saying:

"Today we need a process that enables us to react not only immediately but even

beforehand."

Both these comments show that Beyond Budgeting aims to go beyond even instant responses

to events. How can this be achieved if not by anticipating potential outcomes and acting in

advance to modify their likelihood and impact?

The hints are there but, based on publications to January 2003, there is scope for adding a lot

more to the risk management element of the Beyond Budgeting model.

Forecasting: distributions not single points

References to rolling forecasts are too numerous to mention in Beyond Budgeting

publications. What form should those forecasts take?

The most common form for forecasts is one that states the most likely outcome only. e.g. "the

NPV of this project is x", or "free cash of y", or "operating profit of z on turnover of x".

This is not very helpful to action planning and does not help people to appreciate the full

range of potential outcomes and their relative likelihoods. Uncertainty is suppressed.

A much more useful forecast is one that states the probability distribution of whatever is

being forecast. Uncertainty is explicitly represented, discouraging uncertainty suppression.

This is more helpful for action planning. One can ask questions like "What is the likelihood

that the NPV of this project is negative?", "On current funding plans, what is the probability

that our free cash flow will be less than the amount we need to maintain dividends at last

year's level?", "What is the likelihood that demand for this product will require warehouse

capacity greater than our current planned levels?"

This is not as difficult to do as most people think.

It is not necessary to gather a lot of data in order to provide useful distributions.

Even a complete guess as to the distribution would be better than ignoring uncertainty

as it discourages uncertainty suppression and encourages planning for a range of

outcomes. Getting more data and better models to support the distribution simply

increases its value. Most distributions are supported by a model that combines a

mixture of purely subjective and data-supported estimates. Done correctly this is more

reliable than unaided human judgment.

Techniques and software are readily available to do this to a level of sophistication

far greater than any company could reasonably require. Even using the most common

spreadsheet software, Microsoft's Excel, it is easy to set up Monte Carlo simulations

to explore how events could play out, and run the simulation thousands of time in lessthan a minute. @risk is an example of a spreadsheet-like program that has built-in


14/15

Monte Carlo simulation and the whole model is in terms of probability distributions

rather than single numbers. It is cheap and easily available, as are its competitors.

It is not necessary to be a brilliant statistician to build or use these models. Professor

Sam Savage has pointed out that software tools for working with probabilities are

becoming easier to use and more powerful, leading to what he calls an era of"consumer stochastics" where many people will use statistical models and tools

whose operation they don't understand, just as they would use a car or computer

despite having little understanding of its inner workings. Professor Savage's work is

fascinating and his papers entertaining as well as useful.

It is common to offer a single-point best estimate and an optimistic and pessimistic range. If

"optimistic" and "pessimistic" are defined in probability terms this is a form of probability

distribution. (If you can do this you are very close to being able to show the whole

distribution in a graph too.) If these terms are not defined then the range is still helpful as a

reminder that uncertainty exists, but is not as useful.

Even so, forecasting outcomes as probability distributions is more difficult than single-point

forecasting and certainly less familiar for most accountants and business analysts. There are

many alternative techniques, some of which are hard to understand and implement.

Though forecasting with probability distributions may seem unfamiliar and complex now, in

years to come it will be as familiar as discounted cash flow models are today. Forecasting

distributions is a tangible expression of commitment to keep uncertainty in mind and not

make the mistake of assuming one future. It also puts business leaders in a position to say

something specific to analysts and investors without actual stating a single-point forecast or

target.

The value of risk management within the Beyond

Budgeting model

The sense of control, and protection against future uncertainties, that business leaders and

investors want does not have to be provided by "command and control" leadership, where

decisions are made centrally, and where original objectives are the yardstick of success.

Beyond Budgeting offers a welcome alternative based on:

Giving people a direction to move in.

Relative measures of performance that flex with conditions, so staying relevant.

Superior forward looking information.

Adding Risk/Uncertainty management to that list would further strengthen the sense of

comfort. It would also allow business leaders to make more detailed statements about the

future to analysts, if they wanted to, without stating targets.

Summary of recommendations for Beyond Budgeting

implementations
http://www.drsamsavage.com/http://www.drsamsavage.com/


15/15

Companies planning to manage their performance better by moving to the Beyond Budgeting

model should:

Review existing procedures for formal risk management and around major business

decisions such as capital and revenue projects and decide what reforms are needed if

risk management is to support rather than undermine the Beyond Budgeting initiative. Manage the uncertainty and risks of the Beyond Budgeting implementation itself.

Internal Controls Design Website by Matthew Leitch

Documents

Transcript of Internal Controls Design Website by Matthew Leitch