that’s right
thank you we live in an increasingly
complex world and one of the results of
that complexity is that a number of
organizations are surprised when risks
emerge that actually take them down on
the private sector side you can think of
the BP Gulf oil spill where complexities
led to a huge disaster in the Gulf of
Mexico you can think of the GM ignition
switch problem and in those cases of
course people fire the CEOs they fire
people companies are hurt seriously in
the case of the Takata airbags you may
actually see a company go out of
business on the government side you see
the same problem the Veterans
Administration had a series of Veterans
Hospitals and it turned out that over
stretched hospitals have long wait times
but the head of the VA had let it be
known he didn’t want to hear about long
wait times he wanted to hear that
everybody was being dealt with within
two weeks so if you tell me that’s what
I got to say that’s what I’ll say and it
turned out that VA hospitals in fact had
such long wait times that veterans were
dying before they got their health care
and when that finally came to light once
again they fired the secretary they
fired people down the organization and
Congress started to do surgery on civil
service protections in the VA the same
thing happened with the IRS where people
were looking at exempt organizations and
decided not very bright to look at
organizations that all had the name Tea
Party in it when that came to light the
resulting explosion led to firing people
from top of the organization down and
Congress again did surgery on the ir
the common element and all of this is
the people at the top sit there thinking
that everything is great and if you were
to talk to people down in the
organization what you’d find is gee we
got problems we got problems but there
seems to be a layer of cork that stops
the information from rising from the
bottom to the top I first learned about
this when I was on the staff of the
Financial Crisis Inquiry Commission and
we would have all these officials from
failed companies telling us how nobody
could foresee the drop in housing prices
well it turned out in the midst of all
the companies that failed there were a
number of companies that navigated the
crisis and I began to understand the
difference between successful companies
and unsuccessful companies and the
answer in my mind had to do with
information flow that in the successful
companies you had a flow of information
from bottom to top and top to bottom and
across the silos so the Baron’s would
talk to each other so in in JP Morgan
Chase all of a sudden their mortgage
side realized that they were having
serious delinquencies and the news
immediately went up to the operating
committee at the very top of this multi
trillion dollar organization and there
was a food fight among the executives
what’s going on here and they realized
their delinquencies were better than
their competitors delinquencies so the
instructions went down get rid of
subprime mortgages and that was in
October of oh six well before the crisis
the same thing happened with Goldman
Sachs in December of oh six where
somebody reported the head of their
mortgage desk reported that they where
their models said they were supposed to
make money for two weeks they had lost
money immediately the news went up and
Goldman hedged their subprime portfolio
those were the successful companies so
the lessons I took for them from that
or that information flow is essential
but also warning signs or the air if you
look at the post-mortem on the BP Gulf
oil spill or on Massey mining where 29
miners were killed or any number of
disasters the NASA Space Shuttle
disasters
it is so clear in retrospect that
there’s a problem Enterprise Risk
Management is a way to deal with that
and it asks a simple question what are
the major risks that could stop us from
achieving our mission and the whole
point is you want to look at the big
risks government particularly but also
the private sector are always distracted
by all these little risks that they’re
worried about that they tie up in red
tape and in fact what you want to look
at are the really big risks and if you
can build that into your culture you can
have a much more robust capacity to
understand the vulnerabilities that
you’re otherwise going to run into
without appreciating them so one of the
failed companies and the financial
crisis the chief credit officer went to
his executive vice president and said we
got problems we’re not pricing for the
mortgages were buying and the executive
vice president said how come you’re the
only person in the company who believes
in your models well that was really
stupid by the way the chief credit
officer is still there and the executive
vice president is long gone but in the
case of goldman sachs when we
interviewed the head of the mortgage
desk we said why did you report the bad
news to the top and he said part of my
job is to make sure that the people at
the top of the organization know what
they need to know to make good decisions
and that was a successful company so
what you need to make enterprise risk
management work is first of all support
from the top
I’ve just been inserted into a
government agency actually about six
months ago was supportive and under
secretary
and she had us gather all of the senior
executives and talked to them talk about
the big risks and what you’ve got to do
is overcome the tendency of barons to
say there are no risks I run a good
department and instead to understand
everybody’s got risks we’re not blaming
you what we want to do is solve problems
and if we can hear about these risks
early we can deal with them before
rather than after something bad happens
in the earlier you hear about it the
easier it is to deal with an emerging
risk and what we did over time was
infuse the culture of the organization
so people understood we’re not playing
gotcha what we’re trying to do is help
you solve problems that otherwise may be
too big for you and by the way we’re all
in this together in today’s complex
world with the kind of reputational risk
that beset Sall organizations were all
in this together
and we had better work on it together so
that’s Enterprise Risk Management and I
really hope you look into it because it
is a really powerful management tool I’d
like to finish with one of the actually
the best quote from the whole Financial
Crisis Inquiry Commission study and
that’s from a guy named John Reed who
was head of Citigroup back in 2000 and
was eased out at that point before
Citigroup got into all of its trouble
and he asked the question why does a car
have brakes a car has brakes so it can
go fast if you didn’t have brakes
you’d creep around at two miles an hour
if you’ve got brakes you understand what
the problems are and you can really go
forward at 65 miles an hour and the
whole point of enterprise risk
management is not to create another
layer of bureaucracy but rather to have
your chief risk officer facilitate the
conversations and then the discussions
about priorities
one of the really big risks we’ve got a
grapple with it’s a very powerful
management tool and I hope you all have
a chance to take a look thank you [Applause]