Many thanks to OpenPages Vice President of Marketing Gordon Burnes, who carved out time in recent weeks to chat about risk management with me via e-mail.

Our conversation took time to get rolling, with Burnes seeing to business in Brazil and my own Big Bend National Park interruption (Viva Terlingua!). Now that I’ve dried off from a dip in the Rio and survived the attention of a curious javelina, I’m ready to share the first portion of our exchange.

This part of our discussion touches upon risk management’s role as a strategic differentiator, Toyota’s blind spot, and the greening of risk maps…

Eric Krell: Gordon, thanks for taking the time to chat. The importance of risk management has been hammered home on a daily basis in the past month, particularly with Toyota’s challenges playing out in a highly public manner. I’m curious to hear your thoughts on Toyota’s risk management situation. Before we get into that, we should address a larger question: Is risk management a certified strategic differentiator? And, if so, are companies equipped to compete on the basis of their risk management capabilities? Those are two BIG questions, so feel free to start with the first one …

Gordon Burnes: Risk management is most certainly a strategic differentiator. Putting capital “at risk” is the way companies differentiate strategically: whether it’s getting into a new market, offering a new product, or figuring out how to hedge a large position in the equity markets. Managing the risks associated with strategic differentiators allows companies to sustain their advantage.

This is very theoretical, so let’s turn to Toyota. They optimized their culture around quality for many years; anyone on the assembly line could stop the production line if that person saw a defect. And this was their strategic differentiator. When they shifted the culture to one that valued and rewarded volume production, they lost sight of the controls around quality. This story illustrates the importance of tone at the top, which is critical to any risk management program.

Eric Krell: Thanks, Gordon. What you say makes perfect sense to me. There is one point I want to get into more deeply because it touches on a risk management issue that I keep coming back to – let’s call it “risk culture.” I agree that Toyota optimized around quality, but I wonder if they optimized only part of their culture around quality – the “stuff” part. What about the other part of culture, including what you mention – tone at the top? I’m not sure Toyota workers or many executives felt comfortable going to their superiors with bad news. Or, if they did share bad news about quality issues, I’m not sure how that news was treated.

We saw differences in “risk culture” play out during the financial crisis on Wall Street – an industry I know you know well. Some companies responded to “risk news” that was sent upwards in the organization much more effectively than other firms did … at least that’s what that vast majority of the after-the-fact stories and reports indicate.

I’m not asking you to respond to what may have occurred at Toyota (unless you want to); I am asking you (a) what you think about this notion of a “risk culture,” and, if it exists, (b) how companies can assess the strength of their risk culture and, if necessary, strengthen it?

Gordon Burnes: Kermit the Frog was definitely not a risk manager. I say that because he sings that song about it not easy being green. I think in many organizations it’s easy to see a “greening” of risk exposure charts because risk managers and, maybe even more so, their managers are reluctant to surface bad news. If a risk exposure above a certain level is surfaced to the board, they will require an action plan to deal with it, and there may be operational reasons why the managers don’t want to or don’t think they can adequately address the issue.

This “greening” is an example of weak risk culture. One organization that presented this week at the Global Conference on Operational Risk in Boston deals with this issue by having a 1-5 score on their risk category status, but the middle score, 3, requires remedial action, precisely because they want to drive behavior around risk mitigation.

I think that’s the main point: Tone at the top has to be followed up with policies and procedures that engender the behavior that reinforces the culture. This is why we think that technology can actually help companies strengthen a “risk culture” by enforcing behaviors — programmatic risk assessments, consistent scoring, action tracking — that are consistent with a strong risk culture. ###