Risk Management & Risk Imagination for Boards - Q&A with Ken Bacon
In the past 4 years, risk has shown up in business in ways we’ve never seen before. But though the risks have changed, the fundamental importance and pillars of risk management haven’t. In this Boardspan Backchannel, Ken Bacon, a longtime corporate leader, and board member in financial services, talks with Boardspan CEO Abby Adlerman about what has and hasn’t changed in board risk oversight.
About Ken Bacon:
Ken is Co-Founder and Managing Partner at RailField Realty Partners, a real estate asset management and investment firm. He is also Chairman of the Board of Welltower and serves on the boards of Comcast Corporation, Ally Financial, Arbor Realty Trust, and Welltower. Before joining RailField, Ken was Executive Vice President at Fannie Mae.
Abby Adlerman: Ken, thank you for taking the time to speak with me today. Risk is a topic on every board member’s mind, so let’s jump right in. How have you seen boards evolve over the last few years when it comes to addressing risk?
Ken Bacon: I’d say that technology has brought about change. Every board, every industry must now think about risks, especially after these past two years. Cybersecurity is one obvious topic although there are many more.
As society has changed, new risks have emerged. Reputational risk used to mean you were worried about your company or its management being associated with something criminal or unethical. It was relatively rare for private opinions of management or the political stance of the company to get much traction in the media or the minds of the public. But it’s different now.
Operational risk also became more prominent during the pandemic as organizations became leaner and global supply chains were affected. Financial services has always been focused on credit risk, but with recent events you’ve got all these other risks across industries.
“One of the key elements of risk is imagination. It’s critical to imagine. It’s necessary to push yourself to think, ‘What if?’”
AA: One of the confounding things about risk is that it’s often unpredictable. Any advice or thoughts about managing the unknown, the unexpected timing?
KB: That’s the thing – you must be ready for the unknown. You need systems in place that are not only resilient, but also flexible and responsive. For example, take cybersecurity. Boards need to ask: What happens if we get attacked? What’s our backup plan? What’s our level of resilience? What do we do if there’s ransomware? Who has authority? You need to create multiple scenarios based on things that you’ve read and things you’ve heard about. One of the key elements of risk is what I call imagination. It’s critical to imagine. It’s necessary to push yourself to think “What if?”
The pandemic is a classic example. During the pandemic, every financial institution increased their reserves. Everybody assumed that it was going to be a horrible economic event. No one anticipated that the government would respond as aggressively and as quickly as they did. Suddenly people were paying their bills. There were rent moratoriums. Used car prices went up. Strange things happen that aren’t always expected.
AA: The pandemic is just such a great example; we all saw that everybody was blindsided by it. Are there ways for boards to pre-empt, or at least manage, the most salient risks?
KB: There are some risks that you know about — you need to create a framework for analyzing those risks as well as identifying new risks as they arise. You can’t eliminate every risk, but you can create processes and policies to manage and mitigate risks. It’s important to draw a distinction between the responsibilities of the board and the responsibilities of management: The role of the board is to establish the risk parameters for the organization. Management runs the business within these parameters, subject to board oversight.
AA: Great anecdote to make it real. As you’ve pointed out, risk isn’t a new topic.
KB: At Ally, we’ve had a great history of lending for almost 100 years, so we’ve been through all types of cycles on the credit front. Experience is a great teacher. As a rule, most businesses aren’t fond of lot of regulations, but I’ll say that the regulatory system has left banks in very good shape. During the pandemic, people were able to get money out of the ATM, get a mortgage or borrow to buy a car. There was liquidity. Despite supply chain disruptions and a remote working environment, your bank was operating smoothly. The financial system was and is resilient.
“I think the biggest mistake a board can make is to assume they don’t need some type of risk function”
AA: Definitely. A company that has faced risks in the past and learned from the experience might be able to respond better this time around— there’s definitely some good that comes out of the tough times. Do you think there’s such a thing as good risk?
KB: Absolutely. If you’re in financial services, your job is to identify good risk. You don’t want to eliminate it. I think people often view risk as a negative thing, but good risk assessment has been a key to the American economy. All the things you can do through the financial system are because people can assess risk.
AA: How can a board member apply the same lessons learned in the financial industries to other companies? How would it apply to tech, healthcare, or consumer companies?
KB: I think the biggest mistake a board can make is to assume they don’t need some type of risk function. You may not have a risk committee, but you need someone on the board thinking about it, because risk affects everyone. Ultimately, the full board needs to be engaged.
AA: What’s the biggest lesson you’ve learned, Ken, in your career, about managing risk? What are some big takeaways for our readers?
KB: Limited vision, to me, is one of the biggest impediments to efficient risk oversight. In many instances, it’s a lack of imagination. We are often limiting our risk management by what was learned from the past and what we think is the worst thing that could happen. I’ll give you an example: the financial crisis.
I was at Fannie Mae, on the multi-family side, and like many people in commercial real estate, I knew what a meltdown would look like. On the single-family side, banks and agencies got hurt because there had never been a national decline in home prices since the Great Depression. The single-family market had never fallen off a cliff. There were borrowers who were not financially or emotionally invested in their properties and were therefore likely to default. People couldn’t imagine those scenarios because it was unthinkable for people to pay for cable yet not pay their mortgage!
So, you should ask yourself “What if?” You must think through risk and tell yourself that while it might sound crazy, while it might not have happened before, it needs to be considered.
AA: Ken, it has been an absolute pleasure talking to you. Thank you so much for sharing your wisdom. Any final thoughts or advice for our readership as they plan their own risk management and risk mitigation at the board level?
KB: Thinking about risk in all dimensions, reputational, legal, regulatory, operational – is the essence of business. The ability to generate earnings is based on your ability to create a competitive advantage and earn a return, but it’s also based on how you manage the risk associated with generating those earnings. It’s vital to realize that risk is inherent in business. And if you embrace it, if you make risk management part of your culture, you’ll be a better company.
Enjoying the Backchannel?
Check out our conversation with board powerhouse Maggie Wilderotter about what to consider when you’re trying to build a great board.
[Photo by Taylor Wright at Unsplash]
