Prologue: This article was conceived in the first months of 2023 when large stock price declines in well-known corporations began to occur. These declines signaled something possibly amiss with decisions concerning corporate strategy, reputation, financial well-being, marketing, or external market conditions. Rather than react to these early events, publication was postponed to gather additional and more varied information regarding executive-level decision outcomes affecting business strategy and ultimately business success. Consequently, publication of this article was delayed until July 2024.
Introduction
Events beginning in 2020 and continuing into 2024, suggest the practice and value of Enterprise Risk Management or “ERM” has been discounted as a business function, or perhaps simply discarded. Significant declines in stock prices of large publicly traded companies are the tell.
ERM rose to prominence within the last 10 – 15 years as the means to protect the long-term interests, including reputation and profitability of businesses to ensure sales, revenue, and equity growth. Investors looked to CEOs, C-level suite executives, and Chief Risk Officers, to guide corporations through emerging and future uncertainties.
ERM seemed to have much promise, but was it a bust or in remission and there is a long-game being played that is not obvious?
Before delving into further into contemporary ERM practice, a limited review of recent risk management history is informative.
We can go back to 2004 for the COSO Enterprise Risk Management – Integrated Framework (1) and five years later to ISO 31000:2009 Risk management – Principles and guidelines (2), and another eight years later to the 2017 COSO Enterprise Risk Management – Integrating with Strategy and Performance Framework revision. (3) Followed in 2018 by the revised ISO 31000:2018 Risk management guidelines (4).
According to the COSO 2017 framework’s FAQ, “Enterprise risk management is no longer focused principally on preventing the erosion of value and minimizing risk to an acceptable level. Rather, it is viewed as integral to strategy setting and the identification of opportunities to create and maintain value.” The 2017 COSO Framework explicitly linked ERM to strategic objectives.
The ISO risk management body of knowledge migrated from a (2009) focus – on what to do process guidance at operational levels – to an emphasis on leadership (2018) by top management to integrate risk management throughout the organization and most importantly with organizational governance.
It is important to note that risk management is concerned not only in negative events and their effects on businesses, programs, and projects, but also in positive conditions that suggest a future, but uncertain opportunity.
One explanation which might stretch the imagination in the current environment, is that some businesses are pursuing opportunities, i.e., intelligent risks, for the long-term. Meaning that potential future opportunities were recognized, but with some uncertainty of success. But businesses were willing to tolerate short-term financial risk for larger long-term gains.
I define an intelligent risk as an opportunity in which the potential gain outweighs the harm or loss that could impact the organization’s sustainability if the opportunity is not explored. –
Dr. Harry Hertz (5, 6)
As Dr Hertz noted, quoting the Committee of Sponsoring Organizations (COSO) of the Treadway Commission, the main purpose of ERM is in setting an organization’s strategy and objectives to achieve the appropriate balance between growth and return goals and related risks. (7)
Robert Kaplan and Annette Mikes wrote in 2012 of different categories of risk to help enable understanding distinctions among them. (8) These were described as (1) Preventable risks internal to the company and could be unethical practices, or process failures (2) Strategy Risks are those that a company engages in with the promise of superior financial returns., and (3) External Risks are those beyond company control. The authors note that risk any category can be fatal to the company.
Kaplan and Mikes discussion of Rules-based Risk Management was especially informative in that this approach may be best applied to Preventable risks associated with internal to a company’s operations, e.g., compliance, rather than to Strategy or External Risks.
One might think the following are timeless, doomed to be repeated by generations of executives, managers, and employees, as they seem to be.
Human behaviors include a range of factors that affect decision making concerning strategy, internal operations, and external events.
These factors include (a) overestimating ability to influence events, (b) overconfidence about accuracy of forecasting and risk assessments; (c) restricted view of potential outcomes; (d) using available information to predict uncertainty; (e) having a confirmation bias to support a particular position; (f) suppressing information that contradicts a particular position; (g) group think; (h) accepting failures and defects; (i) misjudging signals as false alarms; and (j) decentralizing risk management and responsibility across business functions. (8)
Mckinsey & Company, the global consultancy, describes two sources of risk. First, external factors that can include supply chain disruptions, pandemics, competitors and cyberattacks, among others. The second source may include poor executives’ decisions, reputation affecting information exposure, and the risk of missed opportunities. (9)
Perhaps most relevant today, McKinsey & Company clearly stated that organizations incur business risk when realized that may tank profits or bankrupt the business. (9)
Was the ERM design as embodied in the COSO and ISO publications deficient or remiss in addressing the need for continuous surveillance of the business environment even though strategy was the focus?
Or was it that the human capital required to make it work a rare and difficult to acquire skill akin to that of a prophet?
Or did a rule-based approach, effective for managing preventable risks, that limited the scope of ERM practice to one of known conditions to the exclusion of inconvenient or unthinkable future events?
Or, did external business conditions change suddenly and unexpectantly such that conventional ERM thinking was unprepared?
Let us turn back the calendar 39 years to 1985
The ISO 9001 Quality Management system standard did not exist, at least in the form generally recognized and was not published until 1987, as ISO 9001:1987. (10) The Malcolm Baldrige National Quality Award also did not yet exist and was established by Congress as the Malcolm Baldrige National Quality Improvement Act of 1987 (Public Law 100-107).
The first Malcolm Baldrige National Quality Award recipients were recognized at a White House Ceremony on November 14, 1988. (11)
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) internal control framework (fraud deterrence) did not exist, it was not published until 1992 and released in again in 2013. (12) In 2017 COSO updated the framework to emphasize “Importance of considering risk in both the strategy-setting process and in driving performance”. (13)
This lack of what we recognize today as ERM might be considered an explanation for poor decisions in the 1980s.
New Coke – A Strategic Blunder pre-dating ERM
Coca-Cola Company’s debacle entered the public consciousness on April 23, 1985 with the introduction of the then new formula that came to be known as “New Coke” replacing its original formula, “Coke”. (14)
“Some may choose to call this the boldest single marketing move in the history of the packaged-goods business,” CEO Roberto Goizueta said. “We simply call it the surest move ever made.” (15)
“I’ve never been as confident about a decision as I am about the one, we’re announcing today.” – Coca-Cola president Donald Keough (16)
This was the company’s response to Pepsi and a long running competition between Coke, with declining market share, and Pepsi.
In that pre-Internet age, things quickly unraveled with New Coke called “the biggest marketing blunder of all time.” (17)
By mid-May 1985, the company was receiving 5,000 negative phone calls a day, by June negative call volume swelled to 8,000 calls a day. The previous version of Coke was brought back as “Coca-Cola Classic” on July 11, 1985, 79 days after launch of New Coke. The Coca-Cola Company reportedly lost millions in research ($4 million in development costs) and advertising costs. (18)
Poor strategy, internal issues, or external uncontrollable forces?
Recent ERM Failures
Target
On October 6, 2022, Forbes reported Target’s share price declined 32% from around $232 in October 2021 to about $145 at the beginning or July 2024. Forbes commentary attributed this stock decline to disappointing earnings in 2022, an economic slow-down, supply chain problems, and changing consumer sentiment coupled with higher fuel, freight, and transportation costs. (19)
Target (symbol: TGT) was trading about $91 in April 2020, when COVID-19 shutdowns were in full swing, rising to a high of about $269 in mid-November 2021. Then falling to about $150 in October 2022, subsequently declining to about $102 in October 2023 and rising again to $150 in February 2024.
A later Forbes article opined on some reasons for Target’s stock price decline, including changes in consumer spending habits. (20)
Let us use the mid-November 2021 price high of $269 and the $150 close on 16 February 2024 as a check point, a decrease of 44%.
Between approximately May and June 2023, Target’s market value declined by about $14 billion, prompting a lawsuit filed by a Target investor. (21)
In August 2023, America First Legal filed a lawsuit against retail giant Target for allegedly misleading shareholders with false statements about its political/social risk monitoring. (22)
Poor strategy, internal issues, or external uncontrollable forces?
Yellow Trucking Company
In August 2023, Yellow, the trucking company, became the largest trucking bankruptcy in US history. Yellow specialized in Less Than Truck Load (LTL) shipments and was the number three LTL carrier by revenue, just behind with Fedex and Old Dominion. Yellow had just escaped a Teamsters Union shutdown.
Nevertheless, after the strike threat in late July 2023, Yellow’s freight volume dropped 80% within a week and the company shutdown shortly thereafter – with 30,000 job losses. (23)
Poor strategy, internal issues, or external uncontrollable forces?
CVS Health
In November 2021, CVS Health announced plan to reduce the number of stores, 900 over the course of three years. CVS Health’s rationale was population shifts, changes in consumer purchase, and future healthcare needs. Job cuts were expected to total about 5,000.
To save the company money so it has a better chance of surviving, CVS Health is slashing mostly corporate jobs, The Wall Street Journal reported. Workers at CVS stores, pharmacies, and clinics are not expected to be negatively impacted by the layoffs and store closures – except, of course, for the employees at stores that are closing.
According to CEO Karen Lynch, the changes will allow CVS Health to “be at the forefront of a once-in-a-generation transformation in health care.” (24)
In May 2024, CVS had its biggest selloff in 15 years, after missing first quarter earnings expectations. The selloff was reportedly affected by increased outpatient utilization use of supplemental benefits and an insufficient Medicare Advantage rate. The CVS Medicare Advantage star rating also decreased, which is used to compare a company’s Medicare Advantage and Medicare prescription-drug plans.(25)
CVS Health’s stock price was selling for about $92 a share in November 2021, dropping to $59 at the end of June 2024.
Poor strategy, internal issues, or external uncontrollable forces?
DISNEY
Disney’s stock price has fluctuated substantially since 2020 due to a variety of events affecting the company. Share price was $91.81 on March 12, 2020, $192.64 on March 3, 2021, and $101.78 on May 24, 2024. A 2023 filing with the Securities and Exchange Commission referenced “risks relating to misalignment with public and consumer tastes.” (26)
Poor strategy, internal issues, or external uncontrollable forces?
Hertz
Hertz bet big on electric vehicles and lost. The CEO for about two-years, Stephen Scherr resigned as Hertz Global Holdings CEO at the end of March 2024. Hertz announced its decision in January to sell about one-third of the company’s global electric vehicle fleet, about 20,000 of them, shifting its investment back to gas-powered vehicles.
Electric vehicles evidently experienced higher repair costs and low rental demand. Hertz subsequently announced its biggest quarterly loss since 2020. (27)
Poor strategy, internal issues, or external uncontrollable forces?
Peloton
Peloton provides home exercise equipment. Everyone remembers the 2020 COVID pandemic when telework became the norm for millions of people. Sales surged driven by COVID and Peloton invested hundreds of millions of dollars in its supply chain in response to product demand.
But, as COVID drove the surge in demand for home exercise equipment, post-COVID brought a steep drop in demand. The company which had about 8,600 employees in 2021, has since gone through five layoffs leaving just 3000 employees. Recently announced layoffs may affect another 400 employees.
CEO, since 2022, Barry McCarthy stated during Peloton’s Q1 2023 earnings call the company was done with layoffs and that the “ship was turning.” He is now leaving the company after presiding over the company’s massive loss of share value. (28)
Peloton’s stock price dropped 92% since its high of $162.72 in December 2020 to $3.64 in May 2024, a drop of 98%.
Poor strategy, internal issues, or external uncontrollable forces?
Boeing Aircraft
Unfortunately for Boeing, mentions in the news have focused on in-flight safety issues and cast a shadow on Boeing’s aircraft safety.
The negative effects on Boeing, the manufacturer, airlines, customers have been unsettling. Aviation is a big component of the economy, and problems potentially affect just about everyone.
Boeing aircraft have had nine reported incidents from January to March 2024. (29)
The Federal Aviation Administration has gotten involved resulting in an inspection of Boeing’s production assembly line found a lack of compliance with manufacturing quality requirements. Boeing failed 33 of 89 product audits at the 737 Max aircraft factory.
Why is Boeing having so many public safety issues? Is it cost cutting as some suggest? Competition with Airbus? A toxic Culture? Poor Quality Control? Revenue also decreased $355 million in the first quarter of 2024. (30)
The FAA subsequently required Boeing to develop a corrective action plan to address quality issues. (31)
Poor strategy, internal issues, or external uncontrollable forces?
Walgreens
Walgreens was trading around $52 in June 2019, now five years later it is trading around $12.19 a share on 27 June 2024, a 77% decline. In early January 2024 share price was $25.57, which dropped 52% to $12.19.
Currently Walgreens is planning to close approximately 25% of its 8,600 stores, about 2,150 stores. Apparently, price competition is contributing to Walgreens woes, as are problems in the pharmacy market facing low reimbursement rates.
Other factors include the 18 – 20 million Medicaid initial customer surge resulting from the COVID pandemic, then significantly declining post COVID. Pharmacist labor issues and name brand prescription losses due Pharmacy Benefit Managers’ role in the market also affect Walgreens and others. (32)
Success for non-traditional healthcare providers has been elusive not only for Walgreens (closed 140 of its Village MD primary care clinics, with plans to shutter 20 more), but also for Walmart (closing all 51 of its doctor-staffed health clinics as part of an announcement that its Walmart Health initiative is shutting down), and for a high-profile joint health venture among Amazon, Berkshire Hathaway and JP Morgan Chase that failed several years ago. (33)
Poor strategy, internal issues, or external uncontrollable forces?
ERM Expectations
A December 2022 article by McKinsey discussed risk and resilience priorities from the Chief Risk Officer perspective. The article stressed that when business environments are subject to constant disruption, superior risk management becomes a competitive advantage in all industries. It also noted that risk functions need to develop more sophisticated risk identification approaches to rapidly identify and respond to new risks. (34)
The three Lines of Defense Model is a common ERM component. For example, Operational Management (front line managers who own a risk and corresponding controls) is the first line. The second line is an internal monitoring and oversight function that develops and implements internal control and risk processes. The third line of defense is internal audit that provides assurance to the Board of Directors and senior management through systematic evaluation and improvement of risk management, internal controls, and governance processes. (35)
Public companies are required to have Boards of Directors. Companies listed on the New York Stock Exchange and the Nasdaq must have boards with majority independent directors. Key board committees such as the audit committee are also required to include independent directors.
Boards serve a fiduciary role, making decisions on behalf of the company and its shareholders. Board members’ responsibilities include helping set broad goals, supporting senior management’s achievement of goals, and ensuring provision of adequate resources. (36)
How, reasonable expectations for ERM were practiced, e.g., making superior risk management a competitive advantage, such as confronting market disruption, as well as how Boards’ fiduciary responsibilities were executed to minimize financial risk in the example companies remain unknown.
Summary
• The current and future value of ERM may be uncertain, but how widespread this uncertainty is remains unknown.
• Retrospectively, CEO statements about expected future success seem wildly optimistic now (e.g., Coke, Peloton, CVS, and perhaps Hertz) and were probably overly optimistic when made.
• Retail pharmacies and new venues for delivery of healthcare services are facing an uncertain future for a variety of reasons including those both internal and external to the companies.
• The COVID impact in early 2020 through 2021 was a massive anomaly, creating initial and later unsustainable pharmaceutical product and service demand. Consequently, the contraction for companies like Peloton, CVS and Walgreens was probably predictable, significant and may soon be catastrophic.
Conclusion – What happened to ERM?
Of course, it is impossible to know what may have transpired without inside information on the discussions of CEOs, CFOs, CROs, Boards of Directors, and others in the examples cited – the inescapable conclusion is clear – bad decisions resulted in $ billions in losses to society.
But the fundamental question remains – given the maturity of ERM guidance as evidenced by the 2017 COSO and 2018 ISO revisions and other literature on ERM – what happened?
Risk considerations for the examples cited above for strategy, internal operations, and external events were for the most part publicly invisible when using measures for results – brand equity protection (market share), shareholder return (dividends and share value increase), and reputation (trust).
Executive meetings, market assessments, risk assessments, customer sentiment surveys, consulting support, and similar related ERM activities might demonstrate internal existence of due diligence in terms of risk identification and mitigation, but at the end of the day if results were not delivered on measures that matter then these activities’ contributions were nil.
How publicly traded companies manage risk in turbulent times might very well affect your choice of companies you invest as well as your choice of employers. What next for ERM?
Epilogue: Why businesses made the business decisions they did was out of scope of this article. Only publicly reported information was considered and then only in cases where decision errors appeared to result in public display of financial and reputational loss. If ERM, with a 20-year ramp up and growth is in decline, might other business functions also be in decline?
REFERENCES:
1. The Committee of Sponsoring Organizations of the Treadway Commission (COSO). Enterprise Risk Management – Integrated Framework. https://www.coso.org/guidance-erm
2. International Organization for Standardization (ISO). The first international standard on the practice of risk management was published in 2009 as ISO 31000 Risk management — Principles and guidelines. https://riskandinsurance.com/a-brief-history-of-iso-31000-and-why-it-matters/ Accessed 22 September 2023.
3. COSO. Enterprise Risk Management-Integrating with Strategy and Performance – 2017. The emphasis on the linkages among risks, strategy and performance was a key change in the 2017 update to the COSO ERM framework. https://www.coso.org/_files/ugd/3059fc_61ea5985b03c4293960642fdce408eaa.pdf
4. ISO. ISO 31000:2018 Risk management guidelines. Note: This update. provides more strategic guidance https://www.iso.org/standard/65694.html
5. Hertz, Harry, PhD. Director Emeritus, Baldrige Performance Excellence Program. Innovation Results from Intelligent Risk Taking and a Supportive Environment. Insights on the road to performance excellence. May 2012. https://www.nist.gov/baldrige/innovation-results-intelligent-risk-taking-and-supportive-environment
6. Hertz, Harry, PhD. Director Emeritus, Baldrige Performance Excellence Program. Enterprise Risk Management Requires a Systems Perspective. Insights on the road to performance excellence. Summer 2016. https://www.nist.gov/baldrige/enterprise-risk-management-requires-systems-perspective
7. Ibid. According to the Committee of Sponsoring Organizations of the Treadway Commission, the main purpose of ERM is in setting an organization’s strategy and objectives to achieve the appropriate balance between growth and return goals and related risks.
8. Kaplan, Robert S. and Mikes, Annette. Managing Risks: A New Framework, The Magazine, June 2012.
9. What is business risk? An organization faces business risk when it is exposed to a situation that can lead to decreased profits or even bankruptcy. Featured Insights. August 23, 2023 https://www.mckinsey.com/featured-insights/mckinsey-explainers/what-is-business-risk#/
10. https://www.latestquality.com/iso-9001-history/)
11. https://baldrigefoundation.org/who-we-are/history.html
12. (https://en.wikipedia.org/wiki/Committee of Sponsoring Organizations of the Treadway_Commission)
13. https://www.trintech.com/blog/coso-history-framework-principles-and-the-fault-in-the-implementation-foundation/
14. Klein, Christopher. Why Coca-Cola’s ‘New Coke’ Flopped. Coca-Cola’s disastrous attempt at rebranding Coke in 1985 delivered a painful lesson: Don’t mess with a classic. Updated: September 14, 2023 | Original: April 23, 2015. https://www.history.com/news/why-coca-cola-new-coke-flopped
15. Ibid
16. Ibid
17. Britannica. “the biggest marketing blunder of all time.” https://www.britannica.com/topic/New-Coke
18. Rossen, Jake. Fizzled Out: The New Coke Protests of 1985. August 25, 2016. https://www.mentalfloss.com/article/85231/fizzled-out-new-coke-protests-1985
19. Trefis Team Contributor. Forbes. October 6, 2022. https://www.forbes.com/sites/greatspeculations/2022/10/06/target-stock-down-32-this-year-whats-next/?sh=69ab7cda35c8
20. Meyersohn, N. June 2, 2023. https://www.cnn.com/2023/06/02/business/target-stock-fact-check-lgbt-backlash/index.html
21. Le Mahieu, L. DailyWire.com. August 9, 2023. https://www.dailywire.com/news/investor-sues-target-over-disastrous-2023-pride-campaign-after-company-loses-billions-in-market-value
22. Whedon, Ben. America First Legal sues Target for allegedly misleading shareholders. Just the News. August 8, 2023. https://justthenews.com/government/courts-law/america-first-legal-sues-target-allegedly-misleading-shareholders
23. Bowman E. The Yellow trucking company meltdown, explained. NPR. Updated August 3, 2023 https://www.npr.org/2023/07/30/1190960948/yellow-trucking-shutdown-explained
24. Huff, Ethan. CVS to slash 5,000 jobs, close 900 stores as vaccines kill off repeat customers. August 3, 2023. https://www.newstarget.com/2023-08-03-cvs-slash-5000-jobs-close-900-stores.html
25. Kilgore, T. CVS’s stock suffers biggest drop in 15 years as Medicare Advantage issues weigh on results. Last Updated: May 1, 2024. https://www.marketwatch.com/story/cvs-healths-stock-tumbles-after-earnings-missed-and-slashed-outlook-as-loss-of-large-client-weighed-on-health-services-business-0a5f6508
26. Zilber, Ariel. Struggling Disney hints its woke politics ‘present risks to our reputation and brands’ By Social Links for Ariel Zilber. Nov. 28, 2023. https://nypost.com/2023/11/28/business/disney-hints-woke-politics-present-risks-to-reputation-and-brands/
27. Sorace, Stephen. Hertz CEO Stephen Scherr resigns after big bet on EVs goes bust. March 18, 2024. https://nypost.com/2024/03/18/business/hertz-ceo-stephen-scherr-resigns-after-big-bet-on-evs-goes-bust/
28. Nolan, Lucas. Spinning Wheels: Peloton CEO Steps Down amid More Layoffs, 92% Drop in Stock Price. 2 May 2024. https://www.breitbart.com/health/2024/05/02/spinning-wheels-peloton-ceo-steps-down-amid-more-layoffs-92-drop-in-stock-price/
29. Kika, Thomas. Boeing Plane Incidents Timeline: Full List of 9 Issues in 3 Months. Newsweek. March 25, 2024. https://www.newsweek.com/boeing-plane-incidents-timeline-full-list-9-issues-3-months-1883101
30. Cogan, Marin. How to think about Boeing’s recent safety issues. Flying is still extremely safe. But Boeing’s safety issues are real. Vox. March 15, 2024. https://www.vox.com/2024/3/15/24100817/boeing-crash-safety-aviation-flying
31. Wallace, Gregory. Boeing on track to meet FAA deadline to present quality control fixes, CNN, May 23, 2024. https://www.cnn.com/2024/05/23/business/boeing-fixes-faa-deadline/index.html
32. Gibson, Kate; Picchi, Aimee. MoneyWatch, Walgreens to close up to a quarter of its roughly 8,600 U.S. stores. Here’s what to know. Moneywatch. Updated on: June 27, 2024 / CBS News. https://www.cbsnews.com/news/walgreens-stores-closing-locations/
33. Wile, R. Walmart to close 51 clinics as it shutters its entire Walmart Health division. NBC News. April 30, 2024. https://www.nbcnews.com/business/business-news/walmart-closing-health-clinics-walmart-health-division-why-rcna149968
34. Chiapolino, M., Mazzetto, F. et al. McKinsey. Risk and resilience priorities, as told by chief risk officers. December 8, 2022.
https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/risk-and-resilience-priorities-as-told-by-chief-risk-officers
35. ERM Initiative Staff, NC State University. COSO’s Take on the Three Lines of Defense. June 26, 2018. https://erm.ncsu.edu/resource-center/cosos-take-on-the-three-lines-of-defense/
36. Chen, J. Investopedia. Board of Directors: What It Is, What Its Role Is. Updated April 23, 2023. https://www.investopedia.com/terms/b/boardofdirectors.asp
The intent of this site is to be a resource for those who value their personal and professional well-being. Specifically, for those seeking information on identifying change before it happens, responding to change when it does, and exploring uncertainty when conditions and assumptions change.