Over the last 20 years of working in different levels of risk management, I’ve often heard, “knock on wood” whenever I ask questions about past performance or future goals. It often sounded a bit like this:

Me: “I see you’ve had a significant reduction in losses this year, tell me about that.”

Client: “Well, Larry, we’ve been pretty lucky this year.”

The client would then often look around to find some solid-looking piece of wood on which to rap their knuckles at least twice.

Inevitably in my head (and sometimes out loud), I would immediately ask, “besides giving homage to the wood gnomes, what is your strategy for next year?”

Again, the client’s response would often go a little something like this: “Well, if we’re lucky, we can keep the losses low and pay less for insurance.”

There are two things to consider from this dialogue. First, where did this penchant for wood knocking come from, and second, can an organization’s success be determined by luck?

While the “knocking on wood” superstition can be fun, I’ve yet to find an underwriter who accepts “strong relationships with wood gnomes” as a strategic plan to control losses. So, what can you do to ensure you have good fortune in the area of risk management? I have some ideas.

Applying Good Risk Management Instead of “Luck” – The 10x Companies

Have you ever read the book “Great by Choice” by Jim Collins and Morten Hansen? This is one of my favorite risk management books. In it, Collins and his team look at comparative businesses over an extended operational period and try to determine if any one business received more good or bad luck than other competitors in their industry. Then Collins’ team determines if that luck drove success or failure of that organization.

Collins’ team developed a concept of company performance called the 10x’rs — companies that beat their industry index by at least 10x. Collins and Hansen determined that organizations competing in an industry vertical received the same amount of good and bad luck. Yet, some companies performed at 10x their industry norm, others only kept pace with the market, and some ceased to exist.

The deciding factor between success, mediocrity, and failure was risk management. When companies applied good risk management, they performed well during downturns in the market and were able to exceed performance during upturns.

Key Attributes of Top-Performing 10x Companies

“Great by Choice” breaks out core risk management attributes of those 10x companies:

Fanatic Discipline

Discipline is consistency in action, values, long-term goals, and over time.

This discipline means that companies don’t overreact to events, succumb to the herd, or leap for alluring, but irrelevant, opportunities. It also often means having the discipline to thrive during times of bad luck and keep a steady regulated pace during times of success.

Fanatic discipline imposes two types of necessary discomfort:

• The discomfort of commitment to high performance in difficult conditions.
• The discomfort of holding back in good conditions. (Not getting to far out in front of yourself).

A couple of key things to think about in this area:

• Holding regular safety/risk meetings even though things are going well.
• Investing in a captive to stave off long-term fluctuations in the market.

Empirical Creativity

Often during times of uncertainty, most people look to other people for their primary cues about how to proceed. When it comes to 10x companies, they look to empirical evidence — evidence that relies upon direct observation, conducting practical experiments, and/or engaging directly with evidence rather than relying on opinion or whim. Empirical evidence allowed 10x companies well-founded confidence but also bounded their risk.

Collins and Hansen tell us that different industries have different innovation requirements (ex:  airlines vs biotechnology). However, what was interesting was that once the innovation threshold was met, operational effectiveness was the key to success.

Think bullets then cannonballs. A bullet is a test designed to see what works by meeting three criteria:

• Low-cost relative to the size of the business.
• Low risk, meaning that there are minimal consequences if the bullet goes astray or hits nothing.
• Low distraction, meaning the bullet might be high effort for a few individuals, but most of the organization can carry on as usual.

Then, if the bullet hits something, does it merit being turned into a cannonball? Terminate bullets that don’t show potential for success and don’t fire uncalibrated cannonballs.

To get started in this area, here are a couple of tips:

• Complete a regular review of OSHA data to determine root cause of DART (Days Away Restricted Cases) over the last 3-5 years.
• Test wearables in a small area to get feedback from employees.

Productive Paranoia

10x companies differ from their less successful comparisons in their maintenance of hypervigilance in good times as well as bad.

Even in good times, they believe that conditions will absolutely turn against them without warning, the incidents will occur at some unpredictable point in time or highly inconvenient moment, and they’d better be prepared.

Productive paranoia manifests itself in in three ways:

• Prepare for the worst. Build cash reserves and buffers beyond what others do to prepare for unexpected events and bad luck.
• Bound risk. Identify risk in its four categories. 1. Death line risk (what are those risks that could mean the end of the organization?), 2. asymmetric risk (what risks have higher downside than upside?), 3. uncontrollable risks (market swings or pandemics), and 4. time-based risk (at what velocity is this risk headed at us?).
• Zoom in-zoom out. Remain hypervigilant to sense changing conditions and respond effectively.

A couple of good tips — identify those death-line risks and build the business continuity plan you’ve been putting off. Additionally, identify risks that are right on top of you, like the great reshuffle, and consider implementing a junior shadow board to identify needs for the next generation.

Specific, Methodical, and Consistent (SMaC)

SMaC is a set of durable operating practices that create a replicable and consistent success formula. It is clear, concrete, and enables the entire enterprise to unify its efforts.

SMaC will clearly define what to do and what not to do. Leadership can be decentralized, because actions can be tested against the defined operational practices. You need to ask yourself, “does this action support my goal?” From there, these practices would be developed out of empirical validation on what works and why.

Managing Risk Management Luck

Life offers no guarantees, but it does offer strategies for managing luck.

1. Cultivate the ability to zoom out and recognize when luck happens.
2. Develop wisdom to see when to act on luck.
3. Be well-prepared to endure a long run of bad luck.
4. Create a positive return on luck.

For my risk managers and safety professionals who “knock on wood” in celebration of having good luck, how are you going to act on this moment of good fortune? Will you take your win and create buffers to prepare yourself for a string of bad luck by improving your insurance plans, saving money for deductibles, or joining a captive? Will you use your luck to create new SMaC programs that ensure you can sustain your positive environment by experimenting on workable standard operating procedures (SOPs) and investing in tools for sustainment?

If you’re currently under the protection of the wood gnomes, I encourage you to take these precious moments and make something of them for it might be dark again soon. And, of course, if you’re not sure how to do this or have questions, please don’t hesitate to email us.