As a privately held company, the LEGO Group can't look at stock values, so it looks at the amount of earnings the company is likely to lose compared to budget if the worst-case combined scenarios happen. Not all risks will materialize in any one year, because some of them are mutually exclusive; but a huge number may happen in any one year, as we have seen during the global financial crisis. Hans
Exhibit 6.3 Monte Carlo Simulations and Risk Appetite at the LEGO Group
computes a net earnings at risk (EaR), and corporate management and later the board of directors use that net earnings at risk to define their risk tolerance. They have said that the 3 percent worst-case loss may not exceed a certain percentage of the planned earnings (the percentage is not 100). That guides management toward understanding and sizing the risk exposure. This process has helped the LEGO Group take more risks and be more aggressive than it otherwise would have dared to be, and to grow faster than it otherwise could have done.
Strategic Risk Management Lab Commentary
Risk tolerance is a difficult area for organizations to address. The approach used at the LEGO Group provides a good example of deriving risk tolerance (the term LEGO uses rather than risk appetite) in an actionable and systematic way. It also shows an approach that fosters intelligent risk taking and that avoids being too risk averse while maintaining discipline on the amount of risk undertaken. Hans has actually had cases where he recommended taking on more risks to meet elusive targets. He uses an analogy to communicate the idea of taking risks and not being too risk averse: "I used the (very normal) traffic picture ... 'Guys, you are getting late for the party, yet you are still cruising at 40 mph on the highway. Why not speed up to the 70 mph you are allowed to drive – if that will more likely take you to the party in time?'"
What we've discussed so far is more or less damage control because it's about managing risks already taken by approving strategies and initiating business projects. Hans decided he wanted to move beyond damage control and be more proactive so he could create real value as a risk manager. He came up with a process he calls active risk and opportunity planning (AROP) for business projects.