Businesses face risks every day. Some risks are foreseeable. For example, a company could reasonably be expected to foresee the possibility of a natural disaster or a fire destroying its centralized data storage facility. Companies respond to this type of risk by maintaining off-site backup data storage facilities. Other risks are unforeseeable. For example, in 1982 Johnson & Johnson never could have imagined that a deranged killer would insert poison into bottles of Tylenol and then place these tainted bottles on retail shelves, ultimately killing seven people.¹⁸ Johnson & Johnson—guided by the first line of its Credo (see page 24)—-responded to this crisis by acting to reduce the risks faced by its customers and itself. First, it immediately recalled and destroyed 31 million bottles of Tylenol with a retail value of $100 million to reduce the risk of additional fatalities. Second, it developed the tamper-resistant packaging that we take for granted today to reduce the risk that the same type of crime could be repeated in the future.

Every business strategy or decision involves risks. Enterprise risk managementA process used by a company to help identify the risks that it faces and to develop responses to those risks that enable the company to be reasonably assured of meeting its goals. is a process used by a company to proactively identify and manage those risks.

Identifying and Controlling Business Risks

Companies should identify foreseeable risks before they occur rather than react to unfortunate events that have already happened. The left-hand column of Exhibit 1-11 (page 28) provides 12 examples of business risks. This list is not exhaustive, rather its purpose is to illustrate the diverse nature of business risks that companies face. Whether the risks relate to the weather, computer hackers, complying with the law, employee theft, financial reporting, or strategic decision making, they all have one thing in common. If the risks are not managed effectively, they can infringe on a company's ability to meet its goals.

Once a company identifies its risks, it can respond to them in various ways such as accepting, avoiding, sharing, or reducing the risk. Perhaps the most common risk management tactic is to reduce risks by implementing specific controls. The right-hand column of Exhibit 1-11 provides an example of a control that could be implemented to help reduce each of the risks mentioned in the left-hand column of the exhibit.

In conclusion, a sophisticated enterprise risk management system cannot guarantee that all risks are eliminated. Nonetheless, many companies understand that managing risks is a superior alternative to reacting, perhaps too late, to unfortunate events.

¹⁸ Tamara Kaplan, “The Tylenol Crisis: How Effective Public Relations Saved Johnson & Johnson,” in Glen Broom, Allen Center, and Scott Cutlip, Effective Public Relations, Prentice Hall, Upper Saddle River, NJ.