Lessons from the Super Bowl XLVI Risk Management Committee

Risk management is nothing new to major sporting events. The success of a high-profile event such as the Super Bowl often depends more on what doesn't go wrong rather than what goes right. The organizers of the 2012 Super Bowl were certainly not the first to think through the risks - from bad weather to traffic to accidents to criminal acts.

What did seem to be new in 2012, however, was the way in which enterprise risk management (ERM) principles were applied to identifying and mitigating the risks. In fact, the Host Committee was told that Indianapolis was the first host city to apply ERM tools and principles on such a broad scale.

The success of this approach could be seen in the high praise the event drew from fans, sportswriters and National Football League (NFL) officials alike. As Pro Football Weekly publisher Hub Arkush summed it up shortly afterward; "'Super/ in fact, is the best way to describe Indianapolis' effort... There is very little I can imagine that could have been done better."

While a Super Bowl presents many unique risks, the Hose Committee also recognized that the event is similar in many respects to any other large, elaborate undertaking. It is managed through a highly complex structure that involves not only the Host Committee and staff but also thousands of volunteers, all of whom are charged with a specific area of responsibility. This means there are literally thousands of opportunities for someone to fail to see die big picture. Such an environment demands the enterprisewide recognition, assessment and mitigation of risk that only ERM can provide.

Consider, for example, whar would have happened if a major power outage had struck downtown IndianapolisFebruary 5, just before kickorT. Virtually every aspect of the event would have been affected, so each division, committee and subcommittee needed to have a response plan ready.

Inevitably, though, each of these dozens of disconnected contingency plans would affect other plans, and some would almost certainly conflict. ERM provided a way to cut across these divisions, coordinate the contingency planning and build enterprisewide mitigation plans that addressed and balanced all of the widely divergent effects.

Event Risk vs. Business Risk

Despite the similarities between the Super Bowl and any other large enterprise, there are also some significant differences that set "event risk" apart from die "business risk" diat most ERM managers are accustomed to handling. The most fundamental of these differences is the way risk is measured and quantified.

In most businesses, success - and hence risk - is measured by the bottom line. For an event such as the Super Bowl, however, the financial outcome is secondary. Obviously, nobody wants the event to be a loss, and appropriate controls are essential. But nonfinancial risks, especially reputational risk, are the greater concern.

This distinction is important because nonfinancial risks cannot be shared or transferred as readily by purchasing insurance, one of the most widely used risk management strategies. In many cases, the only practical ways to manage nonfinancial risks are to avoid the risk in the first place or to accept the risk and prepare to respond.

That brings up another imporrant difference between event risk and business risk: the balance between prevention and preparation. Prevention certainly played a role in the Super Bowl's risk management, but many of rhe most material risks to a largescale event cannot readily be avoided, reduced or shared - which means preparation and contingency planning take on greater significance.

The other major difference between event risk and business risk is die changing nature of risk over time. There is a time-related component to most business risks too, but for an event that is scheduled for a specific day, die relationship of risk to time is especially strong.

In the case of the Indianapolis Super Bowl, the relationship of risk to time was appâtent very early. During much of rhe spring and summer of 2011, when the Host Committee had to make major commitments of time and resources, die number-one risk the committee faced was entirely out of its control. A labor dispute between the NFL and its players' union threatened to delay the season, forcing the committee to prepare for the possibility of the Super Bowl being postponed - or even cancelled.

All of those risks disappeared August 4, however, when the players ratified a new collective bargaining agreement. Overnight, labor disruption went from being rhe highest risk to being an after thought.

Super ERM Lessons

It is always risky - so to speak - to extrapolate broad lessons from a single experience. Nevertheless, several general insights gained from the Indianapolis Super Bowl Host Committee's successful risk management seem especially applicable in business settings.

First, not all risks can be monetized - but all must be quantified. Most businesses categorize risk by the financial impact an event is likely to have. But assigning a dollar value to intangibles, such as reputational risk, is often timeconsuming and somewhat arbitrary.

Fot example, it was virtually impossible to accurately determine the dollar cost of bad publicity that would result from an accident at the Super Bowl site. Instead, such risks were quantified in terms of the reach and exposure they likely would receive. An accident that would generate only local news coverage might be considered relatively low risk, but an accident that would be covered by ESPN or Sports Illustrated was assigned a higher risk. And if the story was likely to get the attention of national general-interest media such as the New York Times or USA Today, it was in an even higher category of risk. Even though such risks could nor be readily monetized, some system of quantification and classification was necessary to evaluate, prioritize and prepare contingency plans.

Another insight from the success of the Super Bowl is the importance of being ready to respond to risk, not just prevent it. Naturally, most business managers want to be ahead of the curve in mitigating risk, so most ERM programs focus on three of the four conventional risk management methods: avoiding, reducing or transferring risk.

In the case of the Super Bowl, however, much more attention was paid to the fourth risk management method: accepting and preparing for risk. In the same way, a prudent business risk manager must recognize that even the best risk avoidance plan might fail. Devoting too much attention and resources to prevention - at die expense of a comprehensive response plan - can actually increase the organizations exposure to risk

The Super Bowl experience also made clear that response plans should be multifaceced and multilayered. We often think of risk in black-and-white terms - either a risk will occur or it wont. In reality, however, most risks are much more complex.

For example, the Super Bowl historically has been held almost exclusively in cities where it does not snow. Florida, California and New Orleans have hosted 35 of the 46 total Super Bowls. So as only àie fourth cold-weather city to host a Super Bowl, Indianapolis naturally focused od the risk of inclement weather. The contingency plans quantified and prepared for varying degrees of weather risk - an inch of snow and 30-degree weather presented a dramatically different risk profile from a foot of snow and 1 0-degree weather.

However, the weather that eventually materialized presented a risk no one had factored inro their contingency planning: the risk of unusually pleasant weather. The IndianapolL· Business Journal estimates that the unseasonably balmy temperatures during the week before the game attracted as many as 1.1 million visitors to the threeblock-long Super Bowl Village - nearly double what the Host Committee had projected.

Beautiful weather was a good problem to have, but the high turnout presented a new set of risks in terms of traffic and crowd control. The lesson for businesses is clear: as you prepare your contingency plans, be ready for unexpected good news as well as bad.

An additional lesson businesses may take away from the success of the Super Bowl in Indianapolis: using ERM techniques can contribute to an organization's long-term success and open up even greater opportunities in die future.

Even as the teardown began and crews worked to put downtown back to normal, Host Committee members and other community leaders were looking ahead to a possible bid to host another Super Bowl. Based on the highly favorable reviews for Super Bowl XLVI, there is every reason to believe that the NFL will be eager to bring its championship game back to Indianapolis.

A labor dispute between the NFL and its players' union threatened to delay the season, which forced the committee to prepare for the possibility of the Super Bowl being postponed- or even cancelled.

Implementing ERM at Super Bowl XLVI

The Super Bowl 2012 Risk Management Committee, which was formed to help the Host Committee manage the event's critical risks, was committed to implementing ERM- not just dealing with risk in an ad hoc fashion. The following were among the most important ERM principles employed.

* Establishing the right tone at the top

It was crucial not only that the Host Committee's board of directors and senior leadership understood the game's risks but that they were also supportive of the ERM approach and the efforts of the Risk Management Committee.

* Thinking about risks broadly

ERM provided a methodology to cut across the various divisions and committees, and coordinate the risk mitigation efforts. This enabled everyone from the Host Committee down to keep an eye on the big picture as they prepared their individual contingency plans.

* Linking risk to strategy

Recognizing the potential impact of each risk on the event's strategic objectives was vital. This meant starting with a clear definition of the goals that the Host Committee wanted to accomplish and the strategy for achieving those goals. Only after those points were ciear could the committee drill down to the details of what could go wrong and why.

* Using a îop-downj'bottom-up approach

Early on, the risk committee asked the board of directors to rank the greatest threats to success. They approached the event staff with the same request The differences between the two sets of responses were instructive. White board-level respondents cited strategic issues such as media coverage and succession planning, the staff's responses often focused on the day-to-day tactical concerns such as downtown restaurant capacity, which could have a significant negative impact on their specific areas of responsibility.

* Taking ownership of risk

Ironically, risk management itself can generate risks. Chief among them is the risk of encouraging complacency. "I don't need to worry about contingency planning," a manger might think, "the risk committee is on it" Consistent messaging helped make clear that the Risk Management Committee's job was to facilitate, educate, coordinate and enable- but each division leader was responsible for managing risk.

* Providing the right tools

There is a flip side to expecting each manager to take ownership of risk: the board and the Risk Management Committee needed to provide managers with the necessary tools. These included a rigorous risk assessment process with questionnaires and risk matrices.

As only the fourth cold-weather city to host a Super Bowl, Indianapolis naturally focused on the risk of inclement weather.

Steven R StrammeUo, CPA, CIA, CFSA, CRMA, was co-chair of the Super Bowl 2012 Risk Management Committee and is managing partner of risk consulting services in the IndianapolL· office of Crowe Horwath LLP.

Mark A. Saltsgaver, was co-chair of the Super Bowl 2012 Risk Management Committee and ù senior director of corporate mk management at Eli LiUy and Company in Indianapolis,