The LEGO Group’s Four Elements of Risk Management

Strategic risk management at the LEGO Group consists of a four-step approach that has evolved beyond traditional ERM to strategic risk management. This paper, which is authored by Mark L. Frigo and Hans Laessoe, These four steps are outlined below, as well as the PAPA model which the company uses to prioritize risks.

Step 1. Enterprise Risk Management

This first step represents traditional ERM, and strategic risk was added to the ERM portfolio in 2006. Before this time, strategic risks were not controlled explicitly. In order to incorporate these risks into the portfolio, the CFO charged Hans Laessoe with ensuring they would be going forward. This responsibility became a full-time position in 2007, and Hans added one employee in 2009 and another in 2011. The risk-owner concept at LEGO illustrates the importance of understanding both who owns the risks as well as defining the role of risk management in the organization. Since each line of LEGO’s business owns the relevant strategic risks, Hans trains and supports line management to carry out a systematic process to deal with those risks.

Step 2. Monte Carlo Simulations

Monte Carlo simulations were introduced to LEGO’s strategic risk management process in 2008. This is a mathematical technique that allows one to see all the possible outcomes of decisions and evaluate the impact of risk. Such simulations allow for better decision making when there is uncertainty. This is being used for three areas: budget simulation, credit risk portfolio and consolidation of risk exposure. The LEGO Group is able to “calculate” the 5% worst-case loss compared to budget and use that to define risk appetite.  This information has aided the LEGO Group to be able to take more risks and be more aggressive.  These first two steps are referred to as “damage control,” because each is about managing risks already taken by the company.

Step 3. Active Risk and Opportunity Planning (AROP):

This step deals with the required risk assessment of new business projects. Projects that meet a defined minimum size or level of complexity must have a business case that includes an explicit definition and method of handling both risks and opportunities. A spreadsheet was created by LEGO to standardize this process and allow people who address and work with risks to receive a systematic approach so they can use the same approach from Project A to Project B. 

Step 4. Preparing for Uncertainty

This last step was created to add a systematic approach to define and test strategies.  Management’s purpose is to ensure that long-term strategies are relevant for future changes that may differ from those planned.  Once management has decided on a particular strategy, they test it for resilience. The possible outcomes of the strategy are considered and this is where the PAPA model comes in. The Park, Adapt, Prepare, Act (PAPA) model is used when looking at these scenarios.

• Park: The slow things that have a low probability of happening. It is important not to overlook these.
• Adapt: The slow things that we know will happen or are highly likely to happen—LEGO must adapt to those trends. This is done by systematically monitoring what direction it’s moving in and following that trend.
• Prepare: The things that have a low probability of happening, but, if they do, they materialize fast—LEGO needs to be prepared for. This is where the company identifies most of the risks that it needs to put into its ERM risk database, make sure that it has contingency plans for, apply early warnings and any mitigation it can put in place should they materialize, although they are not expected to.
• Act: Finally, these are the high probability and fast-moving things that the company needs to act on now in order to make sure the strategy will be relevant.

Original Article Source: “Strategic Risk Management at the Lego Group“, Strategic Finance, 2012