The 2012 RIMS Canada Conference in Saskatoon welcomed another exciting keynote speaker to its Monday lineup: respected strategist and risk manager Hans Lessoe from LEGO Systems in Denmark.

Lessoe has accumulated 31 years at LEGO, in positions ranging from supply chain to marketing to, now, risk manager.

“You can become a strategic risk manager from any point in the company,” Lessoe said. “The important thing is that you understand what drives the company, and what dynamics are within the company.”

So how did LEGO become one of the greatest champions or the risk management discipline? Here’s a timeline of the process according to Lessoe himself:

• 2006 — we didn’t know what RM was
• 2007 — came up with 200 risks, pared that down to 90, presented report to the board of directos, came up with systematic approach to cover strategic risks, made a risk map, made risk management at LEGO a full-time job
• 2008 — added Monte Carlo simulations and learned that risk management is not about averages. Monte Carlo gave LEGO the risk tolerance we use today
• 2009 — added a validation of risk controls, we believe we’re in control of our business, we begin doing larger product launches and developing new products
• 2010 — start to manage risks using AROP software, which automatically provides the required reporting, AROP has improved the way LEGO manages project risk, now we believe we implement strategies well, strategic scenarios were developed based on best practices
• 2011 — for individual strategies, we use relevant scenarios, identify and prioritize the strategic issues. “We don’t prioritize based on impact,” Lesso said. “We prioritized based on likelihood.”
• 2012 — we now have a tool for this (complex spreadsheets), we optimize our risk management by using all three processes (Monte Carlo, AROP and Excel).

Now what? Lessoe shared LEGO’s thoughts on risk management going forward:

• the ERM process is cumbersome and focused on top management
• go further out/down in the organization
• each leadership team should own a risk/opportunity portfolio
• work to solve that issue by combining the strength and simplicity of the AROP tool with the best of ERM
• the active use of scenarios is still in its infancy
• we wish to ensure strategic impact
• we wish to be naturally integrated
• we wish to be requested sparring partners as we support conscious choices
• we wish to make risk management a part of what we do

“Strategic risk management is not that complicated,” said Lessoe. “The difficulty is understanding the business and industry. It’s about identifying and assessing and handling and reporting.

And then it’s about common sense. The only problem I have with common sense is that it’s by far the least common of the senses. There is a benefit to knowing whether you are taking the right amount of risk. When you’re ready, move upstream in the decision process.

“Do remember that risk management is not about risk aversion. If everything is under control, you’re moving too slow. You need to be able to take chances, but you need to know how many chances you can take.

Risk management is a very, very small part of the success we’ve had.”

And success they’ve had. The company continues to grow while the toy industry, globally, is down 5%. LEGO, and Lessoe, are doing something right.