R — Reading
"The CEO of any large organization must be the Chief Risk Officer." (2022) "Noah did not wait for it to rain before building the ark." (2001)
I — Methodology Skeleton
The CEO's risk responsibility cannot be delegated:
- Risk management is not the work of an independent department — the CEO must personally understand and manage risk
- "Predicting rain doesn't count, building arks does" — knowing a risk exists but not acting equals no management
- A committee report ≠ risk has been managed — only the CEO can mobilize the entire organization's resources to respond
- Berkshire model: maintain $30 billion+ in cash, use no leverage, do not rely on the goodwill of strangers
A1 — Application in the Book
Case: The NetJets Crisis
- Problem: In 2009, NetJets faced a survival crisis and was suffering severe losses
- Use: Buffett was forced to take over personally, and discovered that the root cause of the out-of-control risk was that management did not treat risk as its foremost responsibility
- Result: Deeply recognized that "the CEO must never delegate risk control" — personally managing it turned the situation around
A2 — Trigger Scenarios
- Assess whether a company's risk management is adequate
- Understand why large companies can also suddenly blow up
- Decide the reporting line for risk management when designing organizational structure
- As a CEO/manager, reflect on your own risk responsibility
Language signals
- "Isn't it enough for the risk control department to manage risk?"
- "Should the CEO personally manage risk?"
- "Why do large companies blow up?"
- "How should risk management be done?"
E — Executable Steps
-
Check whether the CEO personally manages risk
- Completion standard: Can the CEO accurately describe the company's top 3 risks? Does he review them regularly?
-
Do the "Noah Test"
- Completion standard: Is the company preparing for the storm while the sun is still shining? Or does it wait until the rain comes before acting?
-
Verify "do not rely on strangers"
- Completion standard: In the worst-case scenario, can the company survive without any external financing?
B — Boundaries
- The CEO personally managing risk ≠ micromanagement — a system needs to be established, but the ultimate responsibility cannot be delegated
- CEOs of small and medium-sized enterprises may not have the resources to do comprehensive risk management — but core risks still require personal involvement
- Author's blind spot: Buffett manages a company with an enormous capital base — the types of risk and pressure faced by an ordinary CEO are completely different
Related skills (to be filled in Phase 3)
- composes-with: no-leverage, institutional-imperative
Audit Information
- Verification passed: V1 ✓ / V2 ✓ / V3 ✓
- Distillation time: 2026-04-16