1

Discipline 1: Manage the Risk

“Practicas algun deporte de riesgo?”—”Si, a veces doy mi opinion” (Do you practice any risk sports?—Yes, I sometimes give my opinion.)

Mafalda,
Argentine comic strip character

OVER THE PAST TWENTY YEARS, THE POWERHOUSE United States Women’s National Soccer Team has won five World Cup titles as well as four Olympic gold medals. In contrast, their male counterparts have never won a World Cup nor have they even come close to winning an Olympic medal—more often than not they have not even qualified for the event.

However, you would never know how much more successful the women’s team has been compared to the men’s team based on their World Cup remuneration and earnings. For reaching Round 16 in 2014, the US men’s team received $5.375 million, whereas one year later, the women’s team received a mere $1.725 million for winning the whole tournament.

So the women’s team sued. And won. Their six-year-long litigation ended on February 22, 2022, the eve of Equal Pay Day, with $24 million in back pay, plus a pledge that pay for both national teams going forward would be equalized.

This is a classic example of an organization failing to manage DE&I-related risk—in this case, the risk of a gender-related wage gap.

Much is at stake when the DE&I-related risk is not managed. US Soccer paid dearly in the form of millions in litigation fees, lost sponsors, lost fans, and a bruised reputation. And their superstar women—Wambach, Solo, Scurry, Rapinoe, Morgan, Lloyd, Lilly, Hamm, Foudy, Chastain, and on—were left feeling excluded throughout their careers, even as they brought joy and pride to millions of fans.

US Soccer joins a long list of the most iconic corporations in the Fortune 500 that failed at managing DE&I-related risk. Consider the 1999 class action lawsuit filed by Black employees against Coca-Cola in the United States. The charge was systemic discrimination resulting in lower pay, fewer promotions, and poor performance evaluations. There were claims of “glass ceiling” and “glass wall” policies that kept African Americans away from the top jobs. In the end, Coca-Cola agreed to a $192 million settlement, at the time the largest settlement in a corporate racial discrimination case. Abercrombie & Fitch, McDonald’s, Nextel, Nike, Novartis, Texaco, and Walmart are just a few of the other big names that were made to pay settlements to the tune of hundreds of millions of dollars related to employee discrimination on a number of fronts.¹

In 2021 alone, there were at least 1,607 workplace class action suits in the United States, totaling a record $3.62 billion in damages.² This is a far cry from having it under control.

Why does this keep happening? Throughout civilization’s history, empires, nations, and colonies have in one way or another perpetuated exclusion through enslavement, segregation, and prohibitions against certain groups of people. Conversely, there is also an arc as old as time of sociopolitical forces driving toward equality, justice, and fairness, leading to laws that freed those enslaved, that gave the right to vote to women, and that sought to protect those in the minority from discriminatory labor practices.

While this measurable progress means that some of the most egregious injustices, such as legal slavery, are a thing of the past in most countries, discrimination in opportunity, promotions, firings, and pay is not. Neither are hostile and violent acts, such as hate crimes based on race, sexual orientation, or disability, or sexual harassment and assault. The thousands of global, national, and local laws protecting the most vulnerable employees from these acts show how much societies have progressed. At the same time, they have increased the risk for companies, since they are now rightfully accountable for what happens within their walls—to their employees and because of their employees. And so they keep being sued.

But managing the risk is not just about staying out of trouble by avoiding litigation, as important as that is. That’s just the starting point. Truly mature inclusive organizations think beyond just the punitive aspect of risk management. Inclusive organizations know that managing the risk is key to staying competitive as an employer and as a provider of goods and services.

Managing the risk to stay competitive can take many forms. Beyond litigation avoidance, there are other risks to consider—the risk of losing existing customers, the risk of not gaining new customers and stifling growth, the risk of high attrition among highly skilled employees, or the risk of not attracting that highly skilled workforce in the first place.

The adage “There’s no such thing as bad publicity” is false. Turns out, bad press—such as branding a company as noninclusive or not on the forefront of social justice—is indeed bad. For example, the sociopolitical convulsions following the May 2020 George Floyd murder in the United States and its reverberations across the world have had a profound impact on consumers and on their relationship with retailers. Eighty percent now say companies need to recognize their role in systemic racial inequality.³

Such sentiments affect buying decisions. They lead to boycotts of certain products and companies. The megaphone of social media amplifies these voices exponentially, and the repercussions are instant. That’s some risk to manage!

Moreover, these sentiments affect employees. A lot has been said about this being a great time for employees to reorient themselves. The market has seen people leave their jobs in greater numbers, with organizations clamoring for talent, and paying a premium for it. This is in part due to employees wanting to work for employers that care—for them as individuals, for society, and for the environment. And if they feel that the company doesn’t, those employees will go elsewhere. Given the runaway costs of hiring and upskilling new employees, poor employee morale is yet another high-stakes risk to manage.

To manage the risk legally and from a talent management and branding perspective, inclusive organizations must focus on both the structures in place (policies, systems, and safeguards) and the behavior being exhibited (mindsets, skill sets, and relationships) as they evolve on a scale from (1) Basic to (2) Progressing to (3) Advanced, and finally, to (4) Leading Edge.

MANAGE THE RISK—STRUCTURALLY

BASIC

From a structural perspective, an organization that is at a Basic level of Manage the Risk is usually focused on compliance and litigation avoidance by having solid antidiscrimination policies in place. The responsibility for inclusion may even lie with the legal team, with a mandate to “not get in trouble.” For organizations that—in the United States—do business with the federal government, affirmative action goals will be in place and initial efforts might be under way to track representation data accordingly. Representation of underrepresented groups in these companies is often very low or concentrated in lower-level jobs.

PROGRESSING

As an organization moves to the next stage, Progressing, we find that either the CEO or the board—or both—have started to pay more attention to DE&I. They may have faced some outside pressure from investors or the media and are now aware they must “do something,” although more often than not they are not sure what that is. It is at this stage that organizations may conduct adverse impact analyses of their employment practices to make sure they don’t run afoul of any equal employment opportunity (EEO) laws.

Adverse impact analyses are meant to root out discriminatory practices that are unintentionally built into the system. They look at employment practices that are seemingly fair and neutral as written but are biased against one or more demographic groups in actual practice. Such bias can happen in any phase of the talent management processes—recruiting, hiring, developing, or promoting people. Some examples are educational requirements, fitness tests, or fixed hours for certain jobs. Why should applicants have to prove they can lift sixty pounds—a requirement that may exclude a higher percentage of women than men as well as people with disabilities—for a warehouse job when workers have access to robots and exoskeleton suits to do the heavy lifting? How does a grade point average prove competence for a job? Or is a college degree even necessary for, say, a programming job? Does the job truly require eight continuous hours to be done well—a requirement that can exclude many who juggle caregiver responsibilities outside work during the day—or can it be broken up into different, dispersed time segments?

ADVANCED

In the Advanced stage, what was once a simple compliance exercise starts being considered through a broader risk management lens. The organization really starts to consider the reputational risk of either doing the wrong thing or—on the flip side—not doing the right thing. This is where leadership becomes more forward looking and considers how it wants to be known in the market as well as among its own employees.

An example of this is the Brazilian office of financial technology company Serasa Experian. More than twenty-five years ago, the Brazilian government instituted one of the world’s first quota requirements for employing people with disabilities (2% to 5% of the workforce, depending on the company’s size). Serasa Experian decided to blow past that minimum. It was convinced it would find a much richer pool of talent than people assumed was there and that this would become a competitive advantage for the company.

They were right. When you walk onto Serasa Experian’s campus in São Paulo today, you will find dozens of people in wheelchairs, who are sight and hearing impaired, and who are neurodiverse, having autism or Down syndrome. They are in professional roles such as sales, legal, research and development, human resources, and communications. Their most accurate proofreader is someone who cannot see. Turnover among Serasa Experian’s employees with disabilities is lower than the organizational average. This is how leveraging the discipline of Manage the Risk shows up as a competitive advantage with respect to talent attraction.

LEADING EDGE

In our experience, very few organizations have achieved Leading Edge maturity in any discipline. But as any journey must have an aspirational goal, we include Leading Edge here as the stage companies must strive toward. It is attained when DE&I is fully integrated in the larger risk management discussion.

The reputational risks of not doing the right thing must be considered from a talent perspective. But at this stage it goes way beyond that. What about the risks of not expanding into new, underrepresented markets? Of not developing products with marginalized groups in mind? Of not having diverse perspectives at the table to spur innovation and growth? At this level of maturity, these risks must be actively monitored, assessed, and mitigated by leadership, by HR, and by the DE&I function.

A company at the Leading Edge level of maturity in risk management is also bold about holding even its highest-revenue-producing, rainmaking leaders accountable for violating nondiscrimination policies, ignoring antiharassment rules, or creating a hostile work environment. While many organizations toe a very close line here between wanting to do the right thing and not wanting to lose a moneymaker, Leading Edge organizations are clear: there are consequences for these behaviors, regardless of who you are.

MANAGE THE RISK—BEHAVIORALLY

BASIC

In an organization that is at the Basic level of managing DE&I-related behavioral risks, leaders get caught off guard when major incidents occur. This is because they have only a rudimentary understanding of the DE&I risks for the business and culture of their organization. The organization may have basic compliance training in place and therefore leaders and managers—and in fact all employees—may be focused only on what this training is telling them. Often it will be “Oh, now I cannot say or do this anymore,” accompanied with an eye roll.

Clearly, this is not going to set an organization up for success around DE&I risk management—or even to avoid illegal discriminatory practices. In our DE&I consulting work, we have come across plenty of examples of companies at this level falling short and paying the price. Take the manager who automatically offered an advancement opportunity to the man on his team. He assumed the equally qualified woman on his team did not want to take on additional responsibility and travel, because she had young children. No thought was given to the discriminatory nature of this assumption; on the contrary, the manager “meant well.” Or the manager whose performance feedback to one of his Black employees included descriptions like “a chip on the shoulder,” “aggressive,” and “lacking motivation”—supposedly unaware that these are damaging stereotypes. How quickly trouble can find you when Manage the Risk is not lived behaviorally.

PROGRESSING

As an organization moves from Basic to Progressing, you will see a greater focus on creating a respectful workplace for all employees. This is the stage of “good intentions” and of greater awareness of what might be disrespectful or even discriminatory behavior. People managers are more aware of what the rules and policies around equitable and inclusive people management means and are applying policies and rules with more consistency. Employees have been educated on what fair treatment looks like, and they feel empowered to stand up if they witness a violation. You may see someone take aside a peer after a meeting and point out that calling a colleague a “girl” during the meeting diminished her contributions and could be considered a microaggression, or pointing out the inappropriateness of using the culturally charged phrase “open up the kimono” to convey transparency, of all things.

ADVANCED

In the Advanced stage, behavior shifts from the Golden Rule (treating others like you want to be treated) to the Platinum Rule (treating others like they want to be treated). In an organization at the Advanced level, employees feel empowered to speak up with their ideas as well as their concerns, without fear of negative consequences if these ideas are opposed to the ones suggested by the leader. You may witness brainstorming meetings where people from different backgrounds bounce ideas back and forth. You may witness leaders very vocally supporting DE&I. There is psychological safety, and the culture is one of trust and encouragement.

LEADING EDGE

In this aspirational stage, organizations at the Leading Edge of risk management will have a workforce that fully understands the risks and impact associated with harassment, bullying, and discrimination, and behaves accordingly. If negative behaviors occur, managers and leaders know how to counteract them, and they do so with no qualms.

Earlier, we talked about the importance of having a process in place that holds leaders accountable for behaving inclusively. Yet it is one thing to have a zero-tolerance policy in place for bad behavior; it is quite another for leaders to behave in a manner that honors that policy.

In one Fortune 500 company, we know of a leader who was placed on the succession path to the CEO role. He began to observe firsthand the abusive behaviors of the company’s leading salesperson. He witnessed this leader publicly berating, belittling, and ridiculing members of his team and creating a climate of fear and intimidation. He was alarmed by the behavior and by the fact that no one spoke up or called him out.

So he decided to do what others would not. He pulled this sales leader aside, pointed out his infractions, and gave him a chance to rectify his ways. When the salesperson did not and the abusive behaviors continued, this leader went to the CEO to discuss how to best address the issue. Here, he hit a brick wall. The CEO made it clear the offender was a top revenue producer and he refused to call him out on his abusive ways. The CEO advised his successor to let it go.

He didn’t.

Instead, he gave the offender another warning and then, on the third infraction, let him go. This is Leading Edge behavior. No one had taken his stance seriously, least of all the offender. A career-limiting move is what they saw when he fired the rainmaker. But the leader stood firm. To him, it was the right thing to do, as well as the best way to manage the risk of having an abusive employee in a prominent role.

Epilogue: he ended up becoming the CEO.

ANATOMY OF A DEBACLE: RACIAL FAUX PAS AT AN ADVERTISING AGENCY

Many years ago, Fayruz, in her role as a DE&I consultant, got called into a meeting with a leading global advertising agency. The information she received when they set up this meeting was cryptic. They wanted to get some advice about how to handle a certain situation. As she was sitting in the lobby of a fancy metropolitan high-rise, waiting for the head of human resources and the head of diversity and inclusion to call her in, the receptionist came over to her, looking over her shoulder.

“I know why you are here,” she whispered.

“Excuse me?” Fayruz was taken aback.

“I know why you are here. If they had just run that ad by me, I could’ve told them it would backfire.”

Aha. Now Fayruz had a bit more information as to why she was there. Once she had a chance to meet with the head of HR and the larger team, she unearthed what had happened. An ad was created for a product; the ad was supposed to run outside the United States. The layout and photo had caused an outcry for its depiction of Black men in a subjugated role. There was a lot of hand-wringing and questions about how this could happen.

Many mistakes were made here. The ad was not run by members of the Black community because—sadly but unsurprisingly—there were no Black creatives on the team. Nor did the agency think to engage Black employees from other parts of the firm. Part of the reason was that this ad was supposed to run in the Asia-Pacific region, so who in the US would see it anyway? On the client side, no one caught it either.

The ad agency’s client was now furious—they were getting backlash and calls for boycotts and had to do a lot of damage control. There were calls for the CEO to resign. Leaders at the agency were stunned and taken aback. Clearly, managing inclusion risk hadn’t been high on their list. And now both the higher-ups at the agency and the client were in full panic mode.

This was not a mistake by one single person or even by one team. The whole structure of creating impactful ads was flawed by a lack of diversity and inclusion, and there were failures at every decision point. There was the creative director who came up with the concept and who had no idea that it would be offensive to the Black community. Then there was the rest of the creative team, who thought this was a great idea and expanded upon it with various iterations of the concept. There were photographers, copy editors, and senior leaders who all signed off on this ad, both the concept and the final product. And the same happened on the client side. At no point was the system set up to catch this snafu. Why not?

Because nowhere in the chain of command at the agency—or with the client—did a Black person, or someone with cultural insights into Black culture, actually look at the concept. The creative team did not have a single Black team member, nor did any of the other people who touched the project. In addition—and perhaps even more telling—even though the teams were homogeneous, no one thought to run the ad concept by anyone from the community to ensure it was culturally appropriate or at least not outright offensive.

There was neither diversity nor a structural process to mitigate the risk of not being inclusive. It was a casebook system breakdown.

It was one thing to have low representation of underrepresented groups at certain levels or in particular areas, such as the creative team. It was quite another not to even think about creating inclusive—or at least inoffensive—ads. Clearly, this client was at the very Basic level on their journey of structural DE&I-related risk management.

With Fayruz’s help, the ad agency set to work with a multiprong approach. It tackled its blind spots from many perspectives, both behaviorally and structurally.

Behaviorally, leaders, managers, and creatives were urged and motivated to think and operate in a more intentionally inclusive way by simply being more attuned to who was and was not in the room where ideas were being developed and tested. If they identified a lack of diversity, they were empowered to take steps in the moment to do something about it.

Structurally, there was a focus on increasing the diversity of employees at all levels, from both a recruiting and a development point of view. The agency launched an initiative to systematically seek input on ads before they were released, looking to existing employees with a diverse set of backgrounds, regardless of where they sat in the agency. The receptionist who spoke to Fayruz before her first meeting, for instance, was now one of many tagged for input. By embedding this approach into its culture and structure, and integrating DE&I into the larger risk management discussion, the organization moved from Basic to Progressing in its risk management maturity.

As an Advanced step on the behavioral inclusion side, there was an effort by the creatives in the agency to partner with their corporate clients and utilize their diversity to test ideas and ads. The structural inclusion step, for example, established protocols to tap into clients’ existing employee resource groups, which represented many identity groups.

And this is how the agency was slowly able to move forward in Manage the Risk and to become more inclusive.

TRIP UPS

No matter how research-based, field-tested, or elegant a methodology is, addressing DE&I in an organization is complex, messy, and full of dilemmas. The most common Manage the Risk trip ups we have observed during our client work are overindexing on one group, ridiculing compliance as irrelevant, and letting the lawyers rule.

TRIP UP 1: OVERINDEXING ON ONE GROUP

We’ve seen it both in organizations and in society at large: calls for broad diversity are answered with progress for just one group.

Globally, a focus on diversity often has been synonymous with a focus on gender equity. In many countries, gender is the one category that is tracked, and so it has become a placeholder for all categories. Take the EU Gender Equality Index, which shows countries such as Sweden and France at the top of the list. Does this mean that these countries—and their companies—have solved the diversity and inclusion challenge? Hardly.

In 2022, a female candidate, Marine Le Pen, ran for president of France and came close to winning, with 41% of the population’s vote. Her popularity stemmed from her hard anti-immigration agenda, indicating that there is still a good amount of diversity, equity, and inclusion work to be done and that gender can’t be the only thing we focus on.

Even when focusing just on women, the progress in countries with a good amount of racial diversity has largely been made by White women at the expense of women of color. For example, according to a McKinsey study, women hold 19% of C-suite positions while women of color hold a mere 4%.⁴ We also worked with a tech organization that claimed to do well around racial equity, only to find that their population of people of color consisted of 80% expatriates from just one country and were predominately positioned in the lower ranks.

The focus on diversity and inclusion cannot be solved by overindexing on one group only. A few years ago, the hashtag #OscarsSoWhite dominated the conversation after a ceremony that awarded twenty acting nominations to White actors for the first of two consecutive years. After a few years of fits and starts to do better, the 2022 Oscars were indeed more diverse—both in nominees as well as in performers. The full production team was all-Black, the opening act was Black celebrities, two of the three female hosts were Black. Progress, right?

Yes, but only on one front. As the night wore on, the number of Black performers became unmistakably lopsided compared to representatives from other minority racial and ethnic groups. A similar dynamic has taken place in the workplace, where Asians, Latinos, and Indigenous people have been largely invisible in efforts that have overindexed on addressing Black talent, especially given the added scrutiny after the George Floyd murder and the wave of Black Lives Matter protests around the world. Despite the undeniable urgency to rectify past wrongs for this group, true inclusion means inclusion of all traditionally underrepresented groups.

TRIP UP 2: RIDICULING COMPLIANCE AS IRRELEVANT

As we alluded earlier in the chapter, many organizations want to move their DE&I conversations as far away from the legal arena as possible, even though that’s where it all began. We hear it all the time: “We are long beyond focusing on compliance,” or “Equating DE&I with compliance brings us back to the 1980s,” or even “Isn’t this focus on compliance just about establishing the numbers?”

Yes, and . . .

We understand that inclusive organizations strive to be so much more than adhering to the local antidiscrimination laws. This is why we highlight the five disciplines in the first place. But compliance is not going away. We still have not rid our society and organizations of practices and behaviors that disadvantage and drive away underrepresented talent. And while having diversity goals for underrepresented talent may be a crude instrument for advancing DE&I, it remains necessary.

We still see thousands of class action suits being filed and won every year. We still see organizations being fined billions of dollars. In addition, have we really accomplished what these antidiscrimination laws set out to fix? Does your organization have equitable representation in its leadership ranks? Few do, so ridiculing compliance as irrelevant is misguided.

Talking about compliance may not be as sexy as talking about innovation, but compliance still plays a vital role in DE&I efforts and ignoring it will surely come around to bite and set you back.

TRIP UP 3: LETTING THE LAWYERS RULE

One of the risks that stands in the way of managing the risk progress is, ironically, the lawyers themselves. In many organizations, the lawyers are very involved in managing DE&I information and data. Their involvement often consists of keeping their foot on the brake. Cutting survey data by demographic groups? Too risky. Conducting listening circles to learn about different experiences? Too risky. Looking at advancement and promotions by race and gender? Too risky. Who knows what dark organizational secrets such information will reveal.

We see many diversity leaders in their organizations with their hands tied by highly risk-adverse lawyers for whom the whole topic of diversity is a land mine to be avoided. In an era of high premiums put on DE&I commitments and demands for greater transparency, this is counterproductive.

There’s a place for diversity leaders to push back on the lawyers who understandably are trying to manage the risk. One key way is to acknowledge the importance of managing risk. Ask them, “So, how risky is it, really?” Not everything is equally risky, and this should become a risk management conversation. Is it a low-risk endeavor? Medium-risk? High-risk? Insist that the legal department truly quantify the risk.

Part of the conversation should also involve a discussion of the risk of not doing something. What is riskier, to not share representation data with the public when it’s obvious to all there is not much diversity at the top (so what are you trying to hide?) or being transparent with your numbers and humbly acknowledging you have a way to go?

Another way to push back is to remember that the legal department is there to advise the business leaders who sponsor DE&I efforts; they are not the decision-makers. If you are feeling stuck, lean on your business sponsor to weigh in, since they have the ultimate decision-making power.

Keeping in mind that this is not a linear model, we will nevertheless say “Next” as we move on to Discipline 2: Explode the Awareness.