MapKAI

Day 3 of 5

Facts, Risk, and Governance

What do the numbers reveal, and what might they hide?

Estimated time: 25 minutes

Today you will learn to
  • read profit alongside cash and operating facts
  • turn risk indicators into action thresholds
  • assign decision rights before pressure peaks
  • connect governance with usable evidence
Start Lesson

Watch the lesson

Subtitles available where provided

Chinese

Three Whiteboards: Finance, ERM, and Governance

Chinese

Three Whiteboards at the Pizza Shop

English

The Corner Bistro

Listen to the podcast

Three Whiteboards in a Pizza Kitchen

01

Opening story or business situation

Beside a university town stood a small pizza shop called Corner Slice. It had only six tables, but delivery made up half its business. Every Friday evening, the order printer kept spitting out tickets, and the owner, Amin, felt business was good.

At the end of March he took the accounts home and told his wife, “This month is good. Profit is thirty per cent higher than the same month last year.” “Did we sell more pizza?” she asked. “No, about the same.” Amin pointed to one line in the accounts: the shop had sold an old delivery van for four thousand euros. Its book value had become very low, so the difference on sale became income for the month.

The profit was real, but his wife asked, “Will we have another old van to sell next March?” Amin had no answer.

The next day he looked around the shop again. The fridge door no longer shut properly. The oven heated more slowly. To save labour, Friday’s evening shift had fallen from four people to three. Pizza sales had not increased, while negative delivery-platform reviews were quietly rising. None of this appeared in the line that said “profit up thirty per cent.”

Later Amin asked Zhou, a member of staff, to make a risk table: oven failure in yellow, expired ingredients in yellow, last-minute absence and delivery delay in red, and falling platform rating in yellow. Zhou put it beside the fridge. At first people glanced at it. A few days later it was covered by the rota, an old menu, and drink-promotion posters. Gradually, nobody noticed which items had turned red.

The real failure came one Friday night. There was a match at the nearby stadium and orders suddenly surged. One employee called in sick, only two bags of cheese remained, and after hours of work the oven temperature became unstable.

Zhou asked, “After how many orders should we close one platform?” Amin said, “Let’s see.” Ten minutes later Zhou asked, “Which comes first—diners or delivery?” Amin said, “Do not delay either.” It sounded like an answer but decided nothing.

By seven o’clock, some pizzas were burnt at the edge and raw in the middle. Customers chased orders, the platform demanded refunds, and neither front nor kitchen knew who could stop taking orders. They refunded more than twenty orders that night. The rating fell from 4.7 to 4.2. A regular student wrote, “The pizza tastes the same, but everyone seems busy and nobody is actually deciding.”

The next morning Amin removed all the posters, rota, and risk table from beside the fridge and hung three whiteboards in the kitchen.

The first asked, “How exactly did we make money this month?” In the past Amin saw only the final profit number. Now he separated it: how much pizza itself earned, how much came from the old van, which platform payments had not arrived, which ingredients had been used while supplier bills remained unpaid, and which refunded orders could no longer count as revenue.

The gain on the van was not wrong, but it did not show that the pizza business had improved. For the first time Amin separated two questions: were the numbers recorded correctly, and what did those numbers actually mean?

The second board asked, “What could stop us from making acceptable pizza?” Risks no longer had only red, yellow, and green colours. If the oven missed its temperature twice, it had to be checked that day; when cheese was enough for only one hundred pizzas, the front desk stopped promotions; when unfinished orders exceeded forty, the duty manager could pause one delivery platform; with fewer than four people on Friday night, no large group order could be taken; below a 4.5 rating, negative reviews had to be examined the next day.

Amin said, “Colours are not here to make a table look complete. When a colour changes, someone must change what they do.”

The third board asked, “Who may decide?” The front desk told customers the real waiting time and could issue refunds within limits. The kitchen lead decided whether ingredients could be used and pizzas could leave the oven. The duty manager could pause orders without waiting for Amin’s approval. Zhou checked risk indicators before closing, but he was no longer merely updating colours. Amin’s wife reconciled platform payments, supplier bills, and the reality in the shop each week, checking whether the story in the accounts matched the story in the shop.

For the next two months, profit looked less beautiful. The van-sale gain would not recur. Deferred repairs entered the accounts and refunds were deducted. The shop also added labour cost to keep Friday staffing adequate. Amin looked at the accounts and said, “When we calculate it like this, it was not as good as I thought.” His wife replied, “At least now you know where the problem is.”

Months later, there was another stadium match. When unfinished orders reached forty-two, the duty manager closed one delivery platform. When the oven temperature became abnormal, the kitchen stopped using one oven shelf and gave the front desk a new waiting time. They accepted a dozen fewer orders, but there were no mass refunds and no new negative reviews.

At closing, Amin said, “We made a little less tonight.” The duty manager smiled: “But we can open again tomorrow.”

Later Amin learned that the three whiteboards have formal names in larger organisations. The first is Financial Accounting: it helps managers see revenue, cost, assets, and obligations that have happened, and understand where profit comes from. The second is Enterprise Risk Management (ERM): it helps an organisation identify what can affect its goals and set early indicators, action thresholds, and responses. The third is Governance: it tells people who runs the operation, who can call a halt, who challenges, and who checks that the system actually works.

Amin did not put those English words on the menu. Beneath the three boards he wrote only one sentence: “Take good news in the accounts back into the shop to see it; when bad news appears on the wall, someone must take the next action.”

02

The decision problem

03

Core concepts

Accounting

read profit alongside cash and operating facts

Why it matters

Which operating fact is missing from your most important report?

Working capital

turn risk indicators into action thresholds

Why it matters

Who has the authority to stop or change the process?

Risk management

assign decision rights before pressure peaks

Why it matters

Which operating fact is missing from your most important report?

Governance

connect governance with usable evidence

Why it matters

Who has the authority to stop or change the process?

04

Visual framework

01Begin with a business situation
02Reveal the financial logic
03Connect the idea to a practical framework
04Apply it through reflection and decision questions

Five-step knowledge chain | Turning a number into governance action

See clearly what has happened → understand why the numbers look as they do → identify what may affect the objective → set the point at which action is required → specify who decides, challenges, and checks.

01How one transaction enters three financial statements

The three statements are not unrelated documents. They record the same company from different angles. The income statement records revenue, cost, and profit recognised over a period; the balance sheet records what the company owns, owes, and the equity left to shareholders at a point in time; the cash flow statement records actual cash inflows and outflows.

If the pizza shop sells a €20 pizza through a delivery platform and uses €8 of ingredients, but the platform pays next month, the income statement records €20 of revenue and €8 of cost, producing €12 of profit. The balance sheet adds a €20 receivable and reduces inventory by €8. The cash flow statement does not yet show the €20 received, because cash has not arrived.

Profit and cash being different does not automatically mean the accounts are wrong. Profit asks whether the business happened; cash flow asks whether money was received or paid; the balance sheet holds the unfinished links between them, such as receivables, payables, and inventory.

02Correct numbers do not have only one explanation

Accounting numbers may be recorded correctly, while managers still need to understand their cause. Higher profit can come from more products sold or from selling land, a building, or an old vehicle. Higher receivables can mean growth or slower-paying customers. Higher inventory can prepare for a peak season or reveal products that will not sell.

An asset remaining on the balance sheet does not prove it still has its old value or works normally. Ask whether a change comes from ordinary operations or a one-off item; whether it can continue; whether book value and reality agree; and what other evidence supports the explanation. EBITDA, margin, working capital, provisions, and impairment help us ask questions; they do not answer them for us.

03ERM starts from objectives, not a risk list

Enterprise Risk Management is not Finance managing every risk for every department, and it is not a Risk team maintaining a separate table. Food safety and quality belong with the business and Quality; equipment, people, and delivery with Operations; cash, budget, and financing with Finance; systems and data with IT; and compliance with the business and Compliance together.

ERM first makes the objective clear and then identifies uncertainty that could affect it. A pizza shop may aim to complete orders on time while protecting food quality and customer trust. Oven failure, staff absence, ingredient shortages, platform failure, and a sudden order surge can all affect that goal. Listing them is not enough: the organisation must state who owns them, how they are monitored, and when action becomes mandatory.

04Give risks signals, thresholds, and actions

Risk management cannot stop at red, amber, and green. Risk appetite is how much risk an organisation is willing to accept to achieve an objective. A KRI is an early indicator that risk is increasing. A threshold defines when action is mandatory. A risk owner monitors and handles the risk.

For example, unfinished orders may be the KRI; forty orders the threshold; pausing one delivery platform the response; and the duty manager the risk owner. Risk management then changes from “we know something could go wrong” into “when it reaches this point, this person must do this.”

05Governance says who is responsible, who challenges, and who checks

Even with correct numbers and identified risks, problems can remain trapped in minutes or spreadsheets when authority and responsibility are unclear. The first line runs the operation and handles daily risk. The second line provides specialist rules, advice, and challenge—such as Risk, Compliance, Finance, or Quality—without normally making the business decision. The third line, usually Internal Audit, independently checks whether the first two lines are well designed and actually operating.

A board or oversight body does not make every daily decision. It ensures that major objectives and risks are clear, boundaries are reasonable, serious matters are escalated in time, and action really follows. The same logic applies to non-profits and public bodies: their aim may be safety, fairness, response speed, and public trust rather than maximum profit, but public purpose does not remove the need for budget discipline, evidence, and accountability.

05

Practical example

Business example

Set a few actionable signals for cash, delivery, customer satisfaction, and platform dependence; specify the next action when a threshold is crossed.

06

Common misunderstanding

07

Key takeaways

  • read profit alongside cash and operating facts
  • turn risk indicators into action thresholds
  • assign decision rights before pressure peaks
  • connect governance with usable evidence

08

Knowledge check

What do the numbers reveal, and what might they hide?

09

Reference notes

  1. COSO (2017). Enterprise Risk Management: Integrating with Strategy and Performance — Executive Summary.

    COSO ERM executive summary.

    Supports the basic framework of objectives, strategy, risk appetite, performance variation, information and communication, and review.

  2. Grant Thornton (2017). Risk Frameworks.

    Risk-framework material.

    Supports ownership, risk appetite in decisions, risk reporting, and the division of work between management and oversight.

  3. Deloitte (2017). Managing Non-Financial Risk.

    Non-financial-risk framework material.

    Supports cross-functional operating, cyber, data, people, third-party, compliance, customer, and reputation risks.

  4. Royal DSM (2021). Integrated Annual Report, pp. 123–146.

    Assigned governance, risk, and internal-control pages.

    Supports the distinction between a company’s public description of control design and whether it works in daily operations.