A year ago, I attended a charity ball attended mainly by high-profile guests: business leaders, journalists, and politicians. Various items were auctioned off, with opening bids starting at around 200 euros and, in some cases, climbing somewhat higher, as happened with an unusual leather handbag. Then the auctioneer introduced a T-shirt signed by Robert Lewandowski.
At first, the bidding was restrained. But as the auction progressed, the mood in the room began to shift. Tension rose, excitement spread, and the bids started to escalate — first in increments of 10 to 50 euros, then by hundreds. In the end, the shirt sold for nearly 5,000 euros.
What made people willing to spend so much on what was, materially speaking, just a piece of fabric? The answer seems fairly straightforward. I do not mean to dismiss the charitable motive, but I do not want to romanticize it either. Without the signature of a world-class striker, it would have been impossible to persuade anyone to part with such a substantial amount. What the winning bidder really bought was not just a shirt, but a symbolic piece of Lewandowski himself.
I found myself wondering what the bidding would have looked like had the shirt belonged to Iker Casillas. My guess is that it would have ended at one or perhaps two thousand euros. I am fully aware that these are two very different players. But is the gap in their abilities really so vast? I do not think so. What matters is that we naturally assign greater value to spectacular moments. We are willing to pay far more for the drama of “Goal!” than for the relief of “That was close.”
Of course, the cry of “Goal!” becomes even sweeter when the team scores more than it concedes. Lewandowski would not be Lewandowski without the work of the entire team behind him. That does nothing to diminish his talent. A player of that caliber, combining exceptional ability with relentless discipline, comes along perhaps once in a decade. My point is simply that even the finest diamond only shines properly when it is set well.
I have spent more than twenty years in business, and during that time I have met a few “Lewandowskis” of my own — people who were reliable, highly focused on results, and possessed that hard-to-define quality that sets top performers apart. Sometimes they achieved spectacular success. At other times, they had to absorb painful defeats. Occasionally, luck was on their side: a fortunate bounce, a chance opening, a decisive moment that broke their way. At other times, they worked just as hard and achieved far less.
Yet once we set emotion aside, the conclusion becomes obvious. Lewandowski’s success is supported by the whole Bayern team. Cristiano Ronaldo’s achievements were built on the strength of Real Madrid. Lionel Messi’s brilliance depended, in no small measure, on the system around him at FC Barcelona. This is not meant to be another simplistic reflection on teamwork, team spirit, or team building. Those things matter greatly, but they are not the heart of the issue.
Strong teams can certainly be built on enthusiasm, mutual respect, and a compelling vision reinforced by passion. But over the long term, these qualities alone do not create winning organizations. Teams that succeed consistently are those in which everyone knows exactly what they are responsible for. High-performing teams understand that there are moments when the entire organization must focus on attack. In business, this may mean expanding production capacity, launching a major holiday campaign, or opening a new store.
A good team, however, must also be able to shift smoothly from attack to defense. Threats are everywhere: conventional market pressures, regulatory changes, fraud, cybercrime, reputational damage, and many others that companies often fail to see — or prefer not to see. The list is long. This naturally leads to a key question: how do we build a team capable of combining attack and defense without losing momentum in either direction?
Universities around the world employ thousands of people who attempt to answer precisely that question. Hundreds of thousands of books and articles have been written on the subject. Yet because we are instinctively drawn to the “attackers,” most attention is still focused on whatever may help drive revenue growth. We concentrate on expansion, sales, and market opportunities. Naturally, we also watch costs. But how many organizations plan seriously for the equivalent of a fire?
Most do not — at least not until something starts to burn. And yet every company should think carefully about what can be done to reduce the likelihood of major disruption and to limit the damage if it occurs. Fraud, legislative change, cyberattacks, supply chain disruption, and reputational crises are not theoretical events. They have happened before, and they will happen again.
One valuable source of insight into the evolving landscape of global threats is the Allianz Risk Barometer, published annually. Even so, broad global trends do not automatically capture the risk profile of any specific business. For that reason, one of the most useful and still underappreciated tools in management is a formal risk assessment model leading to a clear risk map. Such a map categorizes risks according to two basic dimensions: their impact on the organization and the degree to which they are controlled. It may also include a third dimension, such as likelihood or probability. A well-designed risk map is easy to interpret and, more importantly, makes it possible to connect identified risks with specific mitigation measures.
So how do we bring all of this together? In practice, it is far less complicated than it may appear, and the cost is often lower than managers assume. What it requires is responsibility, sound judgment, and a healthy dose of discipline.
This is where the three lines model becomes especially useful. The first line consists of the people on the front line of the business — the “attackers” who, from time to time, must also switch into defense. These are the individuals who manage everyday risks in the course of their operational responsibilities; in many organizations, they are referred to as process owners. The second line includes functions such as internal control, risk management, and compliance. The third line — internal audit — provides independent assurance on whether the first two lines are functioning properly.
For the model to work, the third line must be disciplined, competent, and genuinely independent, because it plays a critical role in evaluating the effectiveness and coherence of the entire system. If the three lines are properly designed and supported with sound risk management tools, the probability of success increases significantly.
The old saying goes that attack is the best form of defense. There is some truth in that. But the reverse is equally true: a team that defends badly is rarely in a good position to attack well, and teams that cannot defend consistently do not win often. Winning teams are the ones that can move quickly and effectively from defense to attack.
And once such a team is in place, we can afford to invest in Lewandowski — and shout, with confidence: “Goal!”