Estimated annual productivity loss during the NCAA Tournament's first two rounds
Americans who fill out brackets each year — roughly one in five workers
Wagered on March Madness annually — raising compliance flags for any employer who runs or ignores office pools
Each spring, as the NCAA Tournament tips off, millions of employees shift their attention — if only partially — from spreadsheets and strategy to brackets and buzzer-beaters. March Madness is a genuine operational risk event. But it's also one of the few risk scenarios where the treatment isn't avoidance — it's calibrated tolerance.
The risk manager who overreacts and bans all bracket activity will damage morale, reduce engagement, and create a trust deficit far more costly than a few hours of distracted work. The risk manager who ignores it entirely may find themselves managing a compliance issue or an IT bandwidth crisis at the worst possible moment. Here's how to play it smart.
The Three Risk Zones
Operational Risk
- Deadline misses from distracted staff
- Customer service degradation on game days
- IT bandwidth strain from livestreaming
- Absenteeism spikes after upsets
- Concentration risk in teams watching the same game simultaneously
Compliance Risk
- Office pools may constitute illegal gambling in some states
- Employer liability if pools are run on company systems
- Pressure on employees to participate — HR and inclusivity exposure
- Regulatory uncertainty around "prize" thresholds
- Undisclosed gambling activity in regulated industries
Culture & Strategic Risk
- Over-regulation damages morale and trust
- Hybrid/remote teams lose a rare shared bonding moment
- Perceived hypocrisy if leaders participate while staff is banned
- Disengagement in the weeks following if handled poorly
- Talent retention signal — how you handle small things matters
The ERM Perspective: Risk vs. Reward
The fundamental ERM question here isn't "how do we stop this?" It's "what is the actual risk-adjusted cost of different responses?" Banning bracket participation may eliminate the compliance risk — but at what cost to organizational culture, trust, and retention? The ISO 31000 framework calls for risk treatment decisions that are proportionate to the risk and account for all affected objectives, including strategic and cultural ones.
A policy that eliminates one risk while creating a larger one isn't risk management — it's risk shifting. The risk manager's job is to find the treatment that optimizes across all organizational objectives, not just the most visible one.
Erike Young, ARM-E — RM Study Group
The productivity loss from March Madness is real but temporary, concentrated in two days (the first round Thursday and Friday), and significantly offset by the engagement and morale benefits of shared participation. For most organizations, the optimal treatment is not avoidance — it's structured tolerance with defined guardrails.
Do's and Don'ts: The Risk Manager's Bracket
✓ Do This
- Run a free-to-enter company bracket competition — no cash prizes, fun rewards only (extra PTO, lunch with leadership, a trophy)
- Designate a "game break" window on peak game days and communicate it proactively
- Brief your IT team to anticipate bandwidth spikes and implement light throttling if needed
- Consult legal or compliance on your state's gambling laws before running any pool — even casual ones
- Let managers lead by example with balanced, transparent participation
- Use the moment to build cross-team connections in hybrid/remote environments
✗ Avoid This
- Running cash prize pools on company systems without a legal review
- Issuing a heavy-handed blanket ban that treats employees as suspects
- Ignoring it entirely and discovering a compliance issue mid-tournament
- Allowing pressure on non-sports fans or employees with religious objections
- Scheduling critical deadlines or all-hands meetings for first-round game windows
- Leaders visibly participating while prohibiting staff — nothing destroys trust faster
The Risk Manager's Game Plan
- Clarify expectations before the tournament begins
A one-paragraph note from HR or leadership on appropriate use of work time and IT resources — sent before the brackets drop — is far more effective than a reactive policy memo sent after someone streams four games at their desk.
- Get a legal opinion on bracket pools in your state
Gambling law varies significantly by state. What's a casual office tradition in one state may technically violate gambling statutes in another. A 30-minute conversation with your employment attorney is worth more than assuming it's fine.
- Brief IT on bandwidth management
The first-round Thursday is one of the highest-traffic streaming days of the year. If your organization relies on bandwidth-intensive operations, a brief conversation with IT about monitoring and light throttling during peak game hours will prevent a surprise.
- Design an inclusive participation option
Not everyone follows basketball. A free bracket pool with no cash component, fun prizes, and zero pressure to participate creates a shared moment without the compliance risk and without alienating employees who aren't sports fans.
- Schedule critical work around game windows
The first Thursday and Friday of the tournament see the most distraction. If you can avoid scheduling major launches, client presentations, or critical deadlines on those days, you're managing the operational risk at the source.
How an organization handles small, low-stakes cultural moments like March Madness tells employees a great deal about how it will handle big ones. Proportionate, thoughtful risk management — not zero tolerance, not willful blindness — is what builds lasting institutional trust. That's an ERM outcome worth optimizing for.
Final Buzzer: Don't Bench the Fun — Manage It
March Madness doesn't have to be a nightmare for risk managers. With a proportionate approach, it's an opportunity to demonstrate exactly what good risk management looks like in practice: identifying real risks, assessing them honestly, and choosing treatments that optimize across all organizational objectives — not just the most obvious one.
The organizations that get this right will have a more engaged workforce in April. The ones that get it wrong will have either a compliance issue or a morale problem. The bracket is yours.
