Managing Strategic Risk

What is Strategic RISK

Many business leaders do not understand the strategic risks within their business. Risk analysis often focuses solely on management and operational risks but fail to mention or underestimate the likelihood to possible impact of strategic risk on their business. Strategic risks though are far more critical in the determining the success or failure of an enterprise.

When leaders think about risk management in business they are too often talking about legal compliance or about the operational risks around issues such as health and safety.  

Drawing up lots of rules and making sure that all employees follow them on the other hand can solve operational risk. Many such rules, of course, are sensible and do reduce some risks that could severely damage a company. But rules-based risk management focuses on legal requirements, not complete risk management. 

Management and operational risks have attracted leaders attention for obviously important reasons around safety and compliance, but the risks have become over prominent in leadership thinking about risk. This is a common misunderstanding of risk by leaders, not seeing risk as primarily a strategic issue in business. This view of risk misses the strategic elements of risk, which leaders need to actively consider in defining their business model and in making strategic decisions. From start-up to exit risk is a strategic issue, which should underpin all strategic thinking.  

Risk is an essential element of strategic thinking. Every business idea creates and must deal with strategic risks. When someone comes to me with an idea and their opening phase goes along the lines of "no-one has done this before, that's why it will succeed" immediately gets me thinking is there an obvious reason about why no-one has done this before? In the real world there are no natural vacuums. So why has no-one else done this before.   

Strategic risk must be the first risks which entrepreneurs, owners, leaders and stakeholders (the shareholders, NED's, advisors and accountants etc) need to identify and identify and scrutinise. Strategic risk defines the real opportunity a business has to succeed, as an entity or within any chosen opportunity it sets to undertake, from a new product or service through to entering a new market.

Risk v Opportunity

All opportunities carry a risk. The two elements are tangibly linked, there are no opportunities that do carry risk, and the direct link between the two means the greater the opportunity so the greater the risk.  Too few business leaders identify that clearly and develop a clear plan to deal with those strategic risks. In Dragon's Den the reason why the dragons often want so much of the shares for their investment is to deal with that risk. I the risk is low (clear market, clear routes to that market, experienced and viable leadership team and clear plans to get to market with an plausible exit strategy) then they fall over themselves (trample over each other) to make corresponding offers for a far smaller share of the pie. This is a simple example of the value of understanding strategic risk in setting up a new business. But this is what experienced consultants like myself assess when we strategically plan a business. 

As an independent experienced strategic planner identifying the strategic risks, profiling these and then assessing these risks is critical for leaders to understand and actively overcome in their strategic thinking.     

Developing leadership risk skills is an important element for leaders to understand that their approach to risk defines how the lead and what they lead. Strategic risk defines the type of business model that leaders develop through to which markets and where in them they choose to operate. 

Understanding strategic risk and learning to how to manage key business risks throughout your business is an important skill set for leaders to develop in establishing their judgment in risk considerations and ensure they are integrated into strategic thinking.  There are two parts to risk, firstly identifying your strategic risk and then secondly how to actively manage the identified risks, which this article covers. If you would like to know more about strategic business planning then click this link here.

Here are some key questions to consider in identifying strategic risk:  

1. Risk Appetite 

The first stage in managing risk is to look at the leadership team and its surrounding stakeholders, both formal (Board, NED, shareholders) and informal (employees, advisors, channel partners) to map out the appetite to risk. The leaderships' risk appetite determines the overall approach the business will take to risk. Risk is always directly linked to opportunity and therefore reward, take no risk and you take no reward. Conversely take high risks and you could achieve high rewards (think Amazon), but equally exposes the business to potential high failure. 

The more the leadership diversifies from its core skill sets so it increases the risk it is likely to face. This is why investors want to see both  the leadership teams track record but also their relevance to the market. Diversity in its self is also vitally important, too many people from within a narrow field often limits risk taking due to lack o wide and group think mentality. Leadership diversity increases risk, and lack of diversity reduces risk appetite.

Risk appetite is also directly correlated to the experience of the sector you are operating in, the more established and known the sector is to the leadership team has so the lower risk the leadership team sees in operating with in it. than emerging and unknown.       

2. How well is your strategy defined? 

Without a defined strategy your business is at high risk. If the leadership does not have a clear and articulated strategy, which is shared and owned, then the business is vulnerable to strategic drift, living in a dream without clarity and purpose. Having a strategy in place, provides the context of the business, with strategic goals, intent in positioning and outcomes defined which enable the business to drive forward. To learn more about strategy click here.

Inside a good strategic plan the strategic risk must be identified, clarified and clearly mitigated, with realistic, affordable and attainable mitigations in place.  A great strategy does not avoid risk but embraces it.  Many of the leading and successful businesses were begun by entrepreneurs who fully embraced strategic risks.   

3. Strategic Risk Analysis

A business strategy must define the risk environment within which it operates. Strategic risk starts by looking at the risks that exist within a market (and defining why and how you will succeed despite them) as we as the strategic risk in entering a market compared to the risk of not entering a market. Strategic risk management should compare not only the risks of the strategy but the reverse risks of not doing the strategy, the gap risk of missing the opportunity. Why are we going here not there is a classic question which I ask, and so often hear no coherent argument as an answer.

Strategic risk also covers risk analysis of the leadership and its approach to risk, how comfortable it is with risk reflects in how leadership teams actively manage risk which reflects its established risk skill set and appetite to risk across the board. How well can the senior team deal with risk, and to just ignore it, is an important element of risk analysis. 




4. Strategic Risk Assessment

Risk, any risk is defined by the potential impact of the consequences from it. The manifestation of its likelihood of occurring is the assessment which must be undertaken, this is often scrutinized by undertaking scenario analysis (driven by board, NED and expert support and advisors) will encourage the leadership to consider a range of scenarios that can result in significant adverse consequences for the business and assist the leadership to make sure full width and depth analysis of strategic risk is undertaken.

This assessment provides the basis of mapping the risk and determining the investment in mitigation required to reduce or remove that risk. Often risks are not seen across the business, the strategic risk assessment fails to understand that a company is a whole entity not just a product or service, so its IT, people, location and environment  are as vulnerable to strategic risk as is the market it operates within. Strategic risk is as (and often more) likely to occur within the infrastructure of a business as it is within a market. 

The other strategic risk assessment that is often under assessed (if at all) are global risks. The era of global issues from terrorist attacks, natural disasters or global pandemics are now part of strategic risk assessment.




5. Strategic Risk Mapping

The
leaders must see risk in the context of how shareholders or stakeholders measure value in the organization. This essential mapping of risk enables the leadership to articulate to stakeholders how the risks they are taking or the risks the business is exposed to may affect the organization’s ability to realize its strategic goals. By identifying common metrics for risk and performance also allows the leadership to define the priorities of risk management activities and focus on the mitigation of relevant and important and decision defining risks the board.

Defining Strategic Risk

The second step, in creating an effective strategic risk management system is to understand the qualitative distinctions among the types of risks that a business could face and determining how to actively manage those risk. Risks typically fall into one of three categories and here's how leaders should be managing them:

1. Managing: Strategic risks.

The leadership having determined the level of risk it is willing to take in order to generate the returns from its strategy, its risk and reward profile, leaders must then develop appropriate channel partners to achieve that strategy. From its bankers credit risk, its strategy of launching new products through to its channel partner selection, all these decisions impact upon the strategic risk strategy. 

Strategic risks are quite different from operational risks because they are not inherently undesirable; they are quite the reverse they are deliberately accepted as part of operating within that industry. A strategy with high returns requires the business to take on higher risks, and actively managing those risks is a key driver in achieving those potential gains.

Strategic risks cannot be managed through a rules-based control models, such as compliance to legislation. Instead, the leadership must install a risk-management system designed to reduce the probability that the assumed risks actually materialize and to improve the company’s ability to manage or contain the risk events should they occur. Such systems enable companies to take on higher-risk, higher-reward ventures by identifying drivers of strategic risk, most often these are identified through 5 Forces analysis within markets and systems usually include primary (and secondary fallback) detailed objectives which must be achieved which underpin the strategy to actively manage the strategic risks.    

2. Managing: External risk factors

Certain strategic risks arise from events outside the company and are beyond its influence or control, often identified through PESTLE analysis. These major macroeconomic risks are outside the market but directly influence it. PESTLE identification and analysis enable leaders to manage the external risks effectively, through proactive identification and mitigation of their impact. For example changing economic conditions may raise global interest rates, which put pressures on even successful businesses, which impacts upon costs and profits.

Businesses need to build a defined risk management processes to these different PESTLE categories. By identifying key drivers of external change leaders can devise stress testing through scenario planning and devise alternative strategic options should external risk factors come into play.

3. Managing: Preventable internal risks. 

Conversely internal risks, arising from within the organization, that are controllable and ought to be eliminated or avoided. Businesses should have well defined internal risk systems in place which includes a tolerance level, such as 95% of all calls must be answered within 3 calls, in other areas health and safety for example mandatory 100% requirements for the use of PPE and operating systems must always be in place.  

Businesses should seek to eliminate these risks since they get no strategic benefits from taking them on. This risk category is managed through active prevention by monitoring operational processes and guiding people’s behaviors and decisions toward desired norms.

Identifying and managing preventable risks is about good management of existing best practices within the legal and industry best practice.  Companies cannot anticipate every circumstance or conflict of interest that an employee might encounter, so ensuring that risk is talked about, reviewed and assessed against best practice. 

Managing Risk effectively

Risk is a difficult subject for leaders, precisely because it is seen as an operational detail rather than strategic in nature. Business planning sets over optimistic forecasts, from unrealistic timescales to launch new products and services through over inflated revenue streams.  This form of linear extrapolations, how leaders have done it before will be immediately repeatable with something new is compounded by the use of conformation bias, selectively picking supportive data and ignoring unsupportive data. This form of groupthink often limits the risk discussion by narrowing the discussion down to it will happen rather than taking a holistic approach to risk.

Other key drivers of strategic risk failure come from leaders ignoring industry activity, how fast and quickly competitors will react to any new strategic initiatives to minimize their impact upon the status quo and how channel partners and customers will sound supportive but will measure the risk to them and mitigate it by limiting their exposure to risk. How industries react to change is one important consideration from an effective 5 forces analysis of any market. How do they players react to change is often analyzed by war-gaming with scenarios played out in theoretical games to see the impact of industry competition.

By strategy mapping your business leaders can often assess all risks linked to objective setting, looking at risk events associated with each objective and generate a risk profile for each risk and associated mitigation strategy.

Recently the adoption of the balanced scorecard has become a major way of mitigating risk, by linking mitigation to performance driver indicators of behavior within the organization. This highly effective risk management tool enables companies to engineer risk out of departments through positive mitigation strategies.  

For areas of risk which cannot be mitigated from within the company, such as natural disasters or acts of terrorism, then developing contingency plans act as mitigation to unforeseeable external risks. Not putting all leaders on the same plane is a simple example of contingency planning as is having secondary operational site, should your primary site be unusable from either natural causes such as flooding or from acts of terrorism.

Like to know more about strategic business planning then learn more through my video course on strategic business planning, which will reduce your risk in succeeding within your market, then click this link.

Good leaders embrace risk, they do not avoid it and investing time and skills into understanding and actively managing risk is an important element of leadership.  Good strategic planning encompasses strategic risk assessment and leadership teams need to invest in understanding their risk if they wish to succeed in their market.