In recent years, much has been learned about the importance of integrating risk into strategy-setting. This integration theme is vital because, if it is ignored, risk becomes an afterthought to strategy and an appendage to performance management. We’ve distilled the learnings down to 10 lessons for executives and directors to keep in mind when integrating risk into the process of formulating and executing strategy.
What We Don’t Know May Be More Important Than What We Do Know
Focusing on what we don’t know requires a process. One approach is to define the critical assumptions representing management’s view of the business environment during the strategic planning time horizon. These assumptions reflect management’s view concerning the enterprise’s capabilities, competitors’ capabilities and likely actions, expected customer preferences, technological trends, capital availability, and regulatory trends, among other things. They are what two co-authors refer to as management’s “white swans.” These assumptions are important because the strategy is based on them.
One way to cope with uncertainty is to consider the impact if one or more strategic assumptions become invalid. Once management’s assumptions are defined, contrarian statements are developed to suggest plausible as well as extreme scenarios that could affect one or more of them. Management and directors then select the contrarian statements that are likely to have the greatest impact on the company’s ability to execute its strategy and business model if they were to transpire. These high-impact statements would ordinarily reflect situations that would arise from events about which the organization currently lacks sufficient information and that management would likely rationalize after the fact: “Why didn’t we see it coming?”
For the high-impact contrarian statements, management should develop implication statements. An implication statement resolves the conflict between the strategic assumption and contrarian statement by addressing two questions: “What would we do if this assumption underlying our strategy were no longer valid?” and “How would we know if the assumption were no longer valid or were becoming invalid?” As with many strategic uncertainties, action plans arising from an implication statement often include implementing forward-looking trending and other metrics to monitor the vital signs that provide insights regarding the continued validity of the assumptions.
10 Lessons in Integrating Risk Management with Strategy
- What we don't know may be more important than what we do know.
- Sooner or later, something fundamental in your business world will change.
- Failure to attain "early-mover status" can threaten an organization's viability
- Reputation is a precious asset - lost it, it's game over.
- Occasionally, a contrarian voice is needed at a crucial moment - do you have one?
- Every organization can expect to be tested eventually - are you ready?
- Managing to a single view of the future can be a fool's errand.
- Managing the tension between creating and protecting enterprise value is THE toughest risk management task.
- Focus the board's risk oversight on the critical enterprise and emerging risks.
- The rearview mirror doesn't help much when you're going forward.
Because no one knows for sure what’s going to happen in the future, the above analysis would at least help management and directors understand the implications of change, as well as what needs to be monitored closely to detect a change. To use the 2008 financial crisis as an illustration, assume the strategy for a given financial institution was as follows (to paraphrase the substance of what many institutions were doing):
Leverage cheap money to achieve volume and speed in lending to the low-income housing (or subprime) sector to facilitate the securitization and sale of these loans as collateralized mortgage obligations (CMOs).
Key assumptions underlying this strategy included increasing or stable housing prices, continued availability of cheap money, continued demand for CMOs by investment bankers, and continued economic growth, among others.
Assume the following contrarian statement is considered to be high-impact:
To the assumption regarding increasing or stable housing prices: The housing market takes a significant dive in all major markets in the United States, hitting all segments of the loan portfolio.
The implication statement for this high-impact contrarian view might have been as follows:
Monitor housing market indicators in all major U.S. markets with significant loan portfolio concentrations, as well as test housing prices by monitoring the sale of selected assets from time to time to obtain a reliable read on market activity.
The financial services industry had a “blind spot” in that never in recorded history had there been a significant deterioration in housing prices in all major markets in the United States. Accordingly, prior to the financial crisis, many across the industry believed that property markets in different American cities rose and fell independently of one another. Yet, with the heavy concentrations in high-risk, complex financial products, few asked the question: What are the implications if such a scenario develops? Those institutions that focused on that question got a 12- to 14-month head start in liquidating their portfolios. They noted that a nationwide housing-price slump had begun, starting in 2006, while other institutions did not. These banks fared much better in getting through the crisis and finding a seat in the ring when the proverbial music stopped.
Sooner or Later, Something Fundamental in Your Business World Will Change
Are management and the board flying blind, but just don’t know it yet? Disruptive change in the marketplace is a business reality and arises from technological developments, market forces and unexpected threats. Adapting is a game every organization must play to survive and thrive in a rapidly changing business environment. Successful adaptation requires knowledge, which is why a clear understanding of strategic assumptions and the accompanying contrarian analysis, as discussed earlier, is useful in providing direction to the intelligence-gathering process.
The point is this: Competitive intelligence needs to be aligned with what really matters. If intelligence-gathering processes are not linked to strategic assumptions, how else will the company know when it approaches the crossroads where a “strategic inflection point” exists due to a major change in the competitive environment (e.g., introduction of game-changing technologies, a dramatically different regulatory environment, a sea change in customer preferences, or a catastrophic loss of critical value chain components)? These occurrences require a fundamental change in business strategy. Anything less is inadequate.
Take Borders, for example, the bookstore chain that filed for bankruptcy in 2011 after years of increasing competition, declining sales and months of missing payments to vendors. According to the company’s 2003 annual report, the two primary initiatives of its growth strategy were to (1) expand and refine its core domestic superstore business, and (2) drive international growth by expanding in established markets and leveraging infrastructure investments. Among the assumptions underlying this strategy, the following were noted by management in the company’s 2003 annual report:
- Expansion will continue to increase top-line performance
- Diverse geographic presence of more than 1,200 bookstores in six countries on four continents will augment brand recognition and improve distribution network economics
- Expansive selections of a variety of media, including many hard-to-find titles, will make Borders “the place to go”
If intelligence-gathering processes are not linked to strategic assumptions, how else will the company know when it approaches a “strategic inflection point” due to a major change in the competitive environment?
Contrarian analysis of these assumptions might have identified the following:
- Physical plant expansion and store refurbishment “doubles down” on the current cost economics business model at a time of significant change in the industry.
- A big merchandising bet to go heavy on CD music sales and DVDs may backfire as the industry goes digital.
- The emergence of the Internet as a retailing channel for content and media poses a significant threat (i.e., customers may prefer e-books and downloading of music content).
The above contrarian analysis might have resulted in the following implication statement:
The “one-stop shop” retail brick-and-mortar bookstore vision becomes a relic of the past as customers increase use of the Internet to procure what they want and competitors beef up online sales and develop e-readers to capitalize on the mobility provided by technology.
This implication statement is not a mere exercise of 20/20 hindsight. Borders’ primary competitor, Barnes & Noble (B&N), saw the above issues coming and adapted accordingly by slowing down its use of brick-and-mortar outlets, limiting the number of titles it offered, introducing e-books and an e-reader (the Nook), pulling back on music CDs and DVDs, and investing in online sales capabilities. Meanwhile, Borders decided not to invest in online sales operations and instead outsourced to Amazon (a significant competitor), exposing its retail outlet operations to “showrooming.”
What direction would the competitive intelligence function have received, had Borders undertaken the above analysis? Following are some illustrative metrics Borders might have used to evaluate the continued validity of the assumptions underlying its growth strategy and business model:
- Actions by:
- Other real estate bookshops (e.g., reductions in store size and titles, which is what B&N did)
- Recent market entrants (e.g., Amazon, Apple, Netflix)
- Pricing differentials relative to physical retail and Internet competitors
- Web-based sales from:
- Book sales by Amazon
- Music and video by Apple
- Internet sales by B&N (and other retailers)
- Customer behavior in accessing books (e.g., online, physical retail, B&N Nook, Apple, Google, library, borrow from friend, etc.)
- Year-to-year sales growth
- Inventory levels
- Working capital trends
- Per-day store sales
- Web-based sales versus in-store sales
- Number of books sold
- Real estate costs
BRAND AND MARKETING
- Mall traffic trends
- Comparability of storefronts and locations with B&N
- Per-day customer traffic
- Percentage of browsers who do not buy anything
The above metrics are examples of vital signs that provide valuable insights regarding the sustainability of Borders’ growth strategy. The market was undergoing change, and Borders had either reached a strategic inflection point or one was fast approaching. Unfortunately, Borders didn’t make the necessary turn at the crossroads, and the company paid the price.
At the time of publishing this issue of The Bulletin, it appears that B&N faces challenges. A review of the company’s financials over the last five years indicates declining margins, a cause for concern. One reason for this trend is that the company’s Nook reading device division is losing money. As digital books proliferate, B&N appears to remain committed to its retail strategy of combining brick-and-mortar outlets and online sales. In its most recent quarterly report for the fiscal 2014 third quarter ended January 25, 2014, the company’s CEO reported progress in reducing costs while focusing efforts on reversing the decline in content sales. He also reported that B&N remains committed to packaging and distributing content through devices. Given the strong competition in the device space, it will be interesting to watch how this strategy plays out.
Companies fall so in love with their business model and strategy that they fail to recognize changing paradigms and the need to innovate and adjust until it is too late.
Failure to Attain “Early-Mover Status” Can Threaten an Organization’s Viability
Would close attention to market developments have saved Borders? No one can say for sure. An “early mover” is a firm that quickly recognizes a unique opportunity or risk and uses that knowledge to evaluate its options and take appropriate action either before anyone else or along with other firms that likewise seize the initiative. For example, some financial institutions saw the signs of a shifting market and took the initiative in sufficient time before the financial crisis wave crested, giving their management and board valuable options. These early movers had the advantage over their less fortunate counterparts.
What separates an early mover from the rest of the herd? Companies fall so in love with their business model and strategy that they fail to recognize changing paradigms and the need to innovate and adjust until it is too late. Companies can rationalize away the improbable scenario or event without considering the consequences of being unprepared if the scenario or event were to materialize. In essence, they embrace the status quo. Such “status quo bias” drives organizations to focus on doing things right, (e.g., faster, better, cheaper) rather than being more future oriented, obsessing about competitors and game-changing opportunities, and considering how the company can innovate to create market disruption.
Failure to attain “early mover status,” as we’ve defined it, can be fatal in today’s complex and ever-changing business environment. While no one can predict the future, the one thing we can count on is that the validity of management’s strategic assumptions will come under question over time as the business environment changes.
We’ve pointed out the importance of recognition – meaning an early mover quickly recognizes the market opportunities and risks that matter – and outlined a process to facilitate timely recognition. Of equal importance is reaction, meaning an early mover reacts to the significant opportunities and risks it recognizes on a timely basis. Companies that demonstrate the ability to adjust their strategy, plans and processes to adapt to a changing environment typically foster an organizational culture that facilitates consideration of the impact of disruptive change on critical strategic assumptions. Most importantly, they encourage managerial intuition and ingenuity to translate information evidencing invalid assumptions into actionable revisions to their strategy. In summary, they seek to make their organizations more resilient so that decisive action is taken on necessary adjustments to strategic and business plans in response to changing market realities.
Reputation Is a Precious Asset – Lose It, It’s Game Over
Reputation is like a ticket to the big game. Show it at the door or you won’t get in. A company can tarnish and even ruin its reputation with a single instance of poor judgment. While there are likely varying definitions of reputation, everyone agrees it’s important and recognizes a reputation that has been damaged beyond repair. As explained by one author, reputation risk is “the loss of the value of a brand or the ability of an organization to persuade.” A previous issue of The Bulletin described 10 keys for managing reputation risk arrayed among five categories: strategic alignment, cultural alignment, quality commitment, operational focus and organizational resiliency.
Managing reputation risk is inextricably tied to the risk management and crisis management processes. For example, an effective risk assessment process considers the boundaryless enterprise (i.e., an assessment process that applies an end-to-end extended enterprise view of the value chain, requiring consideration of looking upstream to supplier relationships, including the suppliers to critical suppliers, as well as downstream to channels, customer relationships and all the way to the ultimate end user). In effect, the enterprise’s business relationships are just as important as its internal processes, personnel and systems because they are inextricably linked to what makes the business work. This view of the boundaryless enterprise extends to outsourced and offshored processes.
To illustrate the use of this “big picture” approach, uncompensated risks (exposure to events that have significant downside with little or no upside potential) sourced across the value chain can be causes of reputation risk. These risks require attention because they include “stop-the-show” supply chain disruptions, mega warranty costs and/or product recalls, or headline-grabbing environmental, health and safety exposures. Lead content, toxic materials, impure ingredients and other inputs provided by suppliers that fail to meet specifications set by the laws and regulations to which a company is subject can damage that company’s brand and reputation. Unsafe working conditions, child and slave labor, conflict minerals and other issues lurking upstream in the supply chain wait for discovery, at which time they will become an embarrassment to a company’s brand. A culture that permits the trumping of prudent public and worker health and safety standards with cost and schedule considerations carries a price. Eventually, the day of reckoning will arrive.
The above discussion explores the risk management side of managing reputation risk. There is also the crisis management side. As demonstrated by Johnson & Johnson’s handling of the Tylenol crisis in 1982, a world-class reaction can be very effective in protecting a reputation and brand. More contemporary examples include Southwest Airlines’ use of social media in navigating through the crisis resulting from one of its planes landing nose-first at New York’s La Guardia airport. Quick response time and open, honest communication on social media outlets enabled the company to control the story, maintain good faith with its customers and protect the brand.
A great crisis response doesn’t happen by accident. If a crisis management team doesn’t exist or isn’t prepared to address a potential crisis, rapid response to sudden, unexpected events will be virtually impossible. Fires cannot be fought with a committee. Therefore, the risk assessment process should be designed to identify areas where preparedness is critical. This is discussed further later.
Managing reputation risk is a strategic imperative. A company’s customers and stakeholders could not care less where the source of risk is. All they care about is the company keeping its brand promises − both explicit and perceived. They look to the CEO and the board as being ultimately responsible for protecting the enterprise’s reputation.
Occasionally, a Contrarian Voice Is Needed at a Crucial Moment – Do You Have One?
Washington Mutual was an unfortunate casualty of the financial crisis. Two former chief risk officers (CROs) asserted that they tried to curb risky lending practices at the bank; however, they claimed they met resistance from top management when they escalated their concerns. One CRO claimed he was excluded from senior executive meetings and meetings with financial advisers when the bank’s response to the growing crisis was being discussed and, by January 2008, fully isolated until he was fired by the CEO a few months later. The other CRO testified before a Congressional committee that he had tried to limit loans to those who were unlikely to be able to repay and the number of loans made without verifying borrowers’ income. However, he too was ignored by executive management.
According to the Wall Street Journal, the Washington Mutual CEO reported in a 2007 memorandum to the board of directors that “an asset price bubble could deflate at any time” and that “housing prices are declining in many areas of the country and sales are rapidly slowing.” In the same letter, the CEO recommended the institution increasingly emphasize home-equity loans, option adjustable-rate mortgages and subprime loans. Interestingly, the memorandum noted there was “no way for the company to achieve earnings targets without more loan activity.”
The proudest organizations and brands are not immune to being called out by the unexpected. Guessing at probabilities to determine that a particular risk is remotely likely to happen isn’t going to eliminate the threat.
Washington Mutual, Inc. filed for Chapter 11 voluntary bankruptcy in 2008. With respect to total assets under management, its closure and receivership is the largest bank failure in American financial history. It didn’t have to happen. Simply stated, risk management was ignored as a discipline. If viewed by executive management as a tick-the-box compliance exercise, risk management has little strategic relevance. If the board of directors doesn’t ask the tough questions and redirect the CEO’s focus, the organization plays out a losing hand.
This lesson illustrates why a strong contrarian voice is occasionally needed in an organization’s history. More importantly, there are times when such a voice needs to be heard by the right people. Proper positioning of independent risk management/compliance functions entails several important principles:
- Leaders of such functions should be viewed as peers to business line leaders.
- They should have a direct reporting line to the CEO.
- They should have a reporting line to the board or a committee of the board with no access constraints.
- The board or a board committee should conduct mandatory and regularly scheduled executive sessions with these functional leaders.
- A formalized escalation process should exist.
In summary, to ensure an effective contrarian voice, there should be clearly defined positioning for the risk management/compliance functions and how they interface with line of business and executive management, as well as the board of directors. Most importantly, the board and CEO must have a mutual understanding of the value contributed by these independent functions with the intent of preserving their independent role within the organization.
Every Organization Can Expect to Be Tested Eventually – Are You Ready?
It’s a given that stuff happens. The question is, are management and the board prepared to respond? Traditional risk maps, heat maps and risk rankings based on subjective assessments of severity of impact and likelihood of occurrence often leave an organization with a list of risks and, with respect to the high-impact, low-likelihood risks, little insight as to what to do next. And once the exercise is completed, the question still remains: What would the organization do if any of these things were to happen?
The question is a fair one. Even the proudest organizations and brands are not immune to being called out by the unexpected. Throwing darts at the wall to guess at probabilities to determine that a particular risk is remotely likely to happen isn’t going to eliminate the threat. It is important to consider the following factors, in addition to significance of impact and likelihood of occurrence when assessing risks:
- Velocity to impact once an event occurs (e.g., does the scenario or event have an immediate impact once it occurs, allowing little time for reaction, or does it smolder for years mired deep in the company’s internal, outsourced and offshored processes until the day of reckoning finally arrives?);
- Persistence of the impact (e.g., does the scenario or event have a lasting headline effect or will it quickly become yesterday’s news?); and
- Resiliency of the company in responding to the scenario or event once it occurs.
These additional criteria help management evaluate high-impact, low-likelihood threats to identify areas where preparedness must be improved.
As stated earlier, organizations are boundaryless. An “extended end-to-end enterprise” perspective requires a look at the value chain that summarizes the entire life cycle of value creation (i.e., management should look upstream to key suppliers and downstream to key customers to identify key dependencies that really matter). For example:
- Which suppliers do we depend on for essential raw materials and component parts? What would happen if we were to lose one of them for any reason? How long would we be able to operate? Are there other qualified sources of supply readily available?
- Have our key suppliers performed their own risk assessment, looking at their suppliers? Do they have effective plans for taking corrective action in times of disaster? How do we know?
- What if there were temporary shortages in raw materials? Or serious defects in supplier raw materials and component parts? Or material volatility in prices?
- Are there customers we couldn’t afford to lose? What if major customer contracts were not renewed? What if major customers were to consolidate? What if we were to lose a major distribution channel?
- What if there were significant disruptions in transportation and logistics?
When assessing the potential impact of a disruption, consider its velocity and persistence, as well as the organization’s response readiness. When these additional factors are considered, risk management begins to intersect with crisis management.
To illustrate, the Japanese have a word, “sotegai” (meaning “outside our imagination”) to describe the unthinkable, which is exactly what occurred at the six-reactor Dai-ichi complex operated by Tokyo Electric Power Co. (TEPCO) located in the Fukushima Prefecture of Japan. In designing its earthquake model to assess and confirm the safety of the complex, TEPCO’s engineers decided not to factor in quakes occurring earlier than 1896. This approach documented that the reactors were situated some 14 to 23 feet (4.3 to 6.3 meters) above the high-water mark projected by the model. However, the 2011 tsunami that hit the complex was about 27 feet (8.2 meters) above TEPCO’s projection, resulting in flooding that disabled backup power generators and imperiled the nuclear reactors and their nearby spent fuel pools. The earthquake model disregarded important scientific evidence asserting that a major quake had occurred more than 1,000 years ago resulting in a powerful tsunami that hit many of the same locations as the 2011 disaster. Scientists also found evidence of two additional large tsunamis hitting the same region during the past 3,000 years, leading to a view that a largescale tsunami was, in effect, a 1,000 year event.
Contrarian analysis applied to the assumptions supporting TEPCO’s earthquake model would likely have pointed to a high-impact, high-velocity and high-persistence catastrophic event for which there was very little, if any, response readiness. That analysis might have led to an implication statement to evaluate the plant’s safety planning in light of a catastrophic tsunami scenario, including the location of backup power facilities for avoiding a fatal loss of power. We all know how this sad story played out. TEPCO lost a bet against geological time.
Managing to a Single View of the Future Can Be a Fool’s Errand
Given the complexity of the business environment, executives need to be careful to avoid the kind of overconfidence that can breed a single view of the future. Overconfidence is often driven by past success, as well as the strong convictions of leaders who are persuaded their future view is accurate. It is common for leaders to make bets based on what they see happening several years out; it’s what they’re paid to do. But for the truly big bets, what if they’re wrong?
“What if” scenario planning and stress testing are tools for evaluating management’s “view of the future” by visualizing different future scenarios or events, what their consequences or effects might be, and how the organization can respond to or benefit from them. Because these tools focus management on identifying the likely direction and order of magnitude of changes in the business environment on the drivers of the enterprise’s revenues, costs, profits and market share, they are an important consideration in contrarian analysis. They enable management to assess the hard spots and soft spots in the business plan for delivering expected performance, focusing efforts to make the plan more robust and achievable.
Scenario planning can help management cope with uncertainty. The art of scenario planning lies in blending the known with the unknown into a manageable number of internally consistent views of the future spanning a wide range of possibilities. Scenario planning and stress testing help management challenge assumptions and expectations, address “what if” questions, and identify sensitive external environment factors that should be monitored going forward. By deepening their understanding of the pain of the unexpected, management can identify when contingency plans or exit strategies are required and reinforce the need for adaptability in executing the strategy. Management must be committed to the scenario-planning exercise to ensure it is sufficiently rigorous to discriminate the vital signs the company must monitor going forward. Combining the explicit opportunity discussion with scenario analysis and stress testing leads to a business discussion, not a risk discussion.
Managing the Tension Between Creating and Protecting Enterprise Value Is THE Toughest Risk Management Task
Every CEO pursues opportunities with the objective of building enterprise value. It is what every board expects, whether it means entering into new markets, investing in new products, merging with or acquiring another entity, building new plants to expand, or exploiting other market opportunities. A CEO cannot rest on the status quo. Implicit in the bets the CEO makes is the organization’s appetite for risk. A winning strategy exploits to a significant extent the areas in which the company excels relative to its competitors. However, the execution of any strategy is governed by the willingness of the organization to accept risk in the pursuit of value creation, as well as by its capacity to bear that risk. From a strategy-setting standpoint, it is useful to have a notion of when the organization’s capacity for bearing risk is encroached upon (i.e., when is the organization taking on too much risk?). Consider the following questions:
- What is the desirable relationship between the capacity to bear risk and the appetite for taking risk?
- Does it make sense to take all of the risks an organization is capable of undertaking without reserving capital, borrowing capacity and other financial resources for unexpected extreme losses, investment opportunities and other contingencies?
- Is it appropriate to retain a significant risk when options for transferring that risk are available at reasonable cost?
- Are there certain aspects of the strategy that may be unrealistic and result in unacceptable risks if managers are stretched to achieve established performance goals?
A disciplined approach around protecting enterprise value should consider these questions. One lesson from the financial crisis is that there are consequences when a CEO “bets the farm” and ignores the warning signs posted by the risk management function. Washington Mutual is a prime example, as are Countrywide Financial, Lehman Brothers and Bear Stearns. The risk appetite statement outlines the organization’s accepted risks inherent in the strategy, risks to avoid in executing the strategy, and targeted strategic, financial and operational risk parameters. It facilitates the necessary discipline if it (1) serves as a guidepost when new market opportunities or significant risks emerge and (2) is driven down into the organization in the form of risk tolerances and limit structures to influence risk-taking behavior. In this context, risk appetite and the related risk tolerances and limit structures are useful tools for a CEO to use when communicating with the board and operating and functional units and, ultimately, with the investor community.
Risk tolerances are acceptable levels of variation around specified performance targets to help focus attention during periodic operations reviews. For example, they represent the acceptable level of variation from such targets as: quality, time, cost and innovation; customer satisfaction; employee satisfaction; strategic supplier performance; customer-service levels; and operational thresholds for key controls.
Limit structures are like brakes on a car; activities should be reduced or stopped, and objectives revisited when limits are approached or exceeded. They include spending pool limits, specific approved products, lending underwriting standards, derivative counterparty credit and rating limits and credit concentration limits. When limits are approached or exceeded, it is time to step back and revisit the strategy and objectives.
As clearly demonstrated in the Washington Mutual example, tension is inevitable between value creation and protection. For example, how does an organization balance its credit policy and commitment to sound underwriting standards with its sales strategy? There have to be some limits somewhere. A CEO who operates without any boundaries may be signaling to the board that he or she is unfocused strategically. Worse, such behavior may connote that he or she is locked into the status quo and driving the existing business model relentlessly, even if it takes the organization into the ditch as the market shifts. In the financial crisis, underwriting standards were thrown to the winds. Low-doc and no-doc loans in which the lender didn’t require proof of income became commonplace at Washington Mutual and other troubled banks.
Boundaries provide a broad context for balancing the organization’s objectives and performance goals for creating enterprise value with the policies, processes and control systems deemed appropriate to preserve enterprise value. In essence, they are a tool for managing healthy tension between the two. They stimulate appropriate dialogue, escalation and even arbitration when circumstances dictate.
The objective is to balance the entrepreneurial activities and control activities of the organization so that neither one is too disproportionately strong relative to the other. This task is fundamental to managing risk culture.
For independent risk management, compliance functions and internal control processes to perform effectively when crucial decision-making moments or changing circumstances arise, directors and executive management must be committed to enabling them to work. Aligning governance, risk management and internal control processes toward striking the appropriate balance is crucial. The objective is to balance the entrepreneurial activities and control activities of the organization so that neither one is too disproportionately strong relative to the other. This task is fundamental to managing risk culture. As one author explains, rather than tell the CEO what to do or how to run the business, the board provides direction as to what not to do through “a constructive ring fence around behavior.”
Focus the Board’s Risk Oversight on the Critical Enterprise and Emerging Risks
As the board of directors engages executive management through its risk oversight process, the question arises as to whether there is a simple “risk language” the board should adopt to focus its dialogue properly and ensure the bases are covered. To this end, we like the five broad risk categories recommended by the National Association of Corporate Directors (NACD). They are (a) governance risks, (b) critical enterprise risks, (c) board-approval risks, (d) business management risks and (e) emerging risks. These categories are sufficiently generic to apply to every company, regardless of its industry, organizational strategy and unique risks. More importantly, they provide a context for boards and management to understand the scope of the board’s risk oversight process, as well as a framework for delineating the board’s risk oversight responsibilities and management’s responsibilities for identifying, evaluating, managing and monitoring risk.
Governance risks are exclusively within the board’s domain as they deal with board composition and structure, director and CEO selection, CEO compensation and succession, and other important matters critical to the enterprise’s success. Board-approval risks necessitate that the board and executive management remain on the same page as to what decisions and activities require board approval and when. With respect to business management risks, they are the normal, ongoing day-to-day operational, financial and compliance risks embedded within the organization’s operations. Because the board simply does not have sufficient time to consider every risk individually, it should identify business risk categories that pose threats warranting attention and determine whether to oversee each category at the board level or delegate oversight responsibility to an appropriate committee.
That leaves the critical enterprise risks and emerging risks. These risks should command the lion’s share of the board’s risk oversight agenda. These are the risks with which the CEO and executive team should be most concerned. To that end, the board should satisfy itself that management has in place effective processes that (1) identify the organization’s critical enterprise risks and evaluate how they are managed so that the board’s risk oversight is properly focused and informed, and (2) identify and communicate emerging risks on a timely basis. Such processes enable management and the board to be proactive on the risks that matter.
The above risk categories provide a useful context for boards and executive management to ensure the scope of the risk oversight process is sufficiently comprehensive and appropriately focused.
The Rearview Mirror Doesn’t Help Much When You’re Going Forward
Strategy-setting and risk management share a common focus: They are both forward-looking activities. Time devoted to monitoring retrospective performance indicators (so-called “lag indicators”) is useful and appropriate when managing performance, but is of limited value looking forward. Organizations should ensure that sufficient time is devoted to:
- Evaluating how the business environment is changing or is likely to change, and how such change is affecting or is likely to affect the assumptions underlying the strategy and annual business plan;
- Using scenario analysis and stress testing to test the robustness of the business model against multiple views of the future to determine whether contingency plans or exit strategies are needed;
- Implementing robust risk assessment processes to identify the uncertainties about which management and directors are most concerned, identify sources of relevant intelligence to obtain information about those uncertainties, and track strategically aligned trending metrics over time;
- Preparing a response plan to address plausible and extreme crisis situations and significant emerging risk scenarios;
- Providing risk-based input into the determination of key metrics and targets to increase the mix of “lead indicators” relative to “lag indicators”; and
- Identifying signs the strategy is on its last legs.
The above activities pick up on several of the earlier lessons, and would help position the organization as an early mover. They are highlighted here to emphasize perhaps the most important lesson of all, which is to ensure risk management is strategically aligned by looking forward rather than backward. Monitoring forward-looking trending metrics over time, gathering focused intelligence, and mining the appropriate external and internal information enable the organization to deliver sharper, high-value insights into the uncertainties and critical risks inherent in the strategy. With the proper performance and risk metrics in the hands of decision-makers, it becomes possible to act on information more expeditiously once events occur. The key is to undertake an integrated approach and discipline to deploy the strategy while also managing the associated risks of a changing business environment.
Every organization and industry is different, so there is no one-size-fits-all approach in terms of applying the above 10 lessons for integrating risk with strategy. However, these 10 lessons provide insights to executive management responsible for an organization’s strategic thinking and execution processes and to directors when providing strategic and risk oversight.