Identifying Emerging Risks: A Long-Term Perspective
The business environment continues to change – and with it, the landscape of opportunities and risks that companies face. Part of the challenge when assessing this landscape is looking out far enough. Is your organization thinking sufficiently long term?
Time horizon means many things. For our purposes, it is the estimated length of time needed to accomplish the goals outlined in a strategic plan, business plan, project plan or program. Often, time horizon is referred to as the “planning horizon” because it offers the discipline of a point of time in the future by which a plan should be executed and, therefore, facilitates accountability for achieving expected goals.
Because time horizon is so interrelated with goal realization, it is an important variable to clarify in a risk assessment exercise when engaging people with multiple perspectives, reflecting different views on what the time horizon might be due to their respective responsibilities. Our question is whether the risk assessment process uses a time or planning horizon that looks out far enough.
In a risk assessment, there are several attributes of time horizon worth considering:
- The longer the horizon, the more likely a stated event can occur. The shorter the horizon, the less likely the stated event is to occur. Exposure to severe weather is an illustration: the longer the time horizon, the higher the possibility of exposure.
- The longer the time horizon, the more flexibility an organization has in responding to the unexpected. For example, if a competitor adopts predatory pricing tactics over the short term, there is little time to react. However, over the long term, this is an issue the organization can realistically expect to manage.
- By their nature, strategic risks have a longer time horizon than other risks. These risks represent exposure to one or more future events invalidating fundamental assumptions underlying the business strategy. They also present the potential for the strategy and business model to fall out of alignment with management’s long-term outlook. By contrast, operational and financial risks typically have a shorter time horizon given the focus on quarterly performance and the achievement of annual business plans and budgets. And compliance risks, since they reflect ongoing day-to-day activities, likely have the shortest time horizon.
When you really look out longer term, what do you see? Earlier this year, the World Economic Forum (WEF) attempted to answer this question when it published its annual update on global risks.1 For the tenth straight year, this study views risk across five categories: economic, environmental, geopolitical, technological and societal. It defines global risk as “an uncertain event or condition that, if it occurs, can cause significant negative impact for several countries or industries within the next 10 years.” Among its findings:
- The risks of highest concern over the next decade suggest that our lives will be intensely shaped by transformative forces that are already under way. Covering all five categories, the risks include water crises; interstate conflict with regional consequences; failure of climate change adaptation; high structural unemployment or underemployment; large-scale cyberattacks; asset bubble in a major economy; large-scale terrorist attacks; fiscal crises in key economies; profound social instability; food crises; failure of national governance; extreme weather events; and state collapse or crisis.
- Megatrends are driving global risks over the next 10 years. WEF defines a trend as “a long-term pattern that is currently taking place and that could contribute to amplifying global risks and/or altering the relationship between them.” The report highlighted 13 trends: aging population; climate change; environmental degradation (quality of air, soil and water); growing middle class in emerging economies; increasing national sentiment; increasing polarization of societies; rise of chronic diseases; rise of hyper-connectivity (connecting people and things); rising geographic mobility (of people and things); rising income disparity; shifts in power (from state to non-state actors, from global to regional levels, and from developed to emerging market and developing economies); urbanization; and weakening of international governance. The report illustrates the inter-connectivity of these trends with the top global risks.
- There are regional distinctions over the long term with respect to the top three risks for which regions are least prepared. For example, in North America, failure of critical infrastructure, cyberattacks and failure of climate change adaptation are the top three risks. In Europe, unemployment or underemployment, large-scale involuntary migration and profound social instability are the most significant risks. In the Middle East and North Africa, the top risks are water crises, profound social instability and interstate conflict. In East Asia and the Pacific, they are interstate conflict, failure of urban planning and man-made environmental catastrophes. In Latin America and the Caribbean, the top risks are profound social instability, failure of urban planning and failure of national governance. Sub-Saharan Africa faces unemployment or underemployment, food crises and spread of infectious diseases. The point is that risk profiles vary by region.
- The report provides a number of interesting headlines. To illustrate:
- Fragile economies are under pressure due to rising socioeconomic inequality, structural unemployment and climate change.
- There are growing worries about conflict due to a rise in national sentiment, increased geopolitical risks and failure of national governance.
- The global economy is returning to growth, although sluggishly, while facing falling inflation, the risk of deflation, increased exposure to asset bubbles due to low interest rates, and the risks of a failure of a major financial institution and fiscal crises.
- There is high concern, but little progress, with respect to environmental issues, particularly regarding water crises and failure of climate change adaptation, leading to the potential for large-scale involuntary migration.
- There is risk of large-scale cyberattacks on the technological front, with the rise in hyper-connectivity of people and things.
While the WEF’s global risks may not have an immediate impact, they are nonetheless important considerations over the longer term. Companies and their boards should be thinking about the implications of longer-term trends that reach beyond the time or planning horizons considered by management during the strategy-setting and risk assessment processes.
The board should expect management to consider emerging risks periodically. Management should be thinking about the “known unknowns” and the “unknown unknowns” of the future. We often do not see enough of these risks, or their correlated risks, in company risk assessments because the time horizon addressed by most risk assessments does not extend out nearly as far as the WEF update. This is largely due to factors such as the rapid pace of change, short-term incentives, declining tenures for chief executive officers and fixation of investors on quarterly earnings. In fact, one study notes that 65 percent of companies have a strategy-planning horizon of four years or less while only 7 percent have a horizon of greater than six years.2
More important, the same study noted that the longer the strategic horizon, the higher the long-term total shareholder returns. Thus, a dilemma arises: While the uncertainty in viewing a longer planning horizon presents a challenge and the short-term is more predictable, failure to think sufficiently long term can erode competitive position over time. Needless to say, that’s not a good answer.3
One clear sign of short-term thinking occurs when a company’s risk assessments shuffle “known knowns” around on a risk or heat map, year after year, leaving executives and directors wondering about the value of the process. Effective risk management requires understanding more about what we don’t know, including understanding emerging risks, than what we do know. Does it make sense for a risk assessment to look out even longer than the planning horizon, effectively decoupling the risk assessment horizon from the planning horizon?
The WEF study illustrates important considerations relevant to the longer term. Companies and their boards should be thinking about the implications to the company’s strategy and business model of longer-term trends that reach beyond the longest time horizon considered by their strategy-setting and risk assessment processes. For example:
- Focus on the “game-changing” risks – Risks such as a pandemic (an epidemic of infectious disease), large-scale cyberattacks and issues in specific regions where significant investments have been made may be relevant to the company’s business model over the long term, requiring attention sooner rather than later. Make sure your worst-case scenarios are extreme enough by including these risk considerations.
- Pay attention to strategic uncertainties – These uncertainties arise when the critical assumptions underlying the strategy are becoming, or have become, invalid, and management and the board don’t know it. The WEF study points to a number of potentially lethal risks that could affect a company’s assumptions over its planning horizon. Management should consider these risks when formulating strategic assumptions for global and regional markets. They should focus broadly on actions competitors may take, how customer preferences could change, the threat of substitute products, or the implications of losing a major supplier, channel partner, customer or other vital component of the value chain, including transportation and logistics.
- Watch for emerging opportunities, as well as threats – While our focus is on timely identification of emerging risks, disruptive change also presents potential opportunities.
- Use scenario analysis to evaluate the effect of alternative views of the future – Factor the WEF global risks into scenario-planning and stress-testing routines to enable management to challenge assumptions and expectations, address “what if” questions, and identify sensitive external environment factors that should be monitored for change over time so management can focus its intelligence-gathering. By deepening their understanding of the pain of the unexpected, management can identify when contingency plans are required and reinforce the need for flexibility, and even exit plans, in executing the strategy.
Questions for Boards
Following are some suggested questions that boards of directors may consider, based on the risks inherent in the entity’s operations:
- Is the board satisfied that management is looking out far enough when formulating long-term strategies? If not, is the board satisfied that the strategy-setting process is not rooted in short-term thinking?
- During the risk assessment process, is management considering longer-term global risks that are germane to the organization’s strategy, business model and geographic footprint, even though the risks may not manifest themselves over an annual period or even a planning horizon of three to five years?
- Does the organization consider the interrelationships among risks to identify risk themes germane to the company when formulating business plans?
- Is the board apprised in a timely manner of significant changes in the enterprise’s risk profile? Is there a process for identifying emerging risks, including potential “black swan” events? Does the exercise result in appropriate response plans on a timely basis?
How Protiviti Can Help
Protiviti assists boards and executive management with assessing the enterprise’s risks and the capabilities for managing those risks. We help organizations identify and prioritize their risks, including emerging risks that can impair their reputation, brand image and enterprise value.
Board Perspectives: Risk Oversight (Issue 70)