Assessing Risk: A Strategic Perspective

Protiviti Board Perspectives
Assessing Risk: A Strategic Perspective

Strategic risks are risks that (a) the business model is not effectively aligned with the strategy or (b) one or more strategic assumptions lag behind industry realities and the strategy does not reflect the new conditions. Arising from internal process issues and disruptive change in the external business environment, these risks can be lethal because they may not be known to management and the board.

Key Considerations

Analyzing strategic risks1 isn’t easy. Because these risks are not susceptible to precise measurement as operational risks are, the analytical framework applied to them must be more qualitative in nature.

Because an effective strategy is about pursuing the best bets in the context of the enterprise’s desired risk/reward balance, strategic risks are often “compensated” risks, as the potential for upside is sufficient to warrant accepting the downside exposure. For example, the risks associated with initiating operations in new markets, introducing new products or undertaking large research and development projects are “compensated” risks because the act of taking them is inseparable from executing the enterprise’s strategy. By contrast, “uncompensated” risks are one-sided because they offer the potential for downside with little or no upside potential. Our experience is that many managers often bring a “controls mindset” to assessing risk because they think of risk as uncompensated. This mindset does not work when assessing strategic risks because those risks are more about what we don’t know.

Strategic risk analysis assists senior management with understanding the critical assumptions underlying the strategy and using contrarian analysis to challenge those assumptions. The approach works as follows:

Begin by defining your strategic assumptions. These assumptions are management’s “view of the world” during the strategic planning horizon (e.g., enterprise capabilities, competitor capabilities, customer preferences, technological trends, capital availability and economic trends, among other things).

Develop a corresponding contrarian statement for each of the most critical assumptions. These statements negate the strategic assumptions by specifying what might happen to invalidate the assumptions and how much it would hurt. For example, the Japanese utility operating the Fukushima nuclear power plant assumed a worst-case scenario of an earthquake causing a tsunami of more than 20 feet as extremely low risk. A contrarian statement might have asserted a 40+ foot tsunami would hit the plant, which was a plausible 1,000-year event based on geological studies. Once contrarian statements are defined, management should select those with the greatest impact on the company if they were to transpire (i.e., the statements management needs to examine more closely because they would cause the most damage).

Identify and analyze the plausible and not-soplausible scenarios that could make the highest-impact contrarian statements happen. The contrarian statements with highest impact reflect situations that would likely arise from events about which the organization currently lacks sufficient information and that management would likely rationalize after the fact and wonder: “Why didn’t we see it coming?” In instances requiring additional analysis, management should identify other scenarios involving an improbable event or combination of events that could occur in the future and make the contrarian statement a reality. The final list of scenarios should be a workable number that is evaluated using such attributes as impact, persistence, velocity and response readiness. To get to a manageable list, it may be necessary to consider relationships and similarities among multiple scenarios to narrow them down to the vital few.

Articulate the implications of high-impact contrarian statements. This step is the payoff. In effect, implication statements address two questions: “What do we do if the critical assumption underlying our strategy is no longer valid?” and “How would we know if our assumption is no longer valid?” For the scenarios with the greatest impact on the organization, it is useful to identify the drivers evidencing that the scenarios are developing or have occurred. Management then decides on (a) the appropriate key risk indicators, trending metrics and other information to be incorporated into the scope of the competitive intelligence function with the intent of creating an early warning system and (b) the appropriate response plans needed to increase the company’s response readiness for scenarios with a high velocity.

While we can never say with certainty that we know what we don’t know, we can apply techniques that assist knowledgeable managers in thinking strategically and challenging assumptions constructively in a safe environment without fear of reprisals. The contrarian analysis process develops new ideas that can help make the corporate strategy more robust.

Questions for Boards

Following are some suggested questions that boards of directors may consider, in the context of the nature of the entity’s risks inherent in its operations:

  • Is there a common understanding between management and the board as to the critical assumptions underlying the enterprise’s strategy?
  • Is there a process for challenging the underlying strategic assumptions?
  • Are key factors that provide insight regarding the continued validity of the key underlying assumptions monitored over time?

How Protiviti Can Help

Protiviti assists directors in public and private companies to identify and manage the organization’s key risks.
We provide an experienced, unbiased perspective on issues separate from those of company insiders and an analytical assessment that is aligned with the unique characteristics of the risks the company faces, including its strategic risks.

1The first of the Protiviti Early Mover Series, “Analyzing Strategic Risks,” available at, discusses this topic further and includes several illustrative examples that space constraints do not permit us to include here.

Board Perspectives: Risk Oversight (Issue 30)

Click here to access all series

Ready to work with us?