Not every risk is a strategic risk
Strategic risk management remains a risk discipline subject to broad interpretation across industries and not least within the risk management profession. For some risk management professionals, any risk within a business could be presented as a strategic risk. For others, strategic risks are more intricately linked to the design, execution, monitoring and governance of the business strategy and plan. And whilst there is a degree of truth in both viewpoints, strategic risks are risks that arise from the fundamental decisions taken by management and board members concerning a firm’s strategic objectives and plans. Taken in this context, risks such as the temporary loss of a customer-facing application or the misconduct of an employee in an outsourced service provider, whilst seemingly important risks to be addressed, would not likely result in a change in the business strategy or plan. They would not otherwise be considered “strategic risks”.
Strategic risk can be defined as the risk of loss resulting from inadequate or failed processes to identify, quantify, mitigate, and govern risks and interdependencies that affect, or are inherent in, the firm’s business strategy, strategic objectives, initiatives, or investments.
Strategic risks become visible during times of crisis (whether unforeseen or not) and can often become a crisis in themselves. This is demonstrated in the case of BP and Shell, who have announced the divestment of financial investments with Russian state-backed firms following Russia’s invasion of Ukraine. The severity of Russia’s actions has resulted in widespread condemnation and target sanctions of Russian firms and the wider economy, making these financial investments untenable against escalating political, social, and financial unrest. Make no mistake, BP and Shell are not alone in having to respond to strategic risks caused by war between Russia and Ukraine.
Notwithstanding, given the gradual escalation of geopolitical tensions since Russia’s annexation of Crimea in 2014, combined with a potential devaluation of assets caused by the decision to divest strategic assets during a time of crisis, questions will be asked whether the boards of BP and Shell should have challenged management to dispose of their exposure to Russian state-backed investments earlier.
From one crisis to another
We live in an environment where crises can manifest rapidly and the time gap between crisis events is vastly declining. As the effects of Russia’s invasion of Ukraine become apparent, many firms are simultaneously managing other crisis events, such as prolonged material supply chain shortages impacting electronic goods industries, and steep rises in inflation leading to sustained above-target inflation that has sparked a cost-of-living crisis across the US and Western Europe.
As management and board members pivot from one crisis to another, the business case and rationale for improved identification, management, mitigation, and governance of strategic risks becomes evermore apparent. The future strength of strategic risk management will be demonstrated, in part, by whether firms make pre-emptive decisions to address risks to the business strategy and objectives before getting pulled into a strategic change as a consequence of a crisis event, regardless of whether the crisis event is in their control or not.
In a separate blog entitled “Gambling in the boardroom”, I discussed how a recent and persistent pattern of corporate failures has underscored the growing importance of boards scrutinizing the management of risks against the pursuit of profits, including the question: Is the composition of the board equipped with sufficient subject matter knowledge to properly challenge management actions in order to mitigate risks to the delivery of the business strategy?
The high-profile, high-impact nature of strategic risks can often lead to scrutiny by investors, customers, and regulatory agencies into the effectiveness and competency of management and board members. This scrutiny can be far-reaching and publicly expose management and board members to penalties and reputational harm. It is in the best interests of management and board members to take a more proactive, continuous, and data-driven analysis of strategic risks to promote the preparedness and ability to anticipate, prevent, respond to, and recover from materialised strategic risks.
Take it step by step
Strategic risk management relies on a deep understanding of the business strategy and plan and utilises the assessment of risks across the risk taxonomy to form an understanding of key risks to the successful delivery of strategic objectives, underlying initiatives, and investments. Strategic risk management should be designed to fit in sophistication and proportionality to the culture, maturity, and expectations of each individual firm.
- Understand the business strategy and plan
Establish a deep understanding of the business strategy and objectives of the firm, including objectives of key investments and initiatives underpinning the strategy. This step is critical as it sets the basis for prioritising strategic risks. It also sets the basis for integrating risk management into executive and board governance.
- Undertake a risk assessment against risks within your firm’s risk taxonomy
Assess the impact, likelihood, and speed of onset of risks within your firm’s risk taxonomy against each strategic objective. The speed of onset is an important consideration as some risks can manifest more quickly than others, such as the risk of financial exposures caused by sudden changes in market fundamentals (as in the case of BP and Shell). This step in the process relies on a well-articulated risk taxonomy with consideration of both internal and external risks, including emerging risks which may not yet be fully incorporated into your firm’s risk taxonomy. A common pitfall is to forget to identify interdependencies between strategic objectives, investments, and initiatives. Attempt to avoid this pitfall by constructing a simple representation of interdependencies between strategic objectives, initiatives, and investments. Such representations will highlight concentration risks and promote transparency of consequential effects of materialised risks. It is often helpful to conduct interviews and surveys to gather perspectives from key individuals such as key executives, directors, investors, and supervisory personnel.
- Conduct an analysis of key risks
Evaluate current risk management reports, audit reports, and other available intelligence sources (e.g., external reporting repositories) to assess the balance and effectiveness of controls in mitigating risks relative to the impact each risk could have in the delivery of ach strategic objective, initiative, and investment. For more mature firms, the assessment of strategic risks may already be undertaken during the business case analysis of strategic investments and therefore provide valuable insights to direct the analysis of residual risks.
To the extent possible, it is encouraged to review the maturity and effectiveness of current risk management disciplines whilst undertaking this activity.
- Evaluate risk appetite and tolerances
Prepare a strategic risk profile that establishes the relationships between risks and strategic objectives, investments, and initiatives. Highlight the interdependencies between investments and initiatives to showcase concentration risks. At this juncture, management should review the firm’s risk appetite framework to determine whether the current or stated level of risk appetite or tolerances could expose the firm, or its stakeholders, to strategic harm. Any such determination should consider how changes in the internal and external operating environment has evolved since the risk appetite framework was previously approved. In this context and given the outcomes of the strategic risk analysis, it might be necessary to propose changes in the risk appetite framework to protect the strategic and continuing viability of the firm.
- Develop a strategic risk action plan
The real effectiveness of any strategic risk assessment is in the strength of management actions and ongoing risk monitoring to protect the delivery of strategic objectives within the stated commercial, financial, operational, and reputational parameters. Executive management and the board should understand actions required to mitigate strategic risks relative to the outcomes of the strategic risk analysis and the firm’s risk appetite framework (including any proposed revisions as mentioned in the previous paragraph). Management actions should be designed around the determination of whether to prevent, detect or correct the materialisation of each risk.
- Engage the board in open discussion
Encourage open and candid discussion with the board on the outcomes of the strategic risk assessment. This discussion should ideally happen during the construction of the business strategy and plan, with expectations established for the ongoing monitoring and reporting of risks embedded into strategy setting and performance measurement. The board should ensure expectations are set for the ongoing reporting of management’s risk-taking in pursuit of delivering strategic objectives.
Fail to plan, plan to fail
For BP and Shell (and other firms who decide to exit Russian interests in the months ahead), the implications of their strategic decision to divest holdings in Russian backed energy firms during a time of war will become clearer in the coming quarters. Material financial losses or retaliatory measures will raise questions as to whether management or the board failed to pre-emptively address this strategic risk with the foresight of war becoming increasingly apparent in the months before conflict arose.
As we adjust to living in an environment defined by going from one crisis to another, establishing strong practices of strategic risk management, will enhance management and board members preparedness to anticipate, prevent, respond to, and recover from strategic implications caused by the next crisis.
