What's "strategic risks" and how to effectively manage?
What's strategy risks and how to effectively manage?
This session is intended to discuss about another risk which called "Strategic risks".
I. The definition and specific characteristics of "Strategic risks"
Strategic risks can be defined as the uncertainties and untapped opportunities embedded in your strategic intent and how well they are executed. As such, they are key matters for the board and impinge on the whole business, rather than just an isolated unit. A company voluntarily accepts some risk in order to generate superior returns from its strategy. A bank assumes credit risk, for example, when it lends money, many companies take on risks through their research and development activities.
Strategic risk management is your organisation’s response to these uncertainties and opportunities. It involves a clear understanding of corporate strategy, the risks in adopting it and the risks in executing it. These risks may be triggered from inside or outside your organisation. Once they are understood, you can develop effective, integrated, strategic risk mitigation.
II. Strategic risk managements: How to manage strategic risks effectively?
In fact, strategic risks cannot be managed through a rules-based control model. Instead, you need a risk-management system designed to reduce the probability that the assumed risks actually materialize and to improve the company’s ability to manage or contain the risk events should they occur. Such a system would not stop companies from undertaking risky ventures; to the contrary, it would enable companies to take on higher-risk, higher-reward ventures than could competitors with less effective risk management.
Take for example, one of the large companies, BP accepted the high risks of drilling several miles below the surface of the Gulf of Mexico because of the high value of the oil and gas it hoped to extract. Strategic risks are quite different from preventable risks because they are not inherently undesirable. A strategy with high expected returns generally requires the company to take on significant risks, and managing those risks is a key driver in capturing the potential gains.
Far from holding back the business, strategic risk management is about augmenting strategic management and getting the full value from your strategy. In a typical instance, a conventional approach to setting and executing strategy might look at sales growth and service delivery. Rarely does it monitor the risks of a shortfall in demand.
Effective strategic risk management can be built around a clear understanding of how much risk your business is prepared to take to deliver its objectives, and a timely and reliable evaluation of how much risk it is actually taking.
Dr. Chao
12-February-2015
Ken Hackshaw
very interesting piece. Thanks for sharing
Edward Chao
Dear Ken Hackshaw,
Welcome to join discussion.
Kind regards.
edward
Mohammed .
Nice thoughts; Thanks Dr. Chao
Trevor Lilley
I think you need to take this further in that strategic risks may also need to be considered against the cumulative impact of a detrimental event occurring. For example black swan type effect as the impact must be considered against the widest impact and subsequent contagion activity.
Steven Kalavity
Strategic risk management of complex enterprises requires timely and high fidelity data and knowledge sharing to allow rapid fact-based decision making. For example, the uncooperative and poor communication culture(s) at Macando hindered critical information from being shared so that the right/best decisions could be made. The technology and control processes had been developed to prevent catastrophe. It was not a technology issue, but a communication and management issue. System and process management presents the greatest risk and needs to be strategically considered.
Edward Chao
Dear Steven Kalavity,
I agree with your comments 'Strategic risk management of complex enterprises requires timely and high fidelity data and knowledge sharing to allow rapid fact-based decision making.'
I'm very appreciated that you join discussion.
Kind regards.
Edward
Steven Kalavity
Thank you Edward. I appreciate your post.
Dominic Pelletier,PMP, MBA
Mr Chao
I really like your post! There is lots to gain from risk management at all level within the organization. Risk will help you understand if gain will happen in pursuing a business model for example, acquiring a new business or as you mentioned in BP case, drilling scenario. But risk management is as always, subjective to the organization risk tolerance and doing risk management at higher level of the business, as @Steven mentioned, takes time and experience, which in most organization, one or both is missing.
We do enterprise risk management but this is not nearly where it should be. But that is a starting point and hope we keep doing better in our organization
Thanks for your post
Edward Chao
Dear Dominic Pelletier,
According to my experiences, strategic risk management is your organisation’s response to these uncertainties and opportunities. It involves a clear understanding of corporate strategy, the risks in adopting it and the risks in executing it. These risks may be triggered from inside or outside your organisation.
As you have mentioned in your comments which said 'management is as always, subjective to the organization risk tolerance and doing risk management at higher level of the business. We do enterprise risk management but this is not nearly where it should be.'
Thanks for your comments and sharing in this discussion.
Kind regards.
Edward
Cliona O Hanrahan
Dear Dr Chao
First off thanks so much for the posting and great to read your thoughts of risk at this level.
All the best
Guan Seng Khoo, PhD
Strategic risk is 1/10th desire, and 9/10th implementation. Sometimes, a mediocre strategy well-executed may yield a far better result than a perfect one poorly done!
Edward Chao
Dear Cliona O'Hanrahan,
It's my pleasure to provide practical and risk-related issues in Risk Management Online, LinkedIn.
Hoping we can share the experiences and viewpoints with each other.
Nice to meet you in Risk Management Online
Kind regards.
Edward.
Edward Chao
Further Discussion on the issue 'What's "strategic risks" and how to effectively manage?'
Strategic risks can be defined as the uncertainties and untapped opportunities embedded in your strategic intent and how well they are executed.
In fact, different types of strategic risks in business may involve upstart competitors, new product failures, or new technology suddenly replacing existing technology in a marketplace. At various times, a sudden shift in consumer buying behavior may pose a serious strategic risk to manufacturers and retailers. Growth of a company’s sales base may also stagnate for a variety of reasons, and this might pose a challenge to a company’s continued profitability. As we know, one of the more common scenarios that can expose a company to strategic risks is the upstart competitor that experiences a mercurial rise in sales.
Taking for some examples as follows. A company may have experienced decades-long market dominance in selling a type of software. A competitor then comes along with an innovative software product that consumers prefer over the first company's product. The resulting market erosion experienced by the first company may force that firm to invest heavily in innovation, in an effort to stay competitive with the newer firm.In a typical instance, a conventional approach to setting and executing strategy might look at sales growth and service delivery. Rarely does it monitor the risks of a shortfall in demand.
'Strength of brand' may be a factor in how a company manages strategic risks. A company that has a strong brand among consumers is often better positioned to withstand intrusion from competition because it can continue to bring new products to the market that strategically make use of the brand’s reputation. If a company experiences a scandalous failure in a product launch that damages the brand’s reputation, for example, that type of strategic risk can affect its reputation for years.
Kind regrds.
Edward
26-March-2015
Edward Chao
Further Discussion on the issue 'What's "strategic risks" and how to effectively manage?'
Up to now, strategic risk has become a major focus in risk-control managements, about 81% of surveyed companies now explicitly managing strategic risk – rather than limiting their focus to traditional risk areas such as operational, financial and compliance risk. Also, many companies are taking a broad view of strategic risk that doesn’t just focus on challenges that might cause a particular strategy to fail, but on any major risks that could affect a company’s long-term positioning and performance.
Kind regards.
Edward
26-March-2015
Mokoena Portia
A very informative read Edward. I like your topic. Organisations normally have strategic objectives but one wonders sometimes if these were set with risk management in mind. It becomes a challenge when risk management comes as an after thaught.
Edward Chao
'How to manage strategic risks effectively' has been popularly discussed in finan-related industry for many years.
Under risk managements' researchers or institutions, strategic risks cannot be managed through a rules-based control model. Instead, you need a risk-management system designed to reduce the probability that the assumed risks actually materialize and to improve the company’s ability to manage or contain the risk events should they occur. Such a system would not stop companies from undertaking risky ventures; to the contrary, it would enable companies to take on higher-risk, higher-reward ventures than could competitors with less effective risk management.
In addition, 'strength of brand' may be a factor in how a company manages strategic risks. A company that has a strong brand among consumers is often better positioned to withstand intrusion from competition because it can continue to bring new products to the market that strategically make use of the brand’s reputation.
Edward
29-March-2015
Cliona O Hanrahan
Hi Edward mostly I would agree with your comments but we are facing a very fast based competitive environment where a lot of companies are not really assessing their risk in getting their products out. Actually I think and especially with digital projects where and if the business case is carefully outlined this does minimise risk in this area. Another really cool way of assessing risk at some level is through web analytics which can show what to be avoided going forward. I believe that yes in the very big and expensive infrastructure or legacy project risks must be assessed properly however in the small digital faced projects it really requires you as a project manager to run with the pack and get that product out the door. Where I do look at risk is during the UX process and I believe that this is a great way to position this exercise
Edward Chao
Hi, Cliona, thanks for your reply. I agree with your viewpoints concerning about assessing risks methods 'Another really cool way of assessing risk at some level is through web analytics which can show what to be avoided going forward and where you do look at risk is during the UX process'.
Strategic risk management of complex enterprises requires timely and high fidelity data and knowledge sharing to allow rapid fact-based decision making. In addition, strategic risks cannot be managed through a rules-based control model. Instead, you need a risk-management system designed to reduce the probability that the assumed risks actually materialize and to improve the company’s ability to manage or contain the risk events should they occur.
Thanks for your joining this issue's discussion.
Edward.
Didier Verstichel
One needs to be careful with the use and abuse of the words « Strategy / Strategic ». With a stretch of the mind, it is feasible to find a (minute) link between risk of whatever nature and the Strategy. It is a matter of risk taxonomy for which there is no standard. The BP case is a good example. As per their website “Operational risk is the potential for financial loss because of human, process or technology error.” Is a strategic risk a risk arising from the strategy execution or a risk affecting the strategy? In my use of the semantic, it is the latter, not the former. BP was hit by an operational risk. Take for instance an organisation which strategy is to expand its operations in the BRICA countries. Are those strategic risks or geo-political risks?
Edward Chao
Dear Didier Verstichel,
Very thankful for your comments.
You have mentioned 'that The BP case is a good example. As per their website “Operational risk is the potential for financial loss because of human, process or technology error.” Is a strategic risk a risk arising from the strategy execution or a risk affecting the strategy?'
In fact, risk management is as always, subjective to the organization risk tolerance and doing risk management at higher level of the business. Furthermore, strategic risk management is your organisation’s response to these uncertainties and opportunities. It involves a clear understanding of corporate strategy, the risks in adopting it and the risks in executing it. These risks may be triggered from inside or outside your organisation.
I'm very appreciated with your comments.
Thanks for joining this issue discussion.
Kind regards.
Edward
Steven Kalavity
Strategy is how to guide the processes of operations that deliver the product or services. So, in my mind strategy and operations are inextricably connected. Both center around planning and management of resources aimed at meeting predetermined objectives. The main distinguishing characteristic of businesses is risk tolerance. Businesses distinguish themselves by finding a niche or focus on a particular customer (potential) need. They then build the systems and processes to support these products or services to deliver that "need." The integrity and value creation of the data used to base decisions for marketing up to delivery of products and services is key to successful risk management. Again, I advocate a knowledge risk management framework as the best way to reduce enterprise risk in general applied to strategy and operations.
Edward Chao
Dear Steven,
I'm very appreciated with your comments.
I agree with what you have mentioned that "the main distinguishing characteristic of businesses is risk tolerance, in addition strategy and operations are inextricably connected. Businesses distinguish themselves by finding a niche or focus on a particular customer (potential) need."
In fact, how to create a considerate knowledge risk management framework seems to be important for the decision-makers to evaluate the "strategic risks" and/or "operational risks."
Thanks for your comments.
Kind regards.
Edward
Steven Kalavity
Operation processes must support the strategy. You cannot get to the moon with a lawnmower engine. But, you can get to the moon. The uncertainty - risk - is reduced when systems support the objective in real terms.
Cliona O Hanrahan
This is a great discussion and is helping as I am about to do my next SlideShare presentation on project risk so thanks one and all
Rod Farrar
Hi Edward,
Thanks for sharing the discussion, however, I have a more simplistic approach to defining strategic and operational risks:
I define a strategic risk as any event that is outside the control of the organisation that would cause the organisation to alter its strategic direction. Risks in this category relate to changes to Legislation; changes to the economy; changes to competition. It should be noted that these are not preventable and all we can do is prepare just in case it does occur.
Operational Risks, on the other hand, are those events that are within or outside of the control of the organisation that impact on the achievement of the strategies that have been set by the Board.
My observation has been that too many Boards focus on what are actually operational risks, sometimes at the expense of the organisation as they have not been strategically focussed. If the Board continues to look down they may miss the threats and opportunities that arise.
This has been a really good discussion.
Rod
Edward Chao
Dear Rod,
Nice to read your comments about this issue.
You have pointed out the differences between strategic and operational risks which could lead to understand the simplistic approach to definition.
Most of the practical conditions, I agree with that you have mentioned that 'operational Risks, on the other hand, are those events that are within or outside of the control of the organisation that impact on the achievement of the strategies that have been set by the Board.' For cost-and-benefit analysis, the Board sometimes ignore some uncertainty factors inside the risks, and many Boards just focus on what are actually operational risks.
Another concept you have mentioned is that strategic risk should be noted that these are not preventable and all we can do is prepare just in case it does occur. According to past experiences, the Board often made their decision via some suggestions or information came from the manager of risk management.
“When you are dealing with risks, Corporate Management should proactively focus on strategic and transversal risks and Business Units are responsible for managing the risks
they own,” says Elisabeth Pacaud, Associate Vice President, Group Risk Management at Sanofi.
In my opinion, a strategic risk is one that directly impacts the company’s identified strategic goals whether they are diversification, innovation, or emerging countries.
According to an professional research institution report said that two thirds (67%) of the surveyed companies say the CEO, board or board risk committee has oversight over strategic risk. In EMEA, CEO direction is much lower than average and board direction is higher. Top-level oversight is particularly common at consumer companies, followed by companies in financial services and TMT. “Each group company determines risks and takes measures to meet their business needs. Important matters – including the risk strategy of each group company – will be discussed and decided at Pola Orbis Holdings’ board meetings.”
Finally, I'm very appreciated with your comments and joining this discussion.
Kind regards.
Edward
Don Tibbits
Excellent discussion, thanks.
Edward posed the question: 'Is a strategic risk a risk arising from the strategy execution or a risk affecting the strategy?' @Rod: to be clear, under your model, would the former usually be defined as operational risk and only the latter as strategic risk? @Edward: in your opening you seem to imply the former.
I'm mindful that there will sometimes be a crossover and the answer won't always be clear-cut.
Rod Farrar
Hi Don,
Under my definition, the former is an operational risk and the latter is a strategic risk. There my be some crossover but when I see Boards capturing risks such as "death of a worker" or "non compliance against Legislation" I get very worried. To me, the Board should manage the risks that affect strategy and receive reports providing assurance that the operational risks are being managed effectively.
I have decided that this is an excellent discussion for my next eBook.
Edward Chao
Hi, Rod, As a matter of fact, most of the Board don't take much time in managing the risks that affect strategy, whereas, only receive reports providing assurance that the operational risks are being managed effectively and focus the overall performance.
Perhaps, you can focus this topic to declare your viewpoints via your next eBook.
Thanks for your comments.
Edward
Jay R. Taylor
I like to think of risk management in the context of building an automobile. We put brakes on the car not to stop us, but to allow us to go faster, more safely.
Edward Chao
Dear Jay,
Nice to read your comments about this issue.
You have pointed out the basic concepts of risk managements which could lead to understand the simplistic approach to definition. This example makes sense.
Edward.