Adding value with strategic risk

Businesses of all types and sizes are facing challenging times ahead. With so much uncertainty over future economic and political developments, business leaders are worried about how these macro challenges might impact their strategies.

One way to attain such an appreciation is through the strategic risk management process. It allows business leaders to identify, assess and proactively manage the future risks and uncertainties that are likely to affect their business strategies.

However, the strategic risk management process can be complex and often does not produce the intended results that a business was looking to achieve. 

In order to manage strategic risks successfully you need to have a good understanding of your business strategies in the first place. To fully understand them, you need to know the following attributes for each strategy that the business is aiming to achieve.

- Who is your target market?

- What is the current and future size of your target market?

- Who are your key competitors?

- What assumptions have been used to model consumer demand?

- What resources and capabilities – finance, people, system, suppliers etc - do you need to achieve those strategies?

- What changes in the business environment is likely to have the most impact on your strategies?

Knowing the above will help you understand your business strategies better and focus on the right risks at a strategic level.

Strategic risk management requires a structured approach. For it to be successful and add value, the process must be coordinated correctly. A coordinator will typically engage with key stakeholders such as CEO, COO, finance directors, HR directors, legal counsel, CTOs etc to document the potential risks and mitigation. They will also analyse and evaluate risks in light of the changing business environment and produce meaningful reports for management boards.

Define risk appetite 

At any given time there will be a number of risks affecting business strategies. It will not be possible or be a good use of resources to try to manage all of them at the same time. Some risks will be more important than others simply because of the damage it can cause or due to their high likelihood of happening.

Therefore, business leaders must define criteria for prioritising risks – such as potential regulatory fines, financial damages and reputational loss – and the level of exposure that the company can withstand. A clearly defined risk criteria and appetite will ensure consistency in the risk management and reporting process.

The next step is to identify strategic risks. Within the context of strategic risk management, risks are defined as an effect of uncertainty on your business strategies. A risk coordinator may organise risk identification workshops, or have one to one interviews with executives and directors, and other key stakeholders. Care must be taken to ensure all key risks have been identified at this stage.

Risk analysis involves analysing the causes and consequences of the risks. The main objective here is to understand the effects of risks individually and collectively on the business strategies, and prioritise them. Risk analysis can be quantitative and qualitative. However a combination of these measures works best.

Risk mitigation involves identifying a range of cost effective measures and implementing them to manage risks. You can mitigate risks by either treating, tolerating, transferring or terminating them. However, taking a combination of these approaches often is the best way to manage risks.

Review and monitor

Depending on how significant the risks are to the achievement of the business strategies, some risks need to be monitored more frequently. Using a range of forward looking key risk indicators, you can gauge the risk trends and adjust your risk profile accordingly. Strategic risk management is a dynamic process and thus need to be continually evaluated against the key developments in the internal and external business environment.

On a regular basis, key risks need to be reported for awareness, discussion and action. These reports need to be simple with graphs, charts and table for better visualisation and appreciation. A detailed risk report should only be produced only when there is a need for them.

As businesses emerge from the lockdown and move in to the new world of many unknown unknowns, strategic risk management is critical for surviving and thriving in the long term.

To ensure the strategic risk management process adds real value and supports the board to make proactive decisions concerning the business strategies, it must be structured, coordinated by someone who is knowledgeable, and begin with a solid understanding of the business strategies.

Laxman Maharjan is a director at ERM PLUS