3 levels of strategic risks

Can modelling help you meet your strategic aspirations? Hans Læssøe, former senior director, strategic risk management, founder of Aktus and a member of Risk Leadership Network’s advisory board, places this question under the microscope

The concept of strategic risks has been given a lot of attention. For one, the concept and word ‘strategic’ is possibly the hottest and sexiest word in business, so everyone wants to go there. On top of that, the term is opaque – it can encompass almost anything. Finally, strategy is the work of executives, and we all want to become executives, don’t we?

The below are my two cents on the topic of strategic risks.

First – defining strategy: “A strategy is a set of actions taken to meet an objective/aspiration within a defined timeframe”.

Hence, the strategy is what we do, not why we do it.

For the strategy to be relevant, it must be a valid choice which means that someone may validly choose to do something different, for example, ‘pursuing growth through market expansion’ is a valid strategy as others may validly opt to grow through acquisitions or other means. On the other hand, being competitive is hardly a strategy as no-one would really opt “not to be competitive”.

Now let’s attempt to define ‘strategic risks’. Some would say, “Strategic risks are those risks (good or bad) which affect strategic choices and/or the implementation of these”.

This definition includes internal (re)prioritisation as well as changes in business circumstances, which enforce changes to company strategies. However, as these may present themselves in many ways and forms throughout the strategic horizon, these externally imposed risks are seen as just risks to the company in line with any other.

Based on the above, I see three levels of strategic risks, which can be described in terms of three questions:

1. Are we sure our strategic aspiration is relevant by the end of our strategic horizon?
2. Will our strategy ensure we meet our aspiration?
3. Will we, when reality hits us, deploy our strategy as planned?

These 3 types of risks differ in nature, complexity and means of control/risk management and are hence seen as three levels.

Let us start at the bottom and work our way up.

Deployment/execution risks

Deploying a strategy generally elicits a series of projects to implement. If the strategy is expanding into new markets, one project could be to define logistic and delivery systems to these new markets. Another to set-up sales entities, a third to build any needed local organisation, and a fourth to adjust product offerings to meet local needs and legislation.

To be blunt, these projects are just that – projects. As such, they are optimally risk managed as projects within the organisation. The only strategic element of these projects is their anchoring to the strategy and hence their presumably higher priority.

This means, all else equal, that these projects have a smaller risk of being under-funded or not provided with the needed resources. However, it also often means that the number and level of uncertainty is somewhat bigger than that of more operational (known) projects.

Bottom line – strategic projects can be risk managed as projects using the proficient and tested project management processes already (I hope) used by the company.

Given that, I now boldly assume that each defined project will deliver on the targets defined for that project.

Tactical implementation risks

As stated, deploying a strategy invokes a number of projects more or less in parallel. With good project risk management, we have already ensured that each of these will be successful. The question now is, is this enough to meet our strategic aspiration?

By way of example, the aspiration may be to grow sales by 10% annually for the next 5 years. 

The risk question here is, will these initiatives be enough to deliver a 10% annual growth – we may be part of a stagnant or even declining market?

To risk-manage this level, we leverage portfolio risk management methodologies by consolidating the risk exposure management of all the embedded projects as well as any cross-project risks and opportunities.

To be effective we must know which impact each project has on the overall performance. That is, we must link each project to the meeting of the overall aspiration, in this case the 10% annual growth.

The practical risk management of that is based on a Monte Carlo simulation model where the outcome range of each project is built in to an adequate level of detail and accuracy. Key cross-project risks (good or bad) are added and the model is simulated to find the likelihood of being able to deliver the 10% annual growth – year on year as well as overall, i.e. leading to a 61% growth in the 5^th year as compared to the baseline year.

The Monte Carlo simulation software, whichever you wish to use, will also deliver a ‘tornado’ diagram showing which risks affect the achievement of the target the most, and hence where to direct any further attention if/when you are not satisfied with the likelihood of meeting your aspiration as it is. 

You may wish to design your risk management efforts to deliver a 75% likelihood of meeting or exceeding your target. Bear in mind, that if you are/can be 99% certain to deliver your target – you are probably not ambitious enough. To quote racing icon Mario Andretti “If everything is under control, you are moving too slow”.

Largely, this level of risk management is portfolio risk management as seen in astute companies.

Strategic aspiration risks

Many companies state their strategic aspirations as ‘images’ rather than numbers. Hence the aforementioned 10% annual growth is a rarely stated strategic aspiration as it does not drive enthusiasm and energy in the organisation – which is one strong value of strategic thinking.

Instead statements are used – statements that are high and ambitious, but also inherently desirable results are used to communicate strategic aspirations.

“We want to be the world’s best supplier of X by 2025” or “We want to have a positive impact on X amount of people’s lives by 2025”.

The risk management question in a rapidly changing world is, do we really want this by the end of our current strategic horizon?.

One example could be, “We want to be the world’s foremost supplier of spark-plugs by 2025”.

Great aspiration, except that there is a severe risk that the market for spark plugs in 2025 is all but non-existing, as the combination of technical development and environmental legislation has made fully electric cars the only way to drive.

Just imagine today, you are the world #1 supplier of DVD players – and you have spent a decade of hard work to get there. Now take a look at home, when was the last time you saw a DVD or ask your children if they know what ‘DVD’ means?

Risk managing this is all about looking far enough into the future. Here, the notion of likelihood, impact distributions and Monte Carlo simulation will not help you, nor will add-on mitigation actions to any proposed strategy.

What you need to sufficiently risk-manage your aspiration is a ‘map’ that can help you avoid driving down dead-end roads.

One such map is scenario thinking (click here for another blog on this topic) where your best people discuss and define different, but all plausible, images of the future … and from there derive which issues you may have to address. You can then prioritize these, and define your aspiration – with the deliberate option of changing or adjusting this as needed with the factual changes of the world. The end solution or product for 2025 may very well not have been invented yet – but you can still build it into your strategic planning.

This combined approach to risk management is a stretch compared to normal applied risk management, and a long way from focused managing risks. Then again, defining and deploying strategies is a long way from operational execution.

The longer horizon you look at/use for your strategic planning, the more different the world will be at the end of your strategic horizon, and, I assume, you need to be relevant also at that point in time. You need strategic manoeuvrability.

After all, manoeuvrability is a competitive advantage. Ensure you have it, and leverage it.

We recently held a private Member meeting on scenario modelling, monte carlo simulation and qualification, where members from across the globe shared their perspectives and approaches. We are in the process of creating a series on scenario modelling and would love to hear from you! If you’d like to get involved in shaping the agenda and attending our series of meetings, get in touch: kin.ly@riskleadershipnetwork.com.

Are you an in-house risk manager who could benefit from collaborating with a global network of risk leaders? Talk to us about becoming a member today.