|
Strategic risk is therefore any threat to the effective generation of the plan, the implementation of that plan, or the intended outcome of the plan. Strategic risk threatens either the correct functioning of any of the components of the strategy process, or the efficiency of the connecting mechanisms between them. A strategic risk ultimately threatens an effort by the organisation to ‘be strategic’.
For any organisational activity to be regarded as ‘being strategic’ the activity must belong within any component of the strategic sequence, or help connect those components. This view not only helps develop strategic plans that intentionally enhance the plan itself by optimizing component functioning in the plan’s interest, but also helps identify risks that were previously hidden. Even deeper insight occurs if the new view is partitioned into external risks (e.g. economic, business) versus internal risks (e.g. structure, climate), and risks that are hard (e.g. structure) versus soft (e.g. climate). Additionally, risk can be examined in terms of being positive and/or negative.
Is risk negative? Or is risk positive?
The accepted view seems to be that risk is always a negative – to be ‘minimised’ and ‘managed’. Yet some risk deserves to be approached with a positive view because it may present opportunities for growth or opportunity. For example, any threat that is also shared by the organisation’s competitors has positive (good) strategic potential.
Some risks may not be associated with a threat at all. For example, risk is an inevitable and necessary part of intentional organisational growth, innovation, creativity, change, or development of new ideas for products and services. It could be argued, however, that not taking these risks is a bigger risk, because without growth, innovation and new ideas (etc) there will be decay. Strategic risk therefore includes balancing consequences of an action, against consequences of inaction.
THE PRACTITIONER
In my experience of corporate planning, the assessment of strategic risk is traditionally a Board and / or senior executive responsibility, and risk is invariably regarded as a negative. While an essential part of the strategic planning process, assessment of risk may not actually happen at this time, as the architects of the strategic plan are under pressure of time, and their main focus is on defining crisp goals and clear strategies.
It is at a later stage, and perhaps delegated to a risk assessment team, that risks to the goals of the organisation may be assessed – primarily in terms of financial risks through a scan of the economic forecasts, market research, investment levels and available resources.
Financial Risk
Organisational risk analysis and risk management is strongly connected to the need to attract investors who will, in their own interests, assess risks in their own terms before committing their financial resources to a company. Investors typically assess corporate value in a rational way, demanding information that helps their investment decisions. In catering to that need, organisations adopt appropriate processes in managing the numbers, and therefore in managing the entire organisation.
In this well accepted rational model, decisions on business direction and investment are guided by a risk analysis and implemented with risk mitigation tactics. Mining companies, for example, base their decisions on exploration and exploitation of potential mineral sites on extensive risk analyses of the internal political and economic status of the site country. They employ risk management strategies including partnership arrangements with the government of that country. Such strategies reduce the risk of being unable to exploit the site and thereby reduce the risk to investors. It is clear that attracting and keeping investors is an important goal - and they are usually rational.
However, there appears to have been a temporary suspension of rational behaviour on the part of investors in start up IT companies in the late 1990’s and a similar lack of risk analysis in commitment of resources decisions taken within those companies. Goals that focus on website traffic as against actual business transactions proved to be not the right goals. It can be risky to cater too much to investor-related goals.
Goal-related Risks
Architects of strategic plans seem reluctant to consider that the goals themselves may be inherently risky to the performance or indeed survival of the organisation. As described above, the goals and strategies themselves may introduce risks that may be seen as external or internal reactions.
Externally, any organisation must balance the needs and expectations of a range of stakeholders. These entities with a stake in the company are likely to include shareholders, customers, government agencies and the general public. Overlooking the interests of any of these stakeholders can be disastrous. Just ask Nike, who overlooked the reactions of the public to the conditions of outsourced workers. Outsourcing was a strategic efficiency goal for Nike that had the unintended consequence of seriously affecting their organisational performance. Perhaps Nike overlooked the risk of alienating one important stakeholder group.
Internally, a decision to increase production or expand areas of enterprise without considering the effect in work intensity for current staff might well result in some unintended consequences. Disaffected employees might intentionally resist the increased workload or fatigued workers might unintentionally sabotage the enterprise’s performance.
In fact, the least considered group of stakeholders is often the organisation’s own membership. It seems surprising that organisations overlook internal areas of risk that relate to their people, particularly considering that it is accepted wisdom now that high-performing companies increasingly rely on the knowledge and innovation of their employees.
People-related Risks
Risk is (normally) regarded as a formal and orderly process of systematically identifying, analyzing, and responding to risks. ‘People risks’ of course, are generally resistant to such order and system.
Still, risks such as the loss of key personnel, particularly in critical areas of business development, or in smaller or medium size organisations, can seriously affect the progress of a project or the performance of an enterprise. It seems self-evident that a need to replace key people would be a foreseeable identifiable risk, and yet I have rarely seen an organisation make any identification of key people – until those people announce a decision to leave or are poached by another division.
In the same way, organisations seldom consider the risks inherent in an environment of tense or adversarial human resource management, unless it is a full-on industrial conflict. Interestingly, often a climate analysis or employee satisfaction survey is conducted by the human resource department in connection with employee conditions or enterprise bargaining without being used for its potential value in risk analysis. Adverse internal conditions can quickly produce a toxic organisational climate that can significantly increase risk to the achievement of the goals of the organisation, becoming a strategic risk.
Strategic risk, in goal achievement, in meeting the conflicting needs of different stakeholders, and in managing internal risks, seems to be best examined through the development of a strategic risk profile to enable a clear and balanced view of the risks.
A Case Study
What do I mean by a strategic risk profile? As an example, consider the case of an unnamed and obviously fictional organisation. As a federal statutory body, it is charged with developing national policy that is to be agreed and then implemented by all states and territories in connection with a sector of education and training. By its nature, this organisation could be said to be seriously overloaded with unwilling and competitive stakeholders - a strategic risk in itself. In addition to the eventual end users of the education and training services, and the taxpayers whose taxes provide supporting funds, several groups of stakeholders would have a stake in this organisation – and their interests are not necessarily similar or even always complementary to the goals of the organisation.
Although national policies are arguably in the nation’s interests, they may also be potentially at odds with the interests of individual State and Territory governments. The inherent compromises of a national approach can also at times be counter to the policies of a Federal Government.
The providers of education and training services, too, are stakeholders and their interests can also be conflicting. Opening a competitive market is likely to be resisted by well-established and entrenched public providers, seen as too slow and too little by private providers, and viewed as threatening to their values by community-based service providers.
Industry peak bodies represent the interests of their members for tailored, flexible and on-demand services – an often conflicting view to the service providers’ preferences for broadly applicable services, delivered in a planned and ordered and sequential manner.
Balancing interests to manage risk
So how can such a fictional statutory authority balance the interests and concerns of such a range of stakeholders / shareholders in developing appropriate goals? Having developed the goals, how can it assess the risks to achieving those goals and then perhaps the risks of the goals themselves to the performance, and indeed the survival of the organisation?
The place to start is always with the strategic purpose or intent of the organisation. If that purpose is clearly the achievement of agreed national policy and consistent application of that policy, then certain strategic goals will signal that the purpose is being achieved. In order to achieve the goals, the strategies will need to take into account the range of interests and concerns outlined above and some strategic risks accepted, some avoided (by inaction) and some evaded (by taking appropriate action).
In other words, the organisation develops a strategic risk profile – an outline of the risk policy or policies adopted with strategic conversation.
Strategic risk profile
A strategic risk profile that takes into account stakeholder interests and concerns must be developed on the basis that some stakeholders will have power and capacity to influence the achievement of the strategic goals – and some will not. So the risk of alienating some stakeholder groups can be accepted (within bounds). Despite the capacity of some less powerful stakeholders, such as the service providers mentioned above, to influence the more powerful, deliberate organisational action to keep those more powerful ‘on side’ will be an appropriate risk management strategy.
In terms of the ‘demand’ and ‘supply’ side of the equation, there are ways to keep the more powerful stakeholders on side. Demand-side risk (industry and end-users) can be managed by the delivery of policy that provides higher quality and better service. Supply-side risks (supply in this case being represented by State and Territory governments) can be managed by establishing trust in demonstrating the value of joint venture approaches. Both these risk management strategies consume considerable resources.
Unfortunately, a strict demand and supply side view has the capacity to overlook or underplay the interests of both external and internal shareholders – the external ones that ‘own’ the organisation and the internal ones that ‘are’ the organisation.
External shareholders expect to receive value for their investment in terms of dividends of some kind. The dividends expected by the Federal Government are, not unrealistically, support for Federal policies and political benefit through favourable public opinion. Too much compromise and lowest common denominator agreements do not deliver either type of dividend.
Internal shareholders are the employees who invest their commitment, time and energy in the organisation – of course for material benefit, but in expectation of dividends in terms of a returned commitment and acknowledgement of their interests and concerns. Too much resource effort to reduce both demand and supply-side risks at the same time and to the same extent means a heavy workload that does not deliver dividends in terms of work/life balance or support the time it takes to develop individuals.
So the strategic risk profile for this fictional organisation shows a tendency to imbalance in managing the strategic risks of stated goals to achieve a national system. On one side, risks of alienating the demand and supply side stakeholders are recognised, managed, reduced, avoided and evaded. On the other side, risks of alienating external and internal shareholders may not be sufficiently recognised or managed effectively.
So the risk is those shareholders that ‘are’ the organisation might be in a position to weaken its performance, and the shareholders that ‘own’ the organisation might be in a position to threaten its survival.
Systemic and Systematic Risk Assessment
A risk situation such as that described in the profile above does not arise because risk is not assessed and managed – at some levels. In most organisations and at the operational level, whether in connection with implementation of the annual plan, or in relation to project management, risk management processes are in place and used.
A risk situation like this does not arise because strategic risk is not considered at all. On the contrary, strategic threats to the organisation are usually at least identified at the strategic planning stage, and the often conflicting interests and concerns of the different stakeholder groups are recognised and debated.
This kind of risk situation arises in the absence of an holistic analysis of risk, and the discussion of strategic risk is not translated into risk management or reduction controls or treatments, in the same way as operational risks are processed. Many organisations, not just our case study, continually resort to correcting the symptoms rather than rethinking the systems - at the strategic level.
Why do organisations find it difficult to establish a complete strategic and operational risk management approach? What is a strategic response to risk? What does the research say?
THE RESEARCHER:
Systematic approach to Risk
Considerable previous research has shown that application of strategic thinking, and paying close attention to improving the systematic functioning of a strategic loop in an organization, will improve organizational performance in the marketplace. The basic strategic loop of Figure 1 has the potential to facilitate such systematic functioning if outcomes are measured and analysed and then used as data for consideration during the next cycle (Figure 2). If the feedback is used to enhance organisational learning, and is used to continuously enhance the process, then the strategic loop can be regarded as systematized. However, a ‘system’ is more than just having a checklist that becomes ‘the way we do things’. A real system is one that self-corrects and helps organisational members learn about the effectiveness of ‘what’ it does, and about ‘how’ its own processes are working.
|
