Governing and Managing Strategic Risk

In our definition, strategy "is a causal theory of success that exploits one or more decisive asymmetries to achieve an organization's most important goals with limited resources, in the face of uncertainty, constraints, and opposition."

Strategic risk is the potential for ignorance and uncertainty to have a substantial negative impact on the success of a strategy and/or the survival of an organization.

In some cases, the historical frequency of discrete negative events allows their probability and potential impact to be quantified, and the risk they pose to be priced and transferred. However, it is most often the case that the existential threats to a strategy’s success and a company’s survival are true uncertainties (e.g., the potential impact of interacting non-linear trends), whose probability and impact cannot be estimated on the basis of history; instead, well-informed but unavoidably subjective judgment is required to successfully address them.

Governance is the system of rules, practices, and processes by which a company is directed and controlled to achieve its most important goals. The history of corporate failures shows that governing strategic risks — the existential threats that lie at the heart of the new long term viability statement under the U.K. Corporate Governance Code — is one of the most important functions a company’s board performs. Yet companies too often fail to anticipate these risks, accurately assess them, and/or adequately adapt to them. Collectively, these failures are termed “risk blindness.

As NYU professor Aswath Damodaran has observed, "most business disasters can be traced back to bad risk taking...Of all the tasks that make up corporate governance, none is more critical than oversight of risk."

In a world of greatly increased connectivity, complexity, and uncertainty, skill in avoiding failure has become more important than ever before to achieving success and delivering substantial stakeholder returns, because it buys companies the time they need to adapt their strategy in the face of rapid change. As Melanie McLaren, Executive Director of the Financial Reporting Council recently noted, "for investors, as providers of risk capital, knowing how the board is managing and mitigating risks is an important indicator when judging whether the company will be able to deliver the value that investors seek."

However, in executing their duty to govern risk, Directors and Boards face some daunting obstacles.

Logically, the variability of performance across firms in an industry must reflect two factors: either some firms have relative competitive advantages, while others do not, and/or some firms make fewer errors than others. In their quest for superior performance and value creating investor returns, management teams and boards spend most of their time searching for new sources of competitive advantage, rather than reducing the frequency and severity of avoidable organizational errors.

For example, on the basis of an extensive survey, the Travelers 2014 Business Risk Index report concluded that "businesses feel least prepared to manage the risks they identify as most serious." As Peter Whitehead wrote in the Financial Times, "the root cause of most company failure lies in the boardroom, with a serious skills gap and risk blindness being the most common factors." ("Company Disasters: Boards are to Blame" FT, 5 June 13).

A recent McKinsey Quarterly article echoed this point: "Boards often overlook existential risks. These are harder to grasp -- all the more so for executives focused on the here and now -- yet harm companies to a far greater extent than more readily identifiable business risks" (Building a Forward Looking Board). With this in mind, the UK Financial Reporting Council has emphasized that "boards need to focus especially on those risks capable of undermining the strategy or long-term viability of the company, or damaging its reputation" (Boards and Risk).

A June 2013 report by Cass Business School on over 40 company failures ("Roads to Ruin") concluded that these firms, "had underlying weaknesses that made them especially prone both to crises and to the escalation of a crisis into a disaster. These weaknesses … potentially inherent in all organisations … can pose an existential threat to any firm, however substantial, that fails to recognise and manage them. These risk areas are beyond the scope of insurance and mainly beyond the reach of traditional risk analysis and management techniques as they have evolved so far."

Boardroom discussions about strategic risk between directors and management teams are frequently awkward because of the underlying social and cognitive biases at work. Over the course of our evolutionary history, research has found that it has been adaptive to choose as group leaders people who tend to be overoptimistic and overconfident. All of us are also affected by the confirmation bias (the tendency to pay more attention and give more weight to evidence that supports our existing views) and by our natural desire to conform to the views of our group, particularly when uncertainty is high.

The strategic risk governance challenge is further compounded by an impeded flow of risk-relevant information to many boards and directors. As the Cass report noted, "there appears to be a risk ‘glass ceiling’, with often an inability or unwillingness of risk management and internal audit to report on risks to … non-executive directors, particularly risks arising from strategy, behaviour and culture (as opposed to operations)". This point was echoed in "Building a Forward Looking Board", which noted that, "many of the companies whose corpses litter the industrial and financial landscape were undermined by negligent, overoptimistic, or ill-informed boards."

For example, the recent FCA report on the failure of HBOS pointedly noted that, “risk was given insufficient time, attention, focus, and priority by the Board”, and that there is “no substitute for an effective board process which enables non-executive directors as a group to challenge management.”

We work with boards to help them meet the challenge of effective strategic risk governance.

We provide (1) education offerings to improve individual director and collective board capacity for governing strategic risk; (2) board evaluation services, to establish an "as-is" baseline for current performance, and a plan for improving it; (3) design and facilitation of board processes that overcome human biases and produce rich discussions about strategic risks ; (4) independent monitoring services, focused on early warning indicators for strategic risks, and the search for information that challenges key strategy assumptions, and and (5) customized analyses of critical strategic uncertainties, including structured “Red Team” and other competitive analysis techniques.

For more information about us you can download this overview of our firm.