Three levels of strategic risks

The concept of strategic risks has been given a lot of attention. For one, the concept and word “strategic” is possibly the hottest and sexiest word in business, so everyone wants to “go there”. On top of that, the term is sufficiently opaque to encompass almost anything. Finally, strategy is the work of executives, and we all want to become executives, do we not.

The below are my two cents on the topic of strategic risks.

First – defining strategy. “A strategy is a set of actions taken to meet an objective/aspiration within a defined timeframe”. Hence, the strategy is what we do, not why we do it.

For the strategy to be relevant is must be a valid choice which means that someone may validly chose to do something different. Hence “pursuing growth through market expansion” is a valid strategy as others may validly opt to grow through acquisitions or other means. On the other hand, “being competitive” is hardly a strategy as no-one really would opt “not to be competitive”.

Further to define strategic risks. “Strategic risks are those risks (good or bad) which affect strategic choices and/or the implementation of these”.

This definition includes internal (re)prioritizations as well as changes in business circumstances, which enforce changes to company strategies. However, as these may present themselves in many ways and forms throughout the strategic horizon, these externally imposed risks are seen as just risks to the company in line with any other.

Based on the above, I see three levels of strategic risks, which can be described in terms of three questions:

1. Are we sure our strategic aspiration is relevant … by the end of our strategic horizon?

2. Will our strategy ensure we meet our aspiration?

3. Will we, when reality hits us, deploy our strategy as planned?

These three types of risks differ in nature, complexity and means of control/risk management and are hence seen as three levels.

Let us start at the bottom and work our way up.

Deployment/execution risks

Deploying a strategic generally invokes a series of projects to implement. If the strategy is expanding into new markets, one project could be to define logistic and delivery systems to these new markets, another to set-up sales entities, a third to build any needed local organisation, a fourth to adjust product offerings to meet local needs and legislation.

To be blunt, these projects are just that – projects. As such, they are optimally risk managed as projects within the organisation are optimally risk managed already. The only strategic element of these projects is their anchoring to the strategy and hence their presumably higher priority.

This means, all else equal, that these projects have a smaller risk of being under-funded or not provided with the needed resources. However, it also often means, that the number and level of uncertainty is somewhat bigger than that of more operational (known) projects.

Bottom line – strategic projects can be risk managed as projects using the proficient and tested project management processes already (I hope) used by the company.

Given that, I now boldly assume that each defined project will deliver on the targets defined for that project.

Tactical implementation risks

As stated, deploying a strategy invoke a number of projects more or less in parallel. With good project risk management, we have already ensured that each of these will be successful. The question is now, “is that enough to meet our strategic aspiration”.

As an example, the aspiration may be to grow sales 10% annually for the next 5 years.

The risk question here is “will these initiatives be enough to deliver a 10% annual growth – we may be part of a stagnant or even declining market.

To risk manage this level, we leverage portfolio risk management methodologies by consolidating the risk exposure management of all the embedded projects as well as any cross-project risks and opportunities.

To be effective we must know which impact each project has on the overall performance. That is – we must link each project to the meeting of the overall aspiration – in this case the 10% annual growth.

The practical risk management of that is based on a Monte Carlo simulation model where the outcome range of each project is built in to an adequate level of detail and accuracy. Key cross-project risks (good or bad) are added and the model is simulated to find the likelihood of being able to deliver the 10% annual growth – year on year as well as overall, i.e. leading to a 61% growth in the 5^th year as compared to the baseline year.

The Monte Carlo simulation software, whichever you wish to use, will also deliver a “tornado” diagram showing which risks affect the achievement of the target the most, and hence where to direct any further attention if/when you are not satisfied with the likelihood [of meeting your aspiration] as it is. You may wish to design your risk management efforts to deliver a 75% likelihood of meeting or exceeding your target. Bear in mind, that if you are/can be 99% certain to deliver your target – you are probably not ambitious enough. To quote racing icon Mario Andretti “If everything is under control, you are moving too slow”.

Largely, this level of risk management is portfolio risk management as seen in astute companies.

Strategic aspiration risks

Many companies state their strategic aspirations as “images” rather than numbers. Hence the beforementioned “10% annual growth” is a rarely stated strategic aspiration as it does not drive enthusiasm and energy in the organisation – which is one strong value of strategic thinking.

Instead statements are used – statement of high and ambitious, but also inherently desirable results are used to communicate strategic aspirations. “We want to be the world’s best supplier of … by 2025” or “We want to have a positive impact on xx mio people’s lives by 2025” or anything in that nature.

The risk management question in a rapidly changing world is “do we really want this by the end of our current strategic horizon?”. One off of my head example could be “We want to be the worlds foremost supplier of spark-plugs by 2025”. Great aspiration, except that there is a severe risk the market for spark plugs in 2025 is all but non-existing as the combination of technical development and environmental legislation has made fully electric cars the “only way to drive”.

Just imagine today, you are the “world #1 supplier of DVD players” – and you have spent a decade of hard work to get there. Now take a look at home, when was the last time you saw a DVD or ask your children if they know what DVD means.

Risk managing this is all about looking sufficiently far into the future in a world of change. Here notion of likelihood, impact distributions and Monte Carlo simulation will not help you, nor will add-on mitigation actions to any proposed strategy.

What you need to risk manage your aspiration is a “map” that can help you avoid driving down dead-end roads.

One such map is scenario thinking where your best people discuss and defined different, but all plausible, images of the future … and from there derive which issues you may have to address. You can then prioritize these, and define your aspiration – with the deliberate option of changing or adjusting this as needed with the factual changes of the world. The end solution or product for 2025 may very well not have been invented yet – but you can still build it into your strategic planning.

This above combined approach to risk management is a stretch compared to normal applied risk management, and a long way from focused managing risks. Then again, defining and deploying strategies is a long way from operational execution.

The longer horizon you look at/use for your strategic planning, the more different the world will be at the end of your strategic horizon, and, I assume, you need to be relevant also at that point in time. You need strategic manoeuvrability.

After all, manoeuvrability is a competitive advantage. Ensure you have it, and leverage it.