Defining the undefinable?

What exactly is a strategic risk? Most companies can define an operational, financial or market risk, but few agree on the definition of a strategic risk. A guide for directors published last year by the Institution of Civil Engineers (ICE) claims strategic risk is: 'Possible future scenarios that would make a material difference to an organisation's ability to achieve its objectives.' It continues: 'Strategic risks are influenced by people's perception and behaviour. They are more dynamic, uncertain and interconnected.' Well, that covers a lot of ground but does it really help specify or define a strategic risk? Moreover, what does one look like in your organisation? Variety of definitions

Looking at annual reports of FTSE 100 companies offers some further ideas about strategic risk, but there is no unanimity. The banking industry reports risk comprehensively, with, for example Lloyds TSB identifying strategic risk as: 'Strategy risk is the risk arising from developing a strategy that does not maximise franchise value and/or fails to achieve the initiatives in the agreed strategic plan due to changing or flawed assumptions.'

This sounds as if strategic risk occurs where events do not happen as planned. Is that it? A couple of other reports from the Financial Services industry might help. Man Group is 'a leading global provider of alternative investment products and solutions' which recognizes business, operational, credit, market and liquidity risks. Here strategic risk is distinguished from business risk in that it includes risks that are considered to arise over a longer timeframe. This adds the dimension of time, but does not really give us a satisfactory definition of strategic risk. Most people would say that it embraces more than this. Finally let us look at a definition from the venture capital group 3i.

This defines strategic risk in relation to operational risk. Operational risk 'arises from inadequate or failed processes, people or systems or from external factors affecting these', so strategic risk is where 'significant unexpected changes or outcomes, beyond those factored into the group's strategy and business model, may occur, which could have an impact on the group's performance or financial position'. Why are there so many widely different definitions of strategic risk?

One hypothesis is that the identification falls between two areas of responsibility in an organisation: strategy and risk. The strategy people see risk as an opportunity, yet the risk people see risk as a threat. Risk reporting by an internal audit committee is based on a risk register and concentrates on operational risk. Strategic risk evades scrutiny. Strategy reporting is based on forward assumptions and probabilities, which demand skills of prediction and control. Most companies report only what they control.

“One of the most robust definitions of strategic risk is that it sits between operational and market risk

One of the most robust definitions of strategic risk is that it sits between operational and market risk. This definition introduces relativity, in that strategic risks are harder to predict or control than operational ones but easier to predict or control than market ones. This takes out the time dimension favoured by Man Group and retains the dimension of prediction favoured by Lloyds and 3i, while adding the important dimension of control. Sustainability

It is possible to go further in defining strategic risk, with at least two other dimensions: sustainability and irrationality.

First, take the issue of sustainability in strategy. An oil company, whose business model is based on the assumed availability of oil, should identify that assumption as a strategic risk as the fossil fuel is a finite resource. Strategic risk ought to identify threats not only to the business model but to the assumptions on which it is based. The ICE guide sees strategic risk as the most important risk an organisation faces and fundamental to its survival, not just the achievement of next year's figures. A growth strategy based on demand forecast for products or services should highlight the strategic risk, both as opportunity if demand increases and threat if it diminishes. Irrationality is about confidence, as strategic risk is strongly influenced by perception and behaviour. Reputation is a strategic risk, yet few organisations comment on it. Reputation is a perception others have about you and this determines the level of trust they place in you, whether public service or private enterprise. How many organisations do you know who measure the trust of their stakeholders on a regular basis and try to manage reputational risk?

The Companies Act and new enhanced business review require a statement on principal risks and uncertainties, yet here few actively identify reputational risk. Man Group claim: 'Reputational risk can result from events in any risk category', indicating reputation is a consequence of actions not a driver of value. This definition misses the irrationality of strategic risk; it fails to recognise that reputation risk is not just about protection from damage but can be about exploitation or leverage of opportunity. Activist investors can question strategy and whether a board is failing to deliver value to shareholders. But while strategic risk is so poorly understood it is hardly surprising that strategic value is also questioned by those who do a little research.