Managing Strategic and External Risks

Scanning the risk horizon beyond operational risks

By Sourav Gupta, Senior VP-Risk & Compliance, Pipeline Infrastructure Limited

In view of today’s volatile and uncertain environment, proactively assessing the risks which could impact the company’s ability to achieve its strategic objectives becomes very pertinent.  Deliberate choices as to which risks to take/avoid and having explicit consideration of risk-reward trade-offs need to be made prior to taking key business decisions rather than scouting for responses to manage surprises once strategic decisions are made and are being executed.

While organisations continue to focus on operational risks arising from within the organisation, and mostly controllable, the more successful companies are scanning the risk horizon to consider and evaluate strategic and external risks.

What are strategy and external risks?

Strategy risks are those that either affect or are created by business strategy decisions. The company voluntarily assumes such risks in order to generate superior returns from its strategy. A bank assumes credit risk, for example, when it lends money; many companies take on risks through their research and development activities. Strategy risks are quite different from operational risks because they are not inherently undesirable.

External risks, on the other hand, are those arising from events outside the company and are beyond its influence or control. Sources of these risks include natural and political disasters and major macroeconomic shifts.

Risk events from any category can be fatal to a company’s strategy and even to its survival.

Unlike operational, financial and hazard risks, strategic risks are extremely difficult to evaluate, quantify and manage. An unexpected event can nullify the assumptions underlying the strategy and the broader the strategic horizon, the harder it is to manage these threats.

External risks require yet another approach – building resilience and recovery capability. Because companies cannot totally prevent such events from occurring, the focus lies on identification (they tend to be obvious in hindsight) and mitigation of their impact.

When Tony Hayward became CEO of BP, in 2007, he vowed to make safety his top priority. Among the new rules, he instituted were the requirements that all employees use lids on coffee cups while walking and refrain from texting while driving. Three years later, the Deepwater Horizon oil rig exploded in the Gulf of Mexico, causing one of the worst man-made disasters in history.

A U.S. investigation commission attributed the disaster to management failures that crippled ‘the ability of individuals involved to identify the risks they faced and to properly evaluate, communicate, and address them.’

Despite all the rhetoric and money invested in it, risk management is too often treated as a compliance issue that can be solved by construct of risk registers and heat maps. Some of these tools, of course, are useful and do reduce some risks that could damage a company’s objectives.

While a compliance-based approach is effective for managing operational risks, consideration of strategy risks or external risks require a fundamentally different approach based on open and explicit risk discussions. That, however, is easier said than done; extensive behavioral and organisational research has shown that individuals have strong ‘cognitive biases’ that discourage them from thinking about and discussing risk until it’s too late.

Why consideration of such risks is the key to successful business?

In today’s business environment, it has become increasingly difficult for management teams to have confidence that their plans and strategies will play out as expected.

Key to such uncertainty is the exposure to various strategic and external risks – those that can strike more quickly than ever before, hastened by emerging technologies that can disrupt established business models, geo-political instability, changing macro- economic trends, increased regulatory scrutiny and changes, changing markets and consumer preferences, human capital, etc.

Failure to identify or appreciate a risk/opportunity upfront could lead to a failed merger, products that never attract buyers, rushed decisions to enter a new market or geography, losing advantage over a competitor etc.

Further, safeguarding reputational risk has become a key priority, given the rise of social media, which enables instantaneous global communications that make it even harder for companies to control how they are perceived in the marketplace.

How to synthesise outside – In considerations in business strategy?

Some of the key aspects to be considered by companies in integrating the above risks into the process of formulating and executing strategy are:

What we don’t know may be more important than what we do know

The critical assumptions made during the strategic planning time horizon are not always challenged or challenged adequately. Once management assumptions are crystallised, contrarian views could be developed by the risk managers to define plausible/extreme scenarios that could affect or nullify one or more of such assumptions. This would enable management understand what could change and its implications on the delivery of the strategy.

This is crucial since more often than not, the person conceiving an idea is unable to discern what could go wrong may also be biased towards bringing out the downsides.

To use the 2008 financial crisis as an illustration, assume the strategy for a financial institution was to leverage cheap money to achieve volume and speed in lending to low income housing (subprime) sector to facilitate the securitisation and sale of these loans as collatarised mortgage obligations (CMOs). The key assumptions are increasing or stable housing prices, continued availability of cheap money, continued demand for CMOs and continued economic growth amongst others.

Those banks which held a contrarian view monitored housing market indicators and noted nationwide housing price slump starting 2006. They fared much better and remained solvent compared to others (like Lehman Brothers) that remained oblivious leading them to bankruptcy. In fact, in 2007 Lehman fired their internal critics and spent billions of dollars on real estate investments that will within a year, become worthless.

Watch the “Blind Spots” – it pays off to see the change before it hurts

Sooner or later, something fundamental to the business world will change challenging the “status quo” bias. It has happened earlier and shall continue to happen. Disruptive changes in the marketplace area business reality and continually arise from technological developments, market forces and unexpected threats.

Contrarian analysis to underlying strategic assumptions and gathering of competitive intelligence by risk managers is vital for the company to when it approaches the cross roads where a strategic inflexion point exists due to a major change in the external environment (e.g. game changing technologies, dramatically different regulatory environment, catastrophic loss event of a critical value chain component, sea change in customer preference).

Case in point is Borders, the bookstore chain which pursued a strategy to expand brick and mortar outlets whereas the other competitors like Branes and Noble (B&N) capitalised on the opportunity provided by digital mobility. B&N could see the change and therefore slowed down on physical outlets, rather, included e-readers, e-books and invested in online sales capabilities. Borders finally filed for bankruptcy after years of declining sales.

Similarly, some oil majors are investing in emerging technologies as they are commercialised – one of them being Biofuel Technology.

With International Energy Agency reckoning bio-jet to be 10 per cent of aviation fuel supply by 2030 and electric vehicles coming into the market, displacing light vehicles with Internal combustion engines, Eni and Total have repurposed a marginalised refinery for biodiesel to produce low-carbon biofuels whereas ExxonMobil, Shell and BP already produce biofuel alongside crude products

This is helping these corporates pursue their carbon-reduction goals and energy transition initiatives as well as reducing their energy portfolio risk.

Single view of future reduces organisational resilience 

Overconfidence driven by past successes and a fixated bias of the future could be a road block to the think of alternative scenarios. Risk management can help management determine various “What – if “scenarios and their consequences on attainment of business objectives.

By arriving at a manageable number of views of the future spanning a wide range of possibilities, management can identify when contingent plans or exit strategies are required and thereby reinforce the need for adaptability in executing the strategy.

Looking back, one would realise that the winners in business have shifted markedly in the last decade. Ten years ago, the world’s ten most valuable public companies by market capitalization were based in five countries, and only two of them were in the Tech sector. But today, the balance of power has shifted to digital companies in the US and China – and only two of the original ten were still on top.

Given the relentlessness of change on multiple dimensions, the keys to success are likely to be just as different in ten years’ time. How should business leaders prepare their companies to emerge as winners in the next decade?

Strategy setting and risk management share a common focus. They are both forward looking activities. Time devoted to monitoring retrospective performance indicators is useful and appropriate when managing performance, but it is of limited value looking forward. Organisation should have the enterprise risk management process review the risks ‘to and those arising out of strategic planning exercise; including:

  • Understand current enterprise position using a strengths, weaknesses, opportunities, and threats (SWOT) analysis
  • Evaluating how the business environment is changing or is likely to change, and how such changes is affecting or likely to affect the assumptions underlying the strategy and business plan
  • Using Scenario analysis and stress testing to test the robustness of the business model against multiple views of the future to determine whether contingency plans or exit strategies needed
  • Identifying the risks and uncertainties across the business planning horizon
  • Defining the key risk indicators (KRIs) and information sources to track relevant intelligence, preparing response plans for plausible and crisis scenarios


Enter your email address