Risk and Strategy
My good friend, Nenshad Bardoliwalla, is the co-author of Driven To Perform and his latest blog (at http://bardoli.blogspot.com/) starts a discussion about the first phase in the book: strategize and prioritize.
What I want to focus on here is this sentence from the blog:
“In the process of setting business strategy, the development of strategic and operational plans should include the identification and assessment of risks to short- and long-term objectives and plans.”
There is no point in setting unrealistic and unattainable strategies, goals, and objectives. There is also a problem when the risk of a strategy outweighs the reward – even when the risk is managed as well as you realistically can.
So an effective strategy-setting process should include:
- understanding the risks to each of the desired activities
- setting only attainable strategies, goals, and objectives where the rewards exceed the risks (the degree should be set by the board and executive management), and the risks are within organizational tolerances
- taking advantage of the upside of risk – opportunity (for example, L3 Communications is benefiting from the perceived risk of passengers smuggling bombs onto planes by selling more full body scanners)
- establishing how the organization will manage the risks to optimize the likelihood of achieving strategies, goals, and objectives
But there is more to the relationship.
The only risks that need to be managed are those that are material to organizational strategies, goals, and objectives (Marks, 2010)
What is the value in monitoring and managing risks that are not material to strategies, goals, and objectives, and would not impact the likelihood of corporate success? Surely, these are what the Lean practitioners would call muda, or waste.
So, the best risk management system – surely – is one where there is linkage between the system for managing strategies and the risk management system. Strategies are linked to risks, so a review of performance against them also includes a review of related risk levels – and so can drive action to either modify the strategy or change the risk response. Linking risks to strategies also ensures that muda is limited, and resources are spent only on risks that are material to the success of the organization.
Do you agree?
 With Stephanie Buscemi (another friend) and Denise Broady.