Home > Risk > Good advice from Deloitte for boards on risk oversight

Good advice from Deloitte for boards on risk oversight

November 12, 2012 Leave a comment Go to comments

Deloitte has released a new addition to its Risk Intelligence series, which I continue to recommend to all. Shaping a Risk Intelligent strategy: Confronting assumptions to find risk and opportunity provides good advice for boards and senior executives.  It is useful reading for all governance, risk, and audit practitioners.

Here are some excerpts:

  • “boards of directors and senior executives [are] responsible, in their capacity as strategic leaders, for identifying and responding to the killer risks and game-changing opportunities that face an enterprise. These are the risks and opportunities often referred to as “strategic,” since managing the former and taking advantage of the latter is an essential part of an effective business strategy.”
  • “Effective risk governance requires leaders to understand that risk is integral to the pursuit of value, and to guide the enterprise in managing risk exposures so that it incurs just enough of the right kinds of risk – no more, no less – to effectively pursue its strategic goals.”
  • “boards and executives may suffer from a blind spot with respect to strategic risk that can be as dangerous as it is difficult to recognize. That blind spot is the failure to consider the possibility that the strategy itself may be flawed because it is based on assumptions that may no longer be valid.”
  • “A strategy that was once finely adapted to succeed under particular circumstances may fail if those circumstances change. And the forces of creative destruction are always at work. In fact, the only guarantee in business, as in life, is that circumstances are always changing. In a turbulent environment, where circumstances are subject to inevitable but unpredictable, sudden, and violent shifts, it is anything but certain whether what has worked in the past will still work in the future.”
  • “a full understanding of strategic risk requires systematically and regularly challenging the fundamental assumptions that underlie the strategy.”
  • “There is a natural human attachment to assumptions born of experience. In fact, the more successful a businessperson has been, the more tightly he or she is apt to cling to the assumptions that have historically brought success. That’s because most successful people are likely to have encountered and overcome many challenges in the past – and one doesn’t lightly discard the lessons learned from past successes. The problem is that while today’s challenges may be similar, they are not identical, and the same path that one has taken in the past may not succeed under different circumstances. “
  • “The biggest risk for market leaders as the dominant incumbents is often an unwillingness to challenge the underlying assumptions of their business strategies and execution efforts until it is too late. “

At this point, the authors suggest some techniques for challenging assumptions. They continue with a recommendation to ensure that the organization has risk monitoring in place, which will help identify signals that the assumptions may be incorrect – and that the strategy should be reconsidered.

This is all sound advice, but is it enough?

I suggest considering these additional steps:

  1. Ensure you have a clear understanding of all the assumptions you are making about the future and each potential strategy! Too often, these may be thought of as ‘understood’ and therefore are not challenged.
  2. What is the likelihood that these assumptions will be correct? Is there a probability that results will be different? Apply risk principles to the assumptions, perhaps considering a range of potential outcomes, and then whether actions are required to make desired results more likely. Be prepared if they don’t occur as desired.
  3. Monitor not only external and internal signals that actuality may vary from assumptions, but also the actions you are taking to optimize outcomes.
  4. Consider whether the organization, its people and processes, are designed for agility if the assumptions turn out to be faulty, or if alternative strategies become more attractive.

I welcome your views on the Deloitte paper and my extension.

  1. Khanh Vuong
    November 14, 2012 at 6:25 AM


    Great article, with tremendous references and useful material.


  2. Khanh Vuong
    November 14, 2012 at 6:33 AM


    The only dimension I would add to your model for measuring RM maturity is the degree of responsiveness of a RM system to the external environment and any changes thereof. The more mature a system is, the more adaptive it should be to its external environment.

  3. Tom Patterson
    November 18, 2012 at 6:55 PM

    Agree – Boards can also demonstrate active oversight of risk taking when they define and enforce clear accountabilities for the breadth of acceptable activities (and objectives) they expect management to execute when taking risks in pursuit of an organization’s mission and strategy.

    Boards demonstrate strength in their oversight and monitoring capabilities and their performance by how perceptive they are to strategic risks and to changes in the underlying business climate and markets in which their businesses operate; since all are subject to rapid and sometimes unpredictable changes which impact strategy.

    Good risk management is as much the result of having very smart and perceptive managers running the business as it is with giving them a constant wealther gauge of the market and changing business conditions. Having a clear understanding of a business’ value creating activities and products delivered to the market and the factors that reduce the returns on value is critical to a good strategy. However, making good business decisions in the midst of rapid change while continuing to deliver value to stakeholders is as much about having a sound strategy as it is in having good managers who are accountable for making sound business decisions via continous business and market monitoring.

    In the end, the results say volumes on how well the strategy was executed as it does in how risks were managed in carrying out the strategy.

  1. November 13, 2012 at 1:53 PM
  2. December 4, 2012 at 2:47 PM

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: