What’s the risk? An inconvenient necessity or a source of competitive advantage?

Neil Woodford – cautious, conservative, contrarian, high-risk?

These words could all have been used to describe Woodford’s investment strategy at various times during his slow rise and sudden downfall – and they all give an indication of the degree of risk he was taking with his clients’ money.

It is well established in the investment industry that risk and reward tend to go hand in hand – the greater the risk, the greater the potential return on the investment – that is the positive upside to risk – the downside is that the greater the risk the more likelihood there is that investors may lose some or all of their investment.

Risks then are both a source of competitive advantage and a potential threat to success – they can make or break an organisation.

Did Thomas Cook stop taking risks or did they just stop managing their strategic risks?

Not only is it important to recognise that risk-taking is an essential part of building a successful business it is also important that everyone involved in running a business understands what risks are being taken, how they can avoid the downsides and more importantly, how they can exploit the upsides.

Successful enterprises, globally, are realising that risks are something to incorporate into their strategy, not as something to avoid – they recognise the dangers of standing still and avoiding risks and they have made the cultural shift needed to change their business leaders’ approach to taking more risks and reaping the rewards from the greater opportunities available for bolder organisations.

A good place to start with identifying risks is the Business Plan or overall strategy document for the business – a well written plan should be based on an analysis of the strengths and weaknesses of the organisation and the opportunities available to it and any potential threats to its success.

Although when people think of risks they usually focus on the negative aspects – what can go wrong, it is also useful to think of the ‘positive’ risks presented by opportunities.

Once risks have been identified they can then be prioritised to enable the Board to satisfy itself that the organisation’s risks are being managed effectively with regular reviews and discussion to ensure that the most likely or highest impact risks are kept in sight – there will still be shocks and crises for the Board to contend with but an organisation that has identified and mitigated its key strategic risks will be much better prepared to face them than competitors who have not.

risk
 

Recent changes in company law and Corporate Governance, in particular the UK Corporate Governance Code, have emphasised the need for companies to have better strategic risk management and leadership of change, to re calibrate their tolerance for well-managed and calculated risk-taking, to improve their capabilities in managing risk, to have better horizon scanning and the ability to address uncertainties and emerging risks, to place more emphasis on culture and behaviour and for their boards to focus on the things that matter with clear ownership/accountability for risks.

The culture and behaviour of the CEO and the Board with regards to risk is key to ensuring effective decision-making, which drives the success of the business.

There is a balance to be struck between taking measured strategic risks involving innovation and the reduction or elimination of undesired negative risks – a manufacturing plant cannot totally eliminate the production of faulty components but it can ensure that there is a relatively small number of them and they do not get as far as the final assembly line.

In addition to prioritising strategic risks then, we can introduce the concept of risk tolerance where the Board clearly defines and articulates the acceptable levels of risk that it will tolerate.This is analogous to the aphorism “not putting all your eggs into one basket” – a prudent Bank, for example, would not attempt to transfer all its customers from one software platform to another over a weekend – instead it would use pilot phases using batches of customers to ensure all wrinkles were ironed out before undertaking a mass migration of customer accounts.

Oil exploration is inherently a risky business, but it was the mismanagement of the reputation risk by CEO Tony Hayward which caused the most damage to the organisation rather than the environmental risk.

Operational risks, which usually arise from internal causes or known external factors, can be mitigated by using a rules-based treatment which ensures that appropriate policies, procedures and employee training are in place.

The speed with which crises go viral on social media means that it is reputation risk which is far more likely to impact on an organisation’s strategy than financial or environmental risks by themselves.The U.S. investigation commission attributed the Gulf of Mexico disaster to BP’s management failures that crippled “the ability of individuals involved to identify the risks they faced and to properly evaluate, communicate, and address them.”

This evaluation of the cause of the failure could equally well be applied to the failure of many financial institutions during the 2007–2008 credit crisis or Volkswagen and the ‘Diesel Gate’ scandal or indeed any of the high-profile corporate collapses that have occurred in the last few years.

Traditional approaches to risk management use formulaic analysis tools and rules-based systems to produce a risk-register and assurance framework where the Board’s discussion focus is too often on the numbers created by the estimates of likelihood and impact rather than the nature of the risks themselves.

Operational risks, which usually arise from internal causes or known external factors, can be mitigated by using a rules-based treatment which ensures that appropriate policies, procedures and employee training are in place.

Strategic risks on the other hand are much more likely to involve unknown or unknowable factors and therefore require a different approach.

We also see this in the financial sector with regulation and compliance, which is very similar to the management of strategic risks. Going from the familiar to the unimaginable is easier than just thinking of catastrophic outcomes as abstract risks.

These new ways of categorising risk enable Boards to decide which risks can be managed through a rules-based model and which require alternative approaches.

Key to successfully managing existential strategic risks is the ability of the Board, its executives and non-executives to engage in open, constructive, discussions about managing the risks relating to strategic choices and embedding the treatment of those risks in their strategy formulation and implementation processes.

Most importantly for organisations this includes identifying and preparing for non-preventable risks that arise externally to their strategy and operations such as significant swings in global markets, trade wars and global conflicts.

Taking Donald Rumsfeld’s Known knowns, Known unknowns and Unknown unknowns we can map those to the three main types of risks that organisations face, preventable risks, strategic risks and non-preventable risks.

Preventable risks are the internal “never events” that are controllable and should not be tolerated. A risk-based approach to running a business involves having an open management culture with clear recognition of the risks, mitigations and assurances needed to enable all employees to play their part in the company’s success.

There is also a need for Boards to learn from their mistakes – the Banks that failed in the 2007-2008 financial had relegated risk management to a compliance function with their risk managers having limited access to senior management and the Board, whereas the Banks that survived such as Goldman Sachs and JPMorgan Chase had strong internal risk-management functions and leadership teams that understood and managed the companies’ multiple risk exposures.

The future of risk and risk management will be a continuation of the trend to make consideration of strategic risk a key element in the development of corporate strategy – recognising its importance as a source of competitive advantage and a means to avoid the dramatic corporate failures that seem to be occurring with increasing regularity.

First published in Business Reporter Online • November 2019

https://business-reporter.foleon.com/business-reporter-2019/risk-management/whats-the-risk-an-inconvenient-necessity-or-a-source-of-competitive-advantage/

Published by David Doughty

Serial entrepreneur, Software sales and marketing specialist, Chartered Director, Chief Executive, Chair, Non-executive roles in private and public sector, Business consultant and mentor.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: