Integrated risk and strategy: what is the best that could happen?
Risks need to be identified, monitored and managed as an essential component of the strategic management process. The International Standards Organization under ISO 31000 defines risk as “the effect of uncertainty on objectives.” Yet, in my experience, risk is more often the afterthought of a plan and most often considered from the perspective of “what could go wrong.”
Consider the simple example of a bringing a new product to market. The team has spent months, maybe years, performing research, surveying potential customers, developing prototypes, and are finally in the latter stages of product launch. If we go all the way back to the original investment proposal, no doubt there will be some possible risks identified. What if sales flop? What if the product isn’t ready on time? What do we do if a competitor beats us to market? All of these are perfectly valid uncertainties that may impact our ability to deliver on our objectives.
Continuing the example, the strategic performance and risk management processes monitor our progress towards goals and the likelihood of any risk incidents occurring. The organization could conceivably exceed objectives in every respect and mitigate risk all the way through until launch.
Here is the twist. Product sales wildly exceed expectations and, to everyone’s delight, 2 months’ worth of sales happen in just over a week. There are now several new upside risks that present themselves. Will the supply chain scale to serve the demand? Can we handle the volume of calls to the help desk or customer care center now with all this additional stock in the market? How do we handle customer expectations that they can’t get the product for another two months whilst manufacturing catches up? What impact will this have on our brand, and future sales? Throw in one of the downside risks materializing such as a product recall and you have a pretty scary picture developing.
My suggestion is that risk needs to be thought of as both positive and negative, upside and downside. It needs to be incorporated in the development of a strategic plan, and be part of the continuous monitoring of progress against that strategic plan. An “uncertainty mindset” is important in business planning, and the identification and monitoring of upside risk is a good way to help people understand that risk is not just an exercise in thinking about “what could go wrong.” Take a look at Rocket’s solutions in this area of integrated Enterprise Performance Management and Enterprise Risk Management.
Do you have an example of helping our optimistic strategic thinkers to understand and incorporate risk thinking? How have you helped or seen someone come to understand that the best outcome could be just as uncertain and important as what could go terribly wrong?