Strategic Risk Management

16

STRATEGIC ANALYSIS—METHODS FOR ACHIEVING SUPERIOR AND SUSTAINABLE PERFORMANCESTRATEGIC ANALYSIS—METHODS FOR ACHIEVING SUPERIOR AND SUSTAINABLE PERFORMANCE

STRATEGIC RISK MANAGEMENT

PURPOSE: The purpose of strategic risk management is to assess and manage the strategic risks as part of the strategic planning and strategic management process. Sometimes referred to as enterprise risk management (ERM) or governance, risk, and compliance (GRC), strategic risk management is a process for identifying, assessing, and managing risks and uncertainties that could inhibit an organization’s ability to achieve its strategic objectives.14 With increased expectations from shareholders, regulators, rating agencies, and other stakeholders, nonexistent or underdeveloped strategic risk management plans can prove to be detrimental to a company’s ability to create and protect value for its stakeholders.

14 Mark L. Frigo and Richard J. Anderson, “What Is Strategic Risk Management?” Strategic Finance, April 2011, sfmagazine.com/wp-content/uploads/ sfarchive/2011/04/STRATEGIC-MANAGEMENT-What-Is-Strategic-Risk-Management.pdf. 15 See Mark L. Frigo, and Richard J. Anderson, “Strategic Risk Assessment: A First Step for Improving Risk Management and Governance,” Strategic Finance, December 2009, sfmagazine.com/wp-content/uploads/sfarchive/2009/12/Strategic-Risk-Assessment.pdf; Richard J. Anderson and Mark L. Frigo, Creating and Protecting Value: Understanding and Implementing Enterprise Risk Management, Committee of Sponsoring Organizations of the Treadway Commission (COSO), 2020, coso.org/Documents/COSO-ERM-Creating-and-Protecting-Value.pdf.

corrections as needed earlier than if they had no early warning signals.

Strengths: Instead of assuming there is one best answer to a strategic question, scenario planning considers different possibilities for different futures. It considers multiple uncertainties simultaneously. Unlike simulation modeling, it requires subjective thinking as well as quantitative analysis. It is especially helpful when: uncertainty is high, there have been costly surprises in the past, current strategic thinking is weak, and there seem to be few opportunities to pursue. Further, identifying early warning signals is a good practice no matter which strategic planning tool is used. Limitations: Scenario planning is based on just two critical uncertainties that are chosen based

on rankings. Focusing on two could miss other critical potential forces. There will be differing opinions about the implications of uncertainties, sometimes motivated by individuals’ incentives and personal biases. Further, there is usually more than just one key focal issue. The analysis can also be difficult to do well. It generally requires a number of participants from different areas of the company and can take a long time to complete the exercise. Role of the management accountant: As with other strategic planning tools, management accountants can lead or facilitate the process. More specifically, they help identify key focal issues, driving forces, and early warning indicators. They can also represent different stakeholders’ views and assess the logic of the narratives. •

HOW IT WORKS: Strategic risk management is based on a company assessing the strategic risks and developing action plans for monitoring and managing strategic risks. Here is a seven- step process for conducting a strategic risk assessment that has been used by management teams and boards of directors.15

Licensed to: Kaihan Li S/N:34ed34ac143322d90093d862c8a6c21c

S/N:34ed34ac143322d90093d862c8a6c21cLicensed to: Kaihan Li

17

STRATEGIC ANALYSIS—METHODS FOR ACHIEVING SUPERIOR AND SUSTAINABLE PERFORMANCESTRATEGIC ANALYSIS—METHODS FOR ACHIEVING SUPERIOR AND SUSTAINABLE PERFORMANCE

1. Achieve a deep understanding of the strategy of the organization.

2. Gather data and views on strategic risks. 3. Prepare a preliminary strategic risk profile.16

4. Validate and finalize the strategic risk profile. 5. Develop the strategic risk action plans. 6. Communicate the strategic risk profile and

strategic risk action plans. 7. Execute and implement the strategic risk action

plans and monitor the strategic risk profile.

While the steps define a basic, high-level process, they also allow for a significant amount of tailoring and customization in their execution to reflect the maturity and capabilities of the organization. Accordingly, management accountants should see the seven-step methodology process as a beginning outline to be tailored into a detailed project plan for strategic risk assessment. The steps also reflect the fact that strategic risk

assessment is an ongoing process, not just a onetime event. Reflecting the dynamic nature of risk, the seven steps constitute a circular or closed-loop process that should be ongoing and continual within the organization. One approach for introducing the strategic risk assessment process in a finance organization is to conduct a strategic risk assessment process workshop, which would include a discussion of the process and its tools.

A lack of strategic risk management can be disastrous. For example, during the financial crisis in the late 2000s, the banking industry did not have strategic plans in place to protect its firms’ value when the housing market crashed. Subprime mortgages along with many other questionable banking practices and lending posed tremendous risks to these firms that were neither realized nor accounted, and those risks materialized in a disastrous way.

16 A strategic risk profile includes a description of the risk facing a company and the likelihood and impact as well as velocity and readiness relating to each risk. For an example of a strategic risk profile, see Mark L. Frigo and Richard J. Anderson, Embracing Enterprise Risk Management: Practical Approaches for Getting Started, COSO, 2011, coso.org/Documents/Embracing-ERM-Getting-Started.pdf. 17 Frigo and Læssøe, 2012.

STRATEGIC RISK MANAGEMENT AT LEGO A great example of strategic risk management is The LEGO Group.17 LEGO Strategic Risk Management developed risk management in four steps:

1. Supplemented traditional ERM—including financial, operational, hazard, and other risks— by explicitly handling strategic risks. This was the starting point for LEGO to link the risk management areas and added strategic risks to its overall ERM framework.

2. Added Monte Carlo simulations to understand the financial performance volatility (which proved to be significant) and the drivers behind it to integrate risk management into the budgeting and reporting processes. This step was designed to quantify uncertainty in the budgeting and reporting data at LEGO.

3. Began active risk and opportunity planning (AROP), where business projects go through a systematic risk and opportunity process as part of preparing the business case before making final decisions about the projects. This step helped ensure that all projects are reviewed in a consistent manner relating to risks and opportunities.

4. Used scenario planning to help envision a set of different yet plausible futures to test the strategy for resilience and relevance. This step helped LEGO understand and prepare for uncertainty in the strategic planning process.

This four-step approach represents an example of how to evolve beyond traditional ERM and integrate risk management into strategic decision making and strategy execution process.

Licensed to: Kaihan Li S/N:34ed34ac143322d90093d862c8a6c21c

S/N:34ed34ac143322d90093d862c8a6c21cLicensed to: Kaihan Li

18

STRATEGIC ANALYSIS—METHODS FOR ACHIEVING SUPERIOR AND SUSTAINABLE PERFORMANCESTRATEGIC ANALYSIS—METHODS FOR ACHIEVING SUPERIOR AND SUSTAINABLE PERFORMANCE

Strengths: Strategic risk management is a necessary core competency in today’s world.18 Strategy drives risks and opportunities, and the integration of strategy, risk assessment, and risk management is a fundamental strength of strategic risk management. Limitations: Strategic risk management involves developing new specialized skills and capabilities in strategy and risk management, which requires education and training. It also requires working beyond silos in risk management because financial, information security, and other risks reside in different functional departments. Role of the management accountant: Management accountants can help lead strategic risk assessments.19 They can also play a leadership role in developing key risk indicators (KRIs) as part of a company’s strategic risk management and performance measurement system. KRIs might include number of defects for a manufacturing company or number of worker injuries.

Internal/External Strategic Analysis Methods Strategic analysis must include characteristics of the company internally (e.g., strengths and weaknesses) as well as external factors (e.g., opportunities and threats). Management accountants can play an important role by ensuring these issues are considered, collecting data and identifying internal and external issues to consider, and developing key performance indicators (KPIs) to track those issues. They can and should challenge long-held assumptions about the market. Table 2 in the Appendix provides a summary of the internal/external strategic analysis methods. Potential tools and methods to apply include SWOT analysis, value chain analysis, strategy maps, gap analysis, Good to Great’s Hedgehog Concept, and Return Driven Strategy. •

18 Mark L. Frigo, “Strategic Risk Management: The New Core Competency,” Balanced Scorecard Report, January-February 2009. 19 See Frigo and Anderson, December 2009. 20 For an excellent discussion on conducting an effective SWOT analysis, see Fleisher and Bensoussan, 2015.

SWOT ANALYSIS

PURPOSE: SWOT analysis helps an organization understand its strengths, weaknesses, opportunities, and threats from the outside environment. SWOT analysis is typically used to identify opportunities for success in the context of threats and clarify directions and choices.

HOW IT WORKS:20 The first step in SWOT analysis is identifying and evaluating four areas (see next page):

Strengths: SWOT analysis has wide applicability and has been used by virtually every type of organization. It can be applied to products or services, projects, new investment options, for-profit or nonprofit organizations, and even individuals. Almost every business program includes SWOT analysis early in its curriculum. Limitations: The basic SWOT model is descriptive

and does not in itself generate any specific answers or lead to innovative ideas. It can merely provide general recommendations, such as move the company away from threats or match its strengths with opportunities. Although the framework is very simple and uses four easily understandable “boxes,” they often are not so clear-cut. They may be qualitative, requiring judgment and some degree of consensus to be actionable. SWOT analysis may fail due to the blind spots of members of top management who harbor long-held beliefs or biases not easily changed or challenged.

Licensed to: Kaihan Li S/N:34ed34ac143322d90093d862c8a6c21c

S/N:34ed34ac143322d90093d862c8a6c21cLicensed to: Kaihan Li