When someone you meet a conference comes up to you and says “how are you guys dealing with strategic risk in this environment?” What is your response? What is strategic risk? Whose responsibility is it? What types of analytics are best suited to understand, forecast and mitigate it? Not that I should answer all of these questions in a blog entry, but my goal would be to invoke thought about them.
Arguably the global economy and in particular the global financial services industry is faced with greater strategic risk now than ever. Over the past year the global financial system nearly froze up, confidence in a wide array of securities dropped to zero and the infamous housing boom, went bust. What we saw was a confluence of innovative financial engineering fueling a boom cycle with the protagonists wearing blinders and by protagonists, I mean consumers, bankers, investment bankers, regulators and politicians — everyone. When I think of strategic risk, I think of the risk that a firm cannot return economic value to its stakeholders. Stakeholders may be private owners, public investors, or increasingly, tax-payers. Strategic risk is the risk that the underlying strategy of the business model has an obvious or hidden flaw that will cause it to break, to become illiquid or insolvent. For many failed financial firms the flaws were in being over-leveraged while having a host of covenants which could be triggered by downward spiraling market valuations of securities or by a ratings downgrade.
The responsibility of strategic risk falls at the feet of the CEO. Why not the board? The CEO is the one who sets the vision for the organization, who places professionals into positions of expertise around finance, marketing, operations, technology, legal and human resources. The CEO is the steward of the business model and is accountable to his or her board of directors. The CEO has the responsibility to ask the key questions on leverage, on markets, on operational risks, on technology efficiency and disaster recovery as well as risks to the organization’s reputation and most importantly, are the employees able to execute efficiently and appropriately. These risks have to be considered simultaneously while optimizing shareholder wealth — not an easy set of tasks. “What are the issues that keep you up at night?” Is a common question, the answer usually is analogous to “those issues that pose a risk to growth, stability or solvency of the organization”. In summary, the CEO is the organizations strategic risk officer.
To get and keep a grip on strategic risk involves software and analytics, in addition to business acumen and intuition. Truthfully, the CEO might run through a hundred possible scenarios and questions related to a multi-million dollar capital investment, but the multiple input statistical simulation run by his strategic planning or finance team will run over 100,000 possibilities, perhaps more before arriving at a probable outcome. Strategic risk management is also about extreme curiosity about what on the surface are disconnected, disparate business issues within the organization, but underneath have latent connections and dependencies that could be financial, legal, operational or technological. There are new software tools available now that assist organizations in aggregating risk issues and surfacing potentially high risk correlations. Organizations need to look a managing strategic risks as a function of scenario analysis, robust risk assessments and yes, business intuition and acumen. The simple act of convening the debate will unearth new risk issues. Before any risk can be mitigated, the objectives have to be known and the risks to those objectives have to be brainstormed.
So the next time the question of “How do we manage strategic risk?” comes up, have the conceptual answer ready in that your organization as a part of your overall enterprise risk management program have a process for strategic risk assessments which includes financial scenarios and an assessment of risks across the organization that could in their worst cases pose a solvency, reputation or market event. Ultimately, many different types of risks feed into strategic risk. I like aviation, therefore I offer the pilot as a strategic risk officer for your next flight. When you think about it, there are hundreds of lives at stake with billions in liability to be guarded against. The pilot uses training and intuition combined with an array of technologies to accomplish a mission, and when issues arise, has the ability to mitigate risk to the best of his ability.
