Facing (and embracing) strategic risks
Executives, including CFOs, are finding that by focusing on strategic risks, they are better equipped to identify what could undermine their future business, adapt to new challenges, and take advantage of emerging opportunities. In this issue of CFO Insights, we discuss the barriers to recognizing and responding to strategic risks and outline some of the tools available to help harness them.
Risk management has undergone a refocusing in recent years, in an attempt to make its techniques and processes more adaptable to shifts in business and the economy, and more responsive to the demands of C-suite executives. And those same executives, including CFOs, are finding that by focusing on strategic risks, they are better equipped to identify what could undermine their future business, adapt to new challenges, and take advantage of emerging opportunities.
What exactly are strategic risks? In short, they are the risks that threaten to disrupt the assumptions at the core of an organization’s strategy. Think everything from black swans to political upheavals and financial crises, as well as new technologies that can render a business model obsolete. When asked to name specific risks that will impact their business strategy over the next three years, C-level executives surveyed by Forbes Insights on behalf of Deloitte Touche Tohmatsu Limited (DTTL) ranked pace of innovation (30 percent) and increased regulation (30 percent) as the main ones, but many reported not fully applying their risk sensing capabilities to strategic risks (see, “Risk sensing underutilized for strategic threats”). 1
Often hard to spot and manage, strategic risks typically do not respond to traditional risk management approaches, such as hedging or mitigation. Since such risks can also point to an organization’s next opportunity that forces executives to make a choice: “Are we going to try to resist this, avoid it, and push it off if possible? Or are we going to embrace it as an indicator of where the market is going and where our next big opportunity may be?”
The challenge is us
Part of the trouble many organizations have in navigating strategic risks is inevitable; organizations are populated by humans, and human thinking is inherently flawed. The growing discipline of behavioral economics has shed light on just how hard-wired humans are for some key cognitive biases that tend to keep executives from seeing the strategic risks that may be on the horizon. For example:
The overconfidence bias convinces us to trust our gut when we shouldn’t, and makes us unable to calibrate the limits of our own knowledge. We don’t know what we don’t know, and we overestimate the truth of what we believe.
The availability bias encourages us to inflate the importance and likelihood of things we saw or read recently, giving us a distorted view of what is really important.
The confirmation bias causes us to pay more attention to information that fits what we already believe while discounting information that may contradict what we currently believe.
And perhaps worst of all, the optimism bias fools us into thinking that nothing bad will happen and all our plans will work out as we intend. 2
These and other biases can cause companies to misunderstand the likelihood of events that could reshape their businesses and confound their ability to respond to them. And if biological and cognitive biases don’t present enough barriers, some common organizational constraints—everything from poor internal communication to bureaucracy and group think—may conspire to prevent executives from making the choices they’d like to make with the kind of clarity they’d like to have.
Tools for risk detection
For these and other reasons, spotting strategic risks is tough, but increasingly valuable as many forward-looking companies attempt to connect risk more closely with strategy. They understand that every strategy, every strategic choice, carries risk. Moreover, having the ability to scan and monitor strategic risks on an ongoing basis and create regular, high-quality reporting can create a competitive advantage going forward.
That’s because strategic risk management can also point to the next horizon. Consider the automotive industry. Five or six years ago, that sector was just detecting the emergence of car sharing. Now, sharing cars is accepted not just in urban areas, but also increasingly in suburbs, and many companies are embracing the concept. They are using the strategic risk of consumers doing new things empowered by technology and supported by changing demographics as a new business opportunity, rather than viewing it simply as a market threat.
To aid in the identification and tracking of emerging strategic risks—and future opportunities—companies have a number of tools at their disposal. Specifically:
Scenario planning can help organizations see a set of both risks and opportunities more broadly, to imagine potential futures that might challenge their current strategic assumptions, and to spot potential sources of risk that may not surface in other ways. By rigorously exploring uncertainties in the environment and involving multiple stakeholders, scenario planning can also address the cognitive biases that impede the risk/strategy discussion and offer alternative paths for when risks materialize.
Risk sensing technologies can also be useful in identifying and tracking potential strategic risks. There have been a number of advances over the last few years in data analytics and the ability to analyze huge sets of structured and unstructured data for a variety of risks, both internal and external. For example, the ability of the Internet of Things to make the performance of physical objects visible digitally has allowed power plant operators to monitor the condition of key machinery in real time. Even more, they can then use that data to create accurate digital models of the machinery to examine how it would react in different scenarios, say if demand for electricity spiked at an unexpected time.3 Using such tools, organizations should also be able to monitor their environment for those signals, or changes, both inside and outside the company that point to new technologies, new regulations, new social trends, and new customer behaviors. Yet, while some 80% of companies surveyed in the Forbes Insights/DTTL report say they use risk-sensing tools, those tools are more focused on such risks as financial and compliance risks, rather than strategic risks.4
Horizon scanning can inform the discussion. In their recent article Pattern of disruption: Anticipating disruptive strategies in a world of unicorns, black swans, and exponentials, leading researchers from Deloitte’s Center for the Edge identified nine patterns of disruption—ways that disruptors created new value through a new approach under specific market conditions—that seem generalizable in both the past and the future.5 For example, by unbundling products and services or by shortening the value chain, competitors have been able to upend certain marketplaces—and some incumbents’ businesses. And while these patterns can’t describe every possible challenge a business will encounter, they do help make sense of the changing dynamics many companies are experiencing. Moreover, armed with this understanding, executives can start asking the right questions of their business and the world around them to not only anticipate changes, but also make the “unexpected” expected.
Finally, a strategic risk decision framework can help executives and boards zero in on the risks that could upend the business or open up new opportunities. Think about it: the problem for most business leaders is not a lack of information, it’s an inability to identify and distinguish the signal from the noise. In fact, a glut of data can make it harder to see strategic risks and can put executives and boards in a defensive posture. An effort should be made to not just present information but to present it in ways consistent with people’s ability to manage and navigate it, and in ways that help break down built-in institutional challenges or biases to getting and acting on information. This is where the combination of scenario planning, horizon scanning, and risk sensing can create a platform for early discovery and decisive action on potential threats.
Whatever approach you choose, however, be prepared to confront your biases. No matter how experienced, no human is immune to cognitive or institutional biases. Consequently, at every strategic turn or important decision, ask what uncertainties or biases might be in play. Aggressively seek out information that challenges what you believe. And consider involving third parties who will constructively critique and challenge your point of view.
CFOs as risk integrators
Because strategic risks can threaten the logic of management’s strategic choices, the leaders responsible for those choices should own them. Obviously, the CFO is a crucial part of every conversation about the future of the company, but his or her input is even more important given that traditional risk management remains critically important to good corporate governance. CFOs’ voice is magnified since they serve as strategic advisors on a host of issues—the allocation of resources against strategy, investment options, and capital decisions, and the management of a portfolio of financial risk assets—and in that capacity, they are well positioned to connect the CEO, the board, and other senior stakeholders in the conversation about strategic risks.
Strategic risk is the next frontier of risk management, one that will generate a more nuanced conversation about the risks that are sometimes imposed on companies and the opportunities for new businesses. Armed with the right tools, leaders can accelerate how quickly they discover such risks and fit them into their ongoing risk management processes. Those that do are going to see how strategic risk—and the ability to name it, track it, and deal with it—can turn into an important organizational resource going forward.
Risk sensing underutilized for strategic threats
The pace of innovation, increased regulation, damage to reputation, and talent gaps are the leading risks to companies’ business strategy, according to a new global survey of C-level executives conducted with Forbes Insights on behalf of DTTL. Nevertheless, many are not using risk-sensing tools to detect and monitor strategic risks, which could leave organizations vulnerable to business model disruption, shareholder activism, and other challenges.
“The majority of executives surveyed have risk-sensing capabilities in their organizations. However, these capabilities often overlook key elements, lack technical depth, or leave the organization open to the very risks that risk sensing should be protecting against,” says Henry Ristuccia, a Deloitte Advisory partner in Deloitte & Touche LLP, and global Governance, Regulatory and Risk leader, DTTL.
The survey, Risk sensing: The (evolving) state of the art, found that about 80% of the 155 C-level executives asked about their companies’ risk-sensing capabilities use risk-sensing tools. However, the tools are applied most often to financial risk (71 percent), compliance risk (66 percent), and operational risk (65 percent), and are used less often to detect and monitor strategic risks (57 percent).
When asked to name specific risk areas that will impact their business strategy over the next three years, survey respondents ranked pace of innovation (30 percent) and increased regulation (30 percent) as the main risks. Talent and reputation, at 25 percent and 24 percent, respectively, also ranked high as future risks to strategy.
Risk sensing, which involves the use of human insights and advanced analytics capabilities to identify, analyze, and monitor emerging risks, has become a key component of many organizations’ toolkits for managing risk. The survey found that two-thirds of respondents say they employ people with the knowledge needed to monitor, analyze, and act on risk-sensing
Many executives believe both traditional and new tools are needed to have an effective risk-sensing program. But, when factoring in the pace of innovation risk, 49 percent of survey respondents indicate that using risk sensing to leverage data is the key way to mitigate the risk of being left behind. Says Ristuccia: “A starting point for monitoring strategic risks would be to identify the long-term objectives of the organization—those, that if negatively impacted, would alter the key forces that drive a company’s sector. Those forces can be organized into domains, such as economic, regulatory, customer, technological, operational, funding, and research and development, and include scientific, engineering, or other advances that could affect basic drivers of value.”
1. Risk Sensing: The (evolving) state of the art, Forbes Insights on behalf of Deloitte Touche Tohmatsu Limited (DTTL), October 2015.
2. “In the heat of corporate crisis: Mind over matter,” Marlo Karp and Rhoda Woo, Deloitte Review Issue 17, July 2015.
3. Stephen Lawson, “Cloud-based 'digital twins' could make power plants more efficient,” PC World, September 29, 2105, http://www.pcworld.com/article/2987525/cloud-based-digital-twins-could-make-power-plants-more-efficient.html, accessed January 7, 2016.
4. Risk Sensing: The (evolving) state of the art, Forbes Insight on behalf of Deloitte Touche Tohmatsu Limited (DTTL), October 2015.
5. “Pattern of disruption: Anticipating disruptive strategies in a world of unicorns, black swans, and exponentials,” John Hagel, John Seeley Brown, Maggie Wooll, Andrew de Maar, Deloitte University Press, September 2015.
About Deloitte’s CFO Program
The CFO Program brings together a multidisciplinary team of Deloitte leaders and subject matter specialists to help CFOs stay ahead in the face of growing challenges and demands. The Program harnesses our organization’s broad capabilities to deliver forward thinking and fresh insights for every stage of a CFO’s career–helping CFOs manage the complexities of their roles, tackle their company’s most
Learn more about Deloitte’s CFO Program.