Incorporating Risk in Strategy PlanningAs a follow-on to a recent post that touched on the importance of incorporating risk management in strategy development and execution, I'd like to note the five-step process for doing this that McKinseyites Kevin Buehler (a director at McKinsey), Andrew Freeman (a senior expert on risk), and Ron Hulme (also a director) lay out in an article in the September 2008 issue of the Harvard Business Review.
Buehler, Freeman, and Hulme (BFH) argue that
Engineering and managing a company's evolving risk portfolio has become an organizing principle for strategic choice, and companies that succeed in doing this generate far higher returns on their equity than those that stick with their traditional portfolios. That's partly because when they focus on their natural risks [risks for whose management they have a competitive advantage], they can typically support high debt levels: Interest payments unlike dividends can offset taxes. Companies can also save on operating costs ...The five steps in the process for optimizing corporate risk management that BFH recommend are:
- Identify and understand your company's major risks. Typically, this means analyzing and managing 4 to 6 risks.
- Decide which risks are natural for your company. These are the risks your company should embrace; other risks should be transferred to third parties or mitigated through such means as insurance.
- Determine your company's capacity and appetite for risk. Capacity for risk is determined by probabilistic assessment of such critical items as cash flow at risk. For example, in the case of cash flow at risk, the key question is: What is the probability of cash shortages or surpluses over each year of the planning period?
- Embed risk in all decisions and processes investment, commercial, financial, and operational. The key questions: Are critical business decisions made with a clear view of how they change your company's risk profile? Are core business processes consistent with your approach to risk?
- Align your company's governance and organization around risk. This means having systems and infrastructure in place for monitoring and managing the risks your company has assumed.
BFH point out that "developing an institution-wide approach to risk requires a lot of education," which means a training plan should be part of the process of moving to the risk mind-set and culture that BFH advocate. The aim is to ensure that "the organization is aligned from top to bottom with a common understanding of the company's key risks and overall level of exposure" and that those making decisions know how to correctly factor risk considerations into their analysis (e.g., they know how to calculate risk capacity).
Labels: Risk management