Identifying potential risks early is a significant competitive advantage in today’s volatile, uncertain, complex, and ambiguous (VUCA) world. Yet, at too many companies, Enterprise Risk Management (ERM) adds only limited value. The manager – usually only one – charged with ERM gathers a list of top risks by talking to executives and plots them on a “heat map” based on likelihood and impact. The list is subsequently reviewed as a brief agenda item by the senior leadership team and the Board, mitigation plans are described as “in place” or “underway,” typically with no action taken and little or no follow-up.
In our new series, Risky Business, we will describe practical ways that companies can do better – turning ERM from a bureaucratic exercise into a capability that significantly improves high-commitment decisions, identifies opportunities, protects bets, and increases strategic robustness and organizational resilience. Some of the steps are easy, needing no new resources. Others require building internal capabilities, perhaps with outside training and coaching.
The key is shifting ERM’s focus from individual risks to strategic decisions – whether already made or under consideration. Too often, risks are ignored or minimized in critical decisions. Why? When risks are separated from decisions, they seem less urgent. If internal, risks become an internal audit or controls issue, rather than potentially central to the company’s future. If external, they tend to become items for the company’s 10K report, with the goal of shielding the company from shareholder lawsuits.
So how can companies add a risk lens to strategic decisions in ways that add real value? An important step is to identify key assumptions – “what must be true” to achieve the company’s goals.
If the decision is important, but has not been made, stress-test the assumptions. This can be as simple as determining the sensitivity of the business case to plausible ranges for key parameters such as cost and market share. More likely, making critical decisions under high levels of uncertainty will require the application of one or more additional tools to improve decision quality – and company profitability:
· “Trendspotting” analysis can help assess whether the proposed decision is consistent with the direction the company’s business environment and customers are heading. As John Naisbitt, who wrote the strategic foresight classic Megatrends, has pointed out, “it is easier to ride a horse in the direction it is going.”
· Scenario analysis can test the robustness of the decision to plausible alternative futures. Does the decision represent a “no-regret” move that is appropriate in any future world or a “big bet” investment the company would make under one scenario but not another? If so, can the investment be cadenced until there is more clarity or can the bet be protected in some other way?
· Business wargaming puts decision-makers and subject-matter experts into the shoes of other stakeholders – competitors, governments, suppliers, potential entrants, etc. – to understand their likely actions. How will they move, seeing the expected changes in the business environment? Will they respond to moves that the company makes?
If the strategy has been chosen and key decisions already made, a “pre-mortem” will often greatly increase robustness and improve resilience. Pre-mortems involve gathering a cross-functional group and facilitating one or more workshops that assume the decision or strategy has failed and identifying all of the ways this might have happened – whether internal or external. Framed as a pre-mortem, this enables franker and more comprehensive consideration of the risks. Mitigation efforts can then be focused on the more consequential risks to the decision or strategy. Pre-mortems also allow for adjusting or changing decisions if the original assumptions are no longer valid.
Finally, after major crises or initiatives have run their course, post-mortems or “lessons-learned” analyses should be routine, as they already are in the U.S. Army. The goal of these analyses is not to assign blame or offer praise, but to learn valuable lessons for future crises or decisions. Several practices improve the value:
Assign two-person teams to conduct the interviews across a broad cross-section of functions and levels, one from inside the initiative or crisis team and one from outside. This allows for a good combination of experience and specialized knowledge with objectivity and perspective.
Capture what went right, what could have gone better, and what went wrong. All are potentially important for the future, even if the initiative was a success or the crisis well-managed.
Generalize the lessons as much as possible. The interviews usually produce war stories. Rarely will the exact circumstance recur, but similar issues will arise again. The outsider member of the team is often most skilled at seeing and articulating the lasting lesson.
Frame all the lessons as recommendations. Use color-coded bullets – green circles for things that went well, yellow squares if it could have gone better, and red triangles for something that should change.
Organize the lessons in a logical way – maybe by stages or by function. Capture the critical recommendations in an executive summary.
Treat the lessons as if they were a manual for future leaders, and ideally update the “manual” with lessons from subsequent initiatives or crises.
These disciplines of stress-testing assumptions, pre-mortems, and lessons-learned analyses improve individual decisions, but, more important, increase organizational resilience and agility. They can be taught and instituted in any organization.