Sometimes everyone is preoccupied with what they see as the “big stuff” to the extent that the ideas behind it are unclear. But every organisation needs a vision, and a direction to take, which is the underlying philosophy of having a strategy: you know what you want, and you have to plan how to get there. On your journey, you will meet obstacles – so you anticipate what these might be, and think of strategies to overcome them. This is risk management; Corporate Strategic Risk Management is what happens when the company puts it collective thinking cap on, and works out ways to keep the company going through as much adversity as possible. It is big-picture planning and starts at the top.
But first, there should be clarity about what constitutes the big picture for the individual organisation. Some risks are generic but they mean different things to different companies in different environments or industries; they eventuate at different levels of intensity and cause different types of disruption. For instance, a power outage may melt the ice in a café refrigerator but may wipe out the entire stock of an ice-cream manufacturer! Both businesses experience the same kind of risk but the outcomes have vastly different impacts. Risk is inevitable in today’s business environment; knowing where it springs from is therefore imperative if it is to be managed and mitigated.
That is the basis for Corporate Strategic Risk Management: identifying threats to the business, assessing them, finding ways, means and methods to drive the business through disruption, and keep the business going. This is not confined to the operations of the business, but extends to its long-term sustainability. And, like most long-term things, it has to start with an in-depth understanding of what keeping the business going entails – and that starts with inventorying, or measuring what it has to begin with. What can be measured can be managed, but in the case of corporate strategic risk management, what should be measured?
Organisations can start by first identifying their existing business strategy, gauging how closely it is aligned to the company’s objectives, then seeing where the shortfalls lie. A good measurement to use is key performance indicators (KPIs). Is everyone doing what they are supposed to do? What are the outcomes? What should be the outcomes? What will it take for the organisation to achieve its desired outcomes? These are the questions the firm should ask in the pursuit of measuring and managing. Start with the big stuff, invite feedback from the organisation at all levels, and when the conversation gets going, deep-dive into details. All levels will start feeling invested in the process.
But it has to start with the Board, and the Board needs to be clear about where it is going, and what needs to be achieved. Because corporate strategic risk management is first and foremost the responsibility of the Board Accordingly, its members need to have the intellectual capacity to be able to formulate the best way of reaching out to staff and stakeholders alike, to communicate their ultimate strategic vision across all sectors of the organisation. Strategic risks are usually those which pose the biggest challenges to the firm. If the Board cannot see or manage them, then the Board will not be effective, and will not contribute to the firm’s growth, sustainability, competitiveness or value creation ability.
