Year end risk reflections: How bad is bad?

Most companies are increasingly concerned with a range of specific risks facing them. These include risks such as domestic political uncertainty given that 2024 will be a year of elections in the UK, US and for the EU parliament. For example, in the UK and the US, the impact of potential changes to the ‘colour’ of political leadership introduces decision-making uncertainty given possible changes to public sector prioritisation, spend and management of public sector debt.

In addition, geopolitical risk is continuing to be front page news, be that the continuation of the war in Ukraine, the Israel / Hamas conflict in Gaza or the possibility of increased regional tension (e.g. China and Taiwan). These conflicts can adversely impact the economic outlook, organic and inorganic investment decisions and the stability of supply-chains.

Economic risks

From an economic perspective, interest rates and inflation are proving to be stubborn risk factors and although the expectation seems to be that they have both peaked, they are not coming down quickly. In addition, many labour markets are still tight despite unemployment rates going up, hence wage inflation is not abating. As a consequence, cost inflation pressures are persisting and affecting the ability to preserve margins by pass through of these cost increases to customers. Overall, a combination of these risk factors are resulting in a reduction in the demand for goods and services in many sectors.

Other key areas to watch for are tech risk issues such as cyber and AI. These risks need to continue to be front and centre for many Boards and they will require careful evaluation of the risks and opportunities of using AI as an integral part of doing business.

The risk factors described above, whether looked at individually or combined in credible scenarios, present a challenging picture for many businesses. Many companies are also finding it more difficult to identify growth and value creation opportunities beyond the current focus on cost control, efficiency improvements and deleveraging.

It is therefore appropriate to step back and assess whether sufficient time is spent on assessing the volatility and uncertainty facing businesses and whether the current risk management approaches support better planning and decision-making.

Risk identification and management

It would appear that the focus on risk identification and management is not keeping pace with changes in the external environment and the complexity of business models. This could be an indication that compliance is being prioritised above the value protection and value enhancement benefits of embedding Risk Management in Business as Usual.

Hence, both Executive Management and the Board should encourage open and challenging conversations to ensure that they get broad input on questions such as:

• Are we allowing enough time for both risk profile and risk appetite discussion?
• Are we embedding the outcomes of these discussions in day-to-day activities at Group and Divisional / Business / Functional level?
• Are there decisions that we are avoiding today which can impact on future performance or risk?
• Are there decisions we are making today that could hinder future success (delivery of strategic plan)?
• Are we embracing new / more rigorous approaches to risk analysis to better capture the uncertainty we face and the choices we have to make?
• Do we consider disruption as a real possibility or is the attitude more that ‘it couldn’t happen in our industry’?

There are a range of approaches that can be adopted to respond to the questions above. In my experience, here are a few potential actions that can be implemented.

As a first step, strategy and risk discussions should sit side-by-side, and should enable the organisation to consider what the risks to the delivery of the proposed strategy / strategic option are. In addition, rigorous risk analysis can be used to establish how the strategy can be disrupted e.g. by competitors, use of technology, changes to customer expectations and/or behaviour, or changes to regulation. Risk management can also be used to support the delivery of the value case both from a volatility reduction as well as value enhancement perspective e.g. risk sharing and/or restructuring of the proposition. Finally, the impact of the proposed strategy on the Principal / Key risks and risk appetite of the business can be assessed.

Overcoming barriers

Experience demonstrates that there are many potential barriers to having side-by-side strategy and risk discussions however, some ways to overcome these are to:

• Demonstrate that better integration of risk and strategy can increase the resilience or value creation that has been anticipated or built in to the business case.
• Make explicit the linkage between increased resilience and the probability of delivering on the promises in the business case and management being rewarded accordingly
• Leverage approaches such as pre-mortem risk analysis to identify vulnerabilities (and possible future failure) in the business case and identify value creation opportunities such as adjusting the value proposition
• Create / support a culture of using risk-return trade-offs explicitly in decision-making

Conclusion

The outlook for many businesses and industries is undoubtedly challenging. However, this also represents an opportunity to take a fresh look at the way strategic options and changes to business strategy are assessed. This can lead to tangible benefits in terms of understanding and managing both volatility and uncertainty.