The single thread in nearly all of these cases is simple — the conditions changed and the organisation failed to keep pace with that change.

When thinking about the most significant business risks facing an organisation, failing to keep pace with change is the biggest. It outstrips anything on your risk register. It is a death sentence waiting to happen.
In some cases the decline will be rapid, but in many cases, without a big intervention it will be slow and painful. Other risks will hurt; they may cause embarrassment, legal recourse, short-term financial loss, or the loss of a few executives, but they probably won’t kill the organisation.

The most recent analysis from the ASX Corporate Governance Council tells us that 95% of the ASX 200 companies believe they have the systems in place for their boards and management to be across their most material business risks.

In reviewing the risk reports from of a range of organisations, we see that the most material business risks — the risks arising from external change — are often not explicitly stated or well understood.

In part, this is due to narrow time horizons used in framing their risk assessments. In part, this arises from being unable to distinguish weak from strong signals. In many cases, it’s an inability to think beyond business as usual.

Often, the only way to tackle a strategic risk is to take a big risk and change course. Many organisations shy away from this and, in doing so, will end up on the scrap heap.

While it is risky to change and adapt, not hedging your bets is even riskier.

Ironically, for many organisations, a conservative approach to risk in the short term is likely to be the greatest risk of all.

Three questions you should ask:

• What could cause our business model to be defunct or unviable?
• What weak signals do we need to be paying attention to today?
• What risks are apparent now which could take several years to unfold?

This article first appeared in the December 2011 edition of Risk Management Today.   Part two of this article is linked below.

2012 Prophecy – The End of the Industrial Age

To subscribe to this series of occasional articles and case studies, please click here.

About 12 months ago I wrote the feature article for the Institute of Internal Auditors’ global e-zine on the top 10 risks for 2010.

I received an email this week about the article which prompted me to have a look back at what I’d said, and also some of the comments which had been made in response.

My focus at the time was on ‘strategic risks’ a risk category which is often not focused on because they are hard to pin down. These risks tend to move from inconceivable to possible and probable moving quickly on your risk matrix over time and with increasing consequence. And as these things are often unprecedented, its often not clear how these will manifest themselves. As such, some of my top themes tended to be underlying drivers rather than specific risks which can be put in clear focus.

I’ve been talking and writing about this area – strategic risk, black swans, emerging risk, risk foresight and unknown unknowns for a few years now. This has led me down a range of paths including working with futurists, former futurists, board members, CRO’s, CAE’s, and even being on a debating team with people from the WEF’s global risk team. The results of this work can be confronting, particularly as it often challenges fundamentals and norms that we’ve taken for granted during the latter phases of industrialisation.

The human response

What has become more interesting and evident to me over time hasn’t just been the risks specifically but the usual responses I normally get when pointing out some of the big strategic risks as I see them:

1. These risks are not present today, and I’ve got bigger things to deal with in the near term, so please don’t waste my time with this lala land stuff (fair enough, but risk is a business of uncertainty rather than certainty)
2. I don’t believe these risks are going to manifest during my tenure, and they’re not in my role description or KPIs, so they’re not my problem (fair enough, this is not easy stuff to deal with, but raises some issues)
3. You’re right, there are some blind spots, and thanks for pointing some new ones out so I can find out more. (Ureka!)
4. Yes, I agree, and here’s some YOU’VE missed. (Very exciting, let’s talk)

My work is deliberately focused working with people in category 4 and sharing what I learn with those in category 3. In my view, these are the people who will avert massive destruction in shareholder value and create competitive advantage and possibly even market strength as a by product.

Where does strategic risk capability lie? Where should it lie?

Thematically with some notable exceptions, the greatest capability in being across strategic risks seems to lie at the board. Management, risk management and internal audit are mostly focused in the day to day. Their tenures often don’t align with the unfolding nature of these risks over time, whereas ultimately these will come home to roost with the board. This means a good board, and a diverse and well networked board with varied experiences and world views is key, and has been the basis of my arguments for board diversity including but beyond gender.

The challenge is when risks emerge which are not within the experience of the board, possibly because these risks are unprecedented. This is when risk forecasting capabilities are essential to avoid blind spots, which has been the crux of my argument since the GFC. Simply if organisations don’t have this capability in house, boards need to get someone in occasionally to challenge the organisation’s thinking on strategic risks and risks which will manifest themselves beyond the CEO’s tenure.

So how did the crystal ball do?

It is worth looking back to see how the top 5 themes list fared 12 months later with the benefit of hindsight, some of which were refuted by some who commented on the article. Here’s a few thoughts.

1. Energy prices. Forecasters are saying we’re still 12 months away from $100/barrel, but this week world leaders are leaning on OPEC to increase supply to try and postpone the rise. Coal prices are increasing quickly. Governments are strategically positioning around energy security as they understand the consequences to be catastrophic. This continues to be one to watch.
2. Industrialised world atrophies while the emerging economies grow. There are clear signs of this. Have a look at the Europe vs China story.
3. Population pressures and constraints on commodities. Notice that the resource companies are the ones driving economic growth in the developed world over the past 12 months? Seen what’s happening with food prices lately, and why Canada and Australia are now economies and currencies of preference in the developed world?
4. Structural currency rebalancing? Yes, many were in denial on this one, but I’m very happy that I advised my clients to unwind their exposures to certain currencies. The consequences for them would have been more than material and in some cases catastrophic leading to a crisis of confidence in management and the board, with potential knock on effects into the broader community.
5. Climate change. Sure, I’ll agree, not a risk in itself, but on at least half of the boards and audit and risk committees I sit on, it’s a key driver which those organisations will need to deal with creatively if they are to keep achieving at the rate they’re used to.  And although not yet mainstream, there are some disruptive innovators doing some things in carbon markets which previously were unheard of.

So in some of these risks resulted in a material impact for some organisations, industries and countries. Some did not. But it’s fair to say that all five themes did drive changes in the risk profile, and are increasing in likelihood and impact.

Final thoughts

I guess all of this raises a philosophical question about who should be responsible for keeping an eye on strategic risk. In my experience the board and independent risk committee tends to do okay at it, but management is very much immersed in delivering this year’s plan. Taking your eye off these can be devastating. We’ve seen too much of this as I’ve written and spoken about many times.

At the time of the article, the internal audit profession was positioning itself to provide assurance over the risk frameworks and risk reporting of organisations. This article introduced a few ideas on what this actually means, including the provisions of Principle 7 of the ASX Corporate Governance Principles in relation to material business risk. For me, internal audit’s role is to see whether this emerging risk capability is in place and working well. If it isn’t internal audit has an obligation to let the most senior people in their organisation know, including the board.

I hope this has stimulated debate, including people who don’t agree with me, and if it has, then this has been very worthwhile. I’d love to to rekindle the debate, including from those who believe these risks are right, and those who still think it’s all a bit fluffy.

The original article and space for comment can be found here: http://www.theiia.org/intAuditor/free-feature/2010/february/a-look-ahead-top-risks-for-2010/index.cfm

For those who are keen to find out more, I’d also welcome people to trawl my archives of articles, papers, presentations and video on the topic and join the mailing list for future updates.  Where available, these are on this site free of charge.

To subscribe to this series of occasional articles and case studies, please click here.

Insanity is doing the same things over and over and expecting different results.

Albert Einstein

Thanks to Lexis Nexis for making my most recent article available from the current issue of Risk Management Today to my clients and readers.

The editorial panel was asked to cast their mind back to the most significant risk events over the last 12 months. For mine it was a thematic observation that despite strategic risk being the risk class which causes the greatest long term destruction and creation of shareholder value, it the class of risk most poorly handled. There are many reasons for this, but perhaps the greatest is that these tend to be slowly unfolding events over multiple years and therefore tend to not grab our attention in the same way that a sudden shock does.

The good news is that this risk class is starting to get the attention of the mainstream at the big end of town. The bad news is that there are many spruikers who are apparently suddenly well equipped to deal with this class of risk. My assessment is there’s very little substance to much of what’s on offer. This article offers a festive perspective and (hopefully) a little humour to a serious topic as well as a few pragmatic suggestions on how to get on top of this important risk class.

I hope you enjoy it as a light read during the quiet period and I look forward to catching up with you in the new year.

Key points

• ASX Principle 7 requires a focus on material business risks rather than being swamped by process. At the time of drafting the current Principles, the Corporate Governance Council was concerned that companies were being dragged into the minutia by risk processes rather than using them for strategic insights. From a shareholder perspective it seems their concerns were correct.
• Most risk assessments work on the assumption that all things remain the same. The biggest risk of all is that all things don’t remain the same. This is where black swans often are hiding.
• Here’s a bunch of things to think about over the Christmas break.

Please feel free to download the article and pass it on. (Risk Management Today Issue 6 -Black swans, 3 pages, 132kB)

More information on this publication can be found here.

Seasons greetings,

Todd

To subscribe to this series of occasional articles and case studies, please click here.

As the developed world pulls itself away from the abyss of the global financial crisis, many around the globe are breathing a sigh of relief. Having dodged a major bullet, organizations are now returning to business as usual. But if the crisis was a wake-up-call for the world, did business leaders and internal auditors pay attention or just hit the snooze alarm? What’s the next “black swan,” or significant unforeseen risk, and what should internal auditors be doing about it?

In this free feature from IIA’s global magazine, Todd summarises several key areas should be on all company watch lists for 2010 and beyond.

http://www.theiia.org/intAuditor/free-feature/2010/february/a-look-ahead-top-risks-for-2010/

To subscribe to this series of occasional articles and case studies, please click here.

Risk and Responsibility (AHAUCHI Conference, September 2009)

[Streaming video: YouTube - 3 parts, 22 minutes total]

Presented as part of a three day strategy and leadership conference on the future of residential colleges, Todd Davies provides insights into the nexus between governance, leadership and risk, and provides a whole systems perspective into regulatory reform, avoiding the next GFC and the future of leadership on these dimensions.

A Leader’s Responsibility: Governance, Risk and Resilience (AHAUCHI Pre-conference, August 2009) [Streaming and downloadable audio: Resilientfutures.org - 1 part, 26 minutes total] As part of the lead up to the AHAUCHI sessions, Todd discusses the new context for the governance and risk responsibilities of leaders, especially directors and managers; the breakdown of conventional methods of risk and governance management in dealing with these conditions; the consequences of such a breakdown; new processes for more realistic governance, risk and resilience.

The Real Risks of Business as Usual  (Resilient Futures Forum event – “Planning for Growth: Water? Climate Change? Economic Shocks?, August 2008)

[Streaming and downloadable video: Resilientfutures.org - 1 part, 15 minutes total]

This is essential viewing for anyone in a governance, leadership, assurance or strategy role in a large organisation – corporate or government. This presentation is particularly timely given current conditions, increasing market turbulence, and the move by stock exchanges and regulators around the world who are beginning to expect CEOs and Boards to have a strong understanding of ‘material business risk’, and hence strategic risk.

There is also a lot of great material on the resilientfutures.org website and their Youtube channel.  If you are interested in understanding the future, complexity and the challenges and opportunities arising from this, these sites are well worth a look. Enjoy. TDA

To subscribe to this series of occasional articles and case studies, please click here.

As part of their ongoing roles, Directors and CEOs need to have a deep understanding of the strategic risks and opportunties facing their organisations.  Increasingly they are looking to their internal audit team for a view on whether their company’s risk management systems are adequate, and complete which needs an understanding of strategic risk as well as traditional areas of compliance, reporting and operations.

Strategic risk management is an area which is vital to the long term prosperity and performance of any organisation, yet it is an area which is not well understood or applied.  While auditors and managers are often comfortable with operational, reporting and compliance risk, it is often strategic risk that leads to material and irreversible business disruption. Internal audit teams are now expected to have an understanding of strategic risk and evaluate their organisation’s capabilities in this area as emphasised in Principle 7 of the ASX Corporate Governance Principles & Recommendations.

As part of the Institute of Internal Auditors ongoing work to enhance the capabilities of their members they have engaged TDA to facilitate a series of half-day public courses on strategic risk.   The course covers strategic risk as a distinct segment on the COSO framework, sources of strategic risk, strategic risk capability and a range of concepts to help understand and assess strategic risk.

Developed for Chief Audit Executives, by the end of this course, participants should be able to:

• Differentiate strategic risk from other risk types in the overall risk universe
• Recognise how strategic risk manifests itself
• Assess their organisation’s ability to identify, assess and manage strategic risk
• Identify areas of strategic risk vulnerability in their organisation
• Interact confidently with those responsible for leadership in this area.

Dates for the rest of the year are:

Melbourne: Thursday, September 10 2009

Perth: Friday, September 25 2009

Sydney: Friday, November 6 2009

For more information go to the Education & Events section of www.iia.org.au or call the IIA on (02) 9267 9155.

If you are not an internal auditor and would like a briefing session for your organisation, please contact us at info[at]todddavies.com.au or contact Todd on (0) 422 000 913.

To subscribe to this series of occasional articles and case studies, please click here.

The length and extent of debate was extensive ranging from the structure of the financial system, through to regulatory structuring, regulatory arbitrage, global regulatory frameworks, rules vs principles vs supervision and enforcement, Australia’s twin peaks and quadruple peaks model, ESG and a range of other useful debate, as well as the old chestnuts of shareholder input into executive remuneration.

I was encouraged by comments early in the meeting by Jules Muis, former Vice President and Controller of the World Bank saying that there are really only two key issues which need attention – strategic risk and systemic risk, and if we can get accountability for assessing and managing these at different scales, then we will be set for success in the future.

Lindsay Tanner, Federal Minister for Finance explained that conditions had changed and global markets can only be regulated through global coordination, while Anne Simpson, from CalPERS representing one of the largest pension funds in the world told us simply, that “we needed more joined up thinking”, eluding to the need for a wholistic, multi-faceted approach to systems thinking.

Al Gore reminded us that “we often confuse the unprecedented with the unlikely”, and Professor Mervyn King SC reminded us that “companies do not operate in a vacuum.”

Despite this sage counsel that we need an approach which allows us to think properly about strategic and systemic risk, and predict the “unprecedented but increasingly likely”, unfortunately these threads were not actively picked up, perhaps because this is an area which is not yet well understood.

In the area of risk management, boards are concerned about false comfort in risk systems – whereby companies hire a small army of risk experts who go away and implement risk frameworks such as COSO ERM, A/NZS 4360 or ISO 31000, and assure them that everything is okay, that their risk systems are sound, and the board and management can sign off.

The problem of course is that while routine bottom-up approaches to compliance, operational and reporting risk are good at managing the bread and butter of businesses, it’s rarely these areas which cause the material problems. Despite strategic risk and systemic risk now starting to be recognised globally by policy setters as the daddy of them all, people don’t have the capabilities in place to understand what these are, let alone manage them. Intuitively, boards know this.

The result is that a significant proportion of companies which experienced significant value destruction and earnings surprises in the last 18 months came out with the standard rhetoric “no one could have seen this coming”, leading to an inference that either the risk systems are not as we’ve been told (deceptive conduct) or the boards were incompetent (negligence).

I’ve been giving briefings and training on these areas internationally, including in public fora around Australia and the United States in order to help companies govern responsibly. In my mind, strategic and systemic risk are the elephants in the room which are still being overlooked and not understood.

I asserted in a public session at the meeting in front of some of Australia’s leading directors and experts that it might take someone to launch a class action in a move to get traction on this issue. After the session, one of the leading shareholder class action lawyers from New York suggested to me that being his expert witness could be very lucrative in the short term as long as I had no intention of ever being employed again, and perhaps I should stick to helping companies rather than suing them.

In Australia, internal auditors are being asked to give advice to boards on whether their company’s risk management framework is effective, and whether the risk profiles prepared by management give a true and complete picture. The advice I’m giving my clients is that if the organisation doesn’t have good capabilities around strategic and systemic risk, then the answer has got to be no, and therefore their public statements on this issue have to be qualified.

In an effort to raise awareness of strategic risk internationally, I’ve been speaking in public fora around Australia and the United States as well as through the Resilient Futures Network (RFN). The good news is that I’ve been getting traction with industry associations, community groups, pension funds, boards and large companies… and we’re beginning to prove that strategic risk doesn’t have to be difficult as long as you’ve got a good model and a diversity of perspectives (thanks to the RFN for their involvement with that).

If you’re an internal auditor trying to get your head around this, the Institute of Internal Auditors in Australia is running half-day training workshops on this topic nationally, which means you can get your head around this and bank some CPE credits at the same time. If they aren’t running near you, or if you want to run a session in-house, get a group together and The IIA will be happy to organise these.

If you’re a non-executive director and want to find out about the strategic risks which aren’t on your radar and should be, I’d be happy to give you a briefing. Please feel free to watch this primer and get in touch.

Todd

Todd Davies & Associates
Specialists in strategy, governance and step change

Web: www.todddavies.com.au
Email: todd@todddavies.com.au
Tel: +61 (0) 422 000 913

To subscribe to this series of occasional articles and case studies, please click here.

To see the rebuttal, have a look at page 3 of the July edition of Risk Management Magazine here.  And to see the original article which caused the contraversy, click here for page 3 fo the June edition.  (Now locked down, here’s the web version).

For more information on how strategy, risk, governance and assurance come together, please click here.

To subscribe to this series of occasional articles and case studies, please click here.

Success is a lousy teacher. It seduces smart people into thinking they can’t lose.  Bill Gates

Most managers feel well equipped to understand and respond to the regular crises that emerge day to day in the business as usual environment. Risk management processes have permeated most organisations which give middle management a sense of comfort that they have things broadly under control.

But those who read the financial press will be aware of emerging state changes which are not picked up by their normal risk management processes.  As such, Directors and Chief Executives reviewing their risk profiles often feel that all of this effort in risk management is missing the big picture.

Emerging risks are known by many names.  Strategic planners call them external shocks.  Resilience practitioners call them discontinuities.  Risk practitioners call them strategic risks.  Economists call them corrections. Taleb calls them Black Swan events.  Greenspan calls it the age of turbulence.

Whatever you call them, an understanding of emerging strategic risks is critical to leading any organisation.

We have a habit of confusing the unprecedented with the unlikely.  Al Gore, Sydney Hilton, July 15, 2009

Todd Davies & Associates draws on a broad range of experts from a range of fields to provide briefings, training and advisory services on:

• Making sense of emerging and interconnected structural shifts, and how to turn these from strategic risks into strategic opportunities
• Making sense of unprecedented risks which are becoming increasingly certain
• Detailed briefings on each of these structural shifts
• Assessing and developing the capabilities in organisations to assess strategic risk on an ongoing basis.

To find out more, call Todd on 02 9043 1719, or email us to arrange a meeting.

What our clients are saying

“We brought Todd Davies in to conduct the “Understanding Strategic Risk” training sessions and they proved to be very worthwhile. Our audit staff appreciated the insights into sources of strategic risk from a local to a global level. No less than six methods of developing strategic capability were discussed providing something for everyone dependent upon your methodology, fit and preferences. Sound value.”  Allan Reidy | Head of Westpac Retail & Business Banking and Product & Operations Audit, Westpac Banking Corporation

Find out more first

Watch a 15 minute video presentation from Todd on gaps arising from typical risk management processes

Listen to a 25 minute audio interview with Todd on some of the key issues for leaders today

Read a brief article on strategic risk and how this fits in with regulation and standard setting

To subscribe to this series of occasional articles and case studies, please click here.

I’m really pleased to announce that the Resilient Futures website went live today.

Resilient Futures was formed in April 2008 as a result of a number of practitioners in various fields believing that the current thinking in their respective professions was inadequate in dealing with the problems of tomorrow, and that resilience thinking and the concepts underpinning it provide much needed clarity in a rapidly changing interconnected world.

The Resilient Futures partnership consists of a divergent practitioners in strategy, risk, urban planning, leadership development and networked systems.  There is a range of innovative but practial thinking coming out of this one and I encourage you to have a look around, read a few articles, download a whitepaper or two, and subscribe to the RSS feed.

I particularly encourage you to have a look at my recent article Are you being a reckless leader without realising it? which gives a feel for where some of the thinking is heading, or our offering on emerging risk analysis here.

Resilient Futures can be found at www.resilientfutures.org.

To subscribe to this series of occasional articles and case studies, please click here.