Managing strategic risk: a new partnership between the board and management

Managing strategic risk: a new partnership between the board and management

James L. GoodfellowDeloitte partner specializing in the roles and responsibilities of directors (jgoodfellow@deloitte.ca).

Michael E. Raynoris a Director in Deloitte Research based in Toronto (mraynor@deloitte.ca). He is the co-author of The Innovator's Solution: Creating and Sustaining Successful Growth (Harvard Business School Press, 2003).

The widely publicized legal or financial difficulties of such highly-visible corporations as Enron, WorldCom, Xerox and a number of other large firms caused shareholders and regulators to demand that all companies manage risk more effectively. As executives and boards of directors scramble to meet new regulatory mandates, the spotlight is on applying financial and operational risk management tools. Although these are important from a compliance point of view, we believe that the main cause of some of the most noteworthy corporate debacles wasn't vulnerability to financial or operational threats. Rather, it was the absence of the effective management of strategic risks.

For example, according to prosecutors, criminal schemes hatched by top executives sank Enron. While the courts work their way through the charges, we ask a larger question: why would senior executives be in a position where cooking the books seemed the most attractive way out of a crisis? And why would a board be unaware that the company was at risk of finding itself in a corner so tight that executives would decide law breaking was their best recourse?

The root problem is the inability to properly articulate and evaluate strategic risks by corporate leadership – both top management and the board. In Enron's case, the plan to become a market maker in newly deregulated commodities rested upon critical assumptions about the future – for example, that their aggressive strategies to profit from deregulation would flourish. But risks such as those pertaining to the continuation of a trend in government policy – in this case, deregulation – are of a type that cannot be addressed by the tools designed to cope exclusively with financial or operational risk. Illegal actions and cover-ups are inexcusable, and any failures of financial and operational risk management mechanisms are of grave concern, but it is imperative that we also recognize the ultimate importance of risks involving strategy.

There is a way forward that addresses this need without undermining the traditional and proper roles of executives and board members. It does, however, require boards to address "who should do what" in the governance of risk, and how this governance should be performed.

The current responsibilities of the board include explicitly assuming responsibility for the stewardship of the corporation, which includes responsibility for the adoption of a strategic planning process, the identification of the principal risks of the corporation's business, and ensuring the implementation of appropriate systems to manage these risks.

This guideline puts the focus on the board, but not board committees. Current proposals, such as those put forward by the New York Stock Exchange, are pushing the audit committee further into the arena of risk management oversight. As a result, sorting out "who is responsible for what" between the board and its various committees is an important exercise for all boards to undertake.

Effective governance of strategic risk needs to exploit the key capabilities of each party – management's detailed insight into the company and its industry, and the board's broad perspective. We recommend a three-stage process whereby a company can both develop strategy and control strategic risk, with the relative influence of management and board varying according to the requirements of each step (see "A new partnership between the board and management").

Stage 1: Formulating strategy. Management deserves the lead role here because it best knows the organization's capabilities and opportunities. Board members should not be expected to second-guess management's judgment regarding strategy.

However, in the wake of recent collapses, many have called for the board to do something, and in the absence of any meaningful alternatives, the near-universal prescription has been for greater board involvement in setting strategy. This has aggravated the current crisis in corporate governance because it creates a nonsensical situation: transferring responsibility for crafting strategy from well-informed, full-time managers to part-time board members. It is not a trade any rational stakeholder would make.

Stage 2: Identify and assess risk. At this stage, the board and management should work together as equals in identifying and assessing the risks associated with pursuing a given strategy. In energy trading, for example, the success of a "market-making" strategy might be the continued spread of a particular kind of deregulation. In a case where a strategy involves global expansion, the key could be foreign market access and predictable exchange rates. The success of an innovation-based strategy could turn on patent or copyright protection and an expansionary macro-economy.

A new partnership between the board and management

The key to managing strategic risk effectively is recognizing the different roles of management and the board. Management should take the lead in formulating strategy. Directors and executives should collaborate closely in determining the nature and extent of risks attendant to pursuing a given strategy. It falls primarily to the board to determine the appropriate risk/return trade-off for the corporation.

Management's in-depth knowledge is critical to assessing the relevance and impact of key variables. For its part, the board is well equipped to perform a broad inquiry that goes beyond the boundaries of established company and even industry norms. A collaborate process that combines these complementary capabilities is essential to the effective management of strategic risk.

Stage 3: Assessing risk/return trade-off. The third stage of strategic risk management requires that the board take the lead in deciding the appropriate risk/return trade-off. We feel the board should be the leader here because it is the board's fiduciary responsibility to determine which risks are "worth running" and which should be mitigated or avoided altogether. If the board judges that management's proposed strategy entails too much risk, management must find ways to reduce that risk. This requires a new way to think about strategy, for the traditional tools for managing financial or operational risk are not up to the task[1].

How would this work in practice? As an example, a strategy premised on rapid expansion runs the risk of over-extending a company's resources on an unproven concept. Risk can be mitigated by expanding less aggressively, thus ensuring that the venture is workable before fully committing the firm – or by abandoning the expansion program if unfixable problems come to light. This entails a cost – first-mover advantages could be compromised, since competitors will have more time to observe and respond. But making the trade-offs between risk and return define the responsibilities of directorship.

Though this three-stage process should go a long way toward clarifying risk, not every strategic initiative, or even every company, will succeed. Failure is an unavoidable part of business competition, but strategic risk is not unmanageable. So it would be a mistake to see the recent rash of collapses, bankruptcies, and financial restatements as merely an outbreak of mendacity or malfeasance that can be dealt with by stricter laws. The plethora of new regulations introduced to curb corporate scandals, however, will likely have little impact on a company's ability to identify and manage strategic risk. Management and boards must obviously play by the new rules like Sarbanes-Oxley, but they must also clarify and practice progressive roles regarding strategy formulation and strategic risk management. Only when this task is integrated into the best practices of board governance can stakeholders breathe easier.

Note1. For a discussion of the shortcomings of existing approaches and a proposed alternative, see Raynor, M.E. (2004), "Strategic flexibility: taking the fork in the road", Competitive Intelligence, Vol. 7 No. 1, pp. 6-13.