Strategic Risk Assessment-5/6

2010-08-03 / How to do Risk Assessment / 0 Comments

This is a series on the risk manager’s role in strategic planning. In this post I describe the unique and complementary functions of two risk methodologies: risk ID and assessment, and risk scenarios.

Risk Identification and Assessment Process

If you think about it, risk assessment is the opposite of defining a business plan or constructing a forecast. Instead of building one fragile model, and placing all of your hopes on it, you are subjecting that single model to critique from 1000 different perspectives. To illustrate:

Consider a multidisciplinary round-table review of draft plans. In risk facilitation, participants consider the plan or proposal through the filters of many criteria, such as risk categories, organizational values, and financial limits.

To identify risk systematically is a form of stress testing, not by inflating variables in a financial model by a given percentage, nor by running Monte Carlo simulations, but by challenging a hundred assumptions – namely, the ones that underlie each element of the plan or proposal.

Thoroughness is built into the process. You are mapping many minds, each with its rich personal expertise and unique point of view, through many “lenses”, all directed to the scrutiny of the plan. If you lead a structured discussion among the right participants, you will identify comprehensively all the critical business risks.

If you share, as appropriate, the resulting risk profile with proponents or stakeholders, and get their input on risk and  mitigation, it is much easier to gain consensus on a plan for action.

Risk Scenario Analysis

Now we come to how to deal with the unpredictable and the unknown. Conventional forecasting tends to tie our fate to one picture of the future. Risk ID will lose its efficacy as time frames extend into the future and uncertainty rises dramatically. Another risk methodology is called for.

In a previous post, I talked about risk scenarios, and the value of this method to pursue robustness and resilience, similar to an all-hazards approach. Pictures of the future that are both plausible and critical serve as a litmus test of draft plans. Scenarios go beyond stress testing, because they consider structural change of the underlying relationship among future forces and influences. This enriches the planning discussion, creates possibilities, and opens up the examination of the long-term feasibility of the firm.

Enterprise Risk Management will continue to demand of risk managers support for planning objectives, including strategic risk assessment for major projects in the long term. Rigorous risk ID in a facilitated session of subject matter experts, as well as future risk scenario analysis, are two essential risk methodologies.

Read More

Risk Scenario Analysis

2010-06-17 / How to do Risk Assessment / 0 Comments

It is ironic that future scenario analysis, developed famously by Royal Dutch Shell, was not used when it should have been in that very same industry. AP reported on May 06 that:

“…a site-specific exploration plan filed by BP in February 2009 stated that it was “not required” to file “a scenario for a potential blowout” of the Deepwater well.”

Risk and international business managers could take a close look at risk scenario planning as a way to grapple with black swan risk, defined here in the Barnes and Noble synopsis of Nassim Nicholas Taleb’s book:

“an event, positive or negative, that is deemed improbable yet causes massive consequences.”

Doesn’t that definition, by the way, assume that you were able to at least identify the risk before deeming it improbable? Perhaps the true black swan risk is the one that broadsides you altogether. In any case, the value in future scenario planning is that it sidesteps the necessity to predict. It does not depend upon forecasting.

We all know business continuity scenarios are not like conventional risk management, not only because they deal specifically with disaster and emergency risk, but also because they focus on mission-critical functions, and often take an all-hazards approach. There will be significant areas of overlap in plans to address several different perils.

Similarly, risk scenario analysis is interested in resilience, and starts from a consideration of a core mission. You define the trends with the most significant influence upon that mission, and then create extreme – but plausible – scenarios. The advantage is that you are not relying on one narrow prediction or forecast. You have instead rich scenarios that present conditions that challenge your organization’s survival in different ways.

The team can then plan pre-event treatment, and adjust its plans to meet difficult conditions in something like an all hazards approach.

Risk practitioners point out another advantage to future scenario analysis. It permits a freer discussion than is normally held to identify essential business functions, assets at risk, types of threats, and the longevity and relevance of the organization’s very mission. For example, if the team determines that, in three out of four future scenarios, shifts in industry practice, business models and technology would likely render the core business obsolete, they might well re-evaluate their strategic direction.

I have put in a proposal to RIMS to develop another risk assessment online course [update: Creating Value: Risk Manager as Innovator — up and running], in which I would include a module on risk scenario analysis, using the future scenario planning model.

Read More