Lecture 7: Risk Management in Strategic Management

Introduction to Risk Management in Strategic Management

• Definition of risk and its relevance in strategic decision-making
• Distinction between uncertainty and risk (Knight, 1921)
• The role of risk management: Mitigating negative impacts while maximizing opportunities
• Why risk is central to strategic management — changes in markets, technology, and global challenges
• The connection between strategy and risk, and the need for adaptability in decision-making

Key terms: Risk, Uncertainty, Risk Management

Key Steps in Risk Management for Strategic Decisions

• The risk management process consists of identification, assessment, mitigation, and monitoring
• Risk identification locates potential challenges and opportunities
• Risk assessment involves analyzing the likelihood and impact of identified risks
• Risks are categorized as internal or external to the organization
• Monitoring ensures an adaptive response to evolving risks

Key terms: Monte Carlo Simulation

Risk Assessment Techniques: Tools and Frameworks

• Risk assessment combines likelihood and impact into a structured evaluation
• Classic frameworks: Risk matrix, heat maps, and the Failure Mode and Effects Analysis (FMEA)
• Heat maps visualize risks by plotting probability versus impact
• Quantitative techniques: Expected monetary value (EMV), probability-impact grids
• Scenario analysis helps evaluate potential strategic decisions under uncertainty

Key terms: Risk Matrix, Expected Monetary Value (EMV)

Business Continuity Planning: Frameworks and Implementation

• Definition: Ensures an organization can continue core operations amid risks
• Key Elements of Business Continuity Plans (BCPs): Risk analysis, recovery strategies, communication plans, training/testing
• Business Impact Analysis (BIA): Identifies critical functions and their dependencies
• Recovery Time Objective (RTO) and Recovery Point Objective (RPO): Key metrics for recovery planning
• Standards and Guidelines: ISO 22301:2019 for Business Continuity Management Systems (BCMS)

Key terms: Business Continuity Plan (BCP), Business Impact Analysis (BIA), RTO and RPO

Scenario Analysis: Preparing for Uncertainty

• Definition: A method to assess the impact of different hypothetical future scenarios
• Focus on 'What if?' questions to evaluate preparedness for risks
• Enables strategic decision-making under uncertainty by highlighting potential outcomes
• Steps involve identifying driving forces, defining key variables, and outlining plausible scenarios
• Tools such as Monte Carlo simulations and decision trees enhance analysis

Key terms: Scenario Analysis, Monte Carlo Simulation, Decision Tree

Strategic Flexibility: Adapting to Change

• Definition: The ability to remain adaptable amid rapidly shifting conditions in the business environment
• Key principle: Balancing commitment with adaptability to adjust course when risks materialize
• Dynamic Capabilities Framework (Teece, Pisano, and Shuen, 1997): Sensing, Seizing, and Transforming
• Importance of contingency plans for quick pivoting in uncertain situations
• Real-world application: Agile methodology as an operational model for flexibility

Key terms: Strategic Flexibility, Dynamic Capabilities Framework, Agile Methodology

Quantitative Tools for Risk Management: Expected Monetary Value (EMV)

• Expected Monetary Value (EMV) helps quantify risks and make data-driven decisions.
• EMV is calculated by multiplying each risk's probability by its monetary impact and summing up the values.
• EMV = Σ (Probability of Outcome × Monetary Impact).
• Positive EMV suggests potential opportunities, whereas negative EMV signals potential risks.
• Best used in decision trees for evaluating multiple strategic choices.

Key terms: Expected Monetary Value (EMV)

Risk Appetite Frameworks: Defining Tolerance Levels

• Risk appetite defines the level of risk an organization is willing to accept in pursuit of strategic objectives.
• Risk tolerance is the acceptable variation in performance outcomes relative to risk appetite.
• Articulating risk appetite helps align strategy and operations with organizational values and stakeholder expectations.
• Tools like the COSO ERM 2017 framework guide organizations in clarifying and applying risk appetite effectively.
• Visual tools like risk heat maps graphically represent risks relative to predefined thresholds.

Key terms: Risk Appetite, COSO ERM (2017)

Decision-making Under Uncertainty: Decision Trees

• Decision trees graphically model outcomes of decisions under conditions of risk and uncertainty.
• Allow visualization of decisions, chance events, and potential outcomes.
• Each branch represents a possible decision or a subsequent event, with assigned probabilities and payoffs.
• Uses bottom-up calculation (from end branches back to the root) to identify the optimal path.
• Integrates risk assessment techniques like Expected Monetary Value (EMV) and sensitivity analysis.

Key terms: Decision Tree Analysis

Introduction to Risk Monitoring and Response Strategies

• Risk monitoring ensures that identified risks are tracked continuously throughout implementation.
• Response strategies address risks when they occur or to mitigate/prevent potential escalation.
• Key methods include risk audits, performance reviews, and regular variance and trend analysis.
• Common response strategies: avoidance, mitigation, transfer, and acceptance.
• The balance between proactive mitigation and reactive management is critical for strategic success.

Key terms: Risk Monitoring, Risk Response Strategies

Enterprise Risk Management (ERM): An Integrated Approach

• ERM integrates risk management across departments, ensuring a cohesive strategy company-wide.
• Frameworks like COSO ERM (2004, updated 2017) help firms align risk appetite with strategy.
• ERM addresses strategic, operational, financial, and compliance risks holistically.
• Focus areas: identifying interconnected risks, balancing risk-taking and risk-reduction activities, and upholding stakeholder trust.
• Tools include risk heat maps, dashboards, and cross-functional workshops.

Key terms: Enterprise Risk Management (ERM), COSO ERM Framework

Real Options Analysis: Dynamic Decision-Making in Uncertain Environments

• Real options provide 'choices' under uncertainty, much like financial stock options.
• Strategic flexibility is maintained through decisions (e.g., defer, expand, abandon).
• Mathematical evaluation methods include Black-Scholes and Binomial models.
• Real options let firms evaluate investment or abandonment timelines based on external triggers.
• The approach uncovers hidden value in projects typically dismissed under static NPV frameworks.

Key terms: Real Options, Black-Scholes Model

References

• Knight, F.H. (1921) Risk, Uncertainty, and Profit. Boston: Hart, Schaffner & Marx.
• Damodaran, A. (2008) Strategic Risk Management: Approaches and Models. NYU Stern School of Business.
• Hubbard, D.W. (2009) The Failure of Risk Management: Why It’s Broken and How to Fix It. Hoboken: Wiley.
• Hillson, D. & Hulett, D. (2004) Project Risk Management: Principles and Practices. Boca Raton: CRC Press.
• Kerzner, H. (2017) Project Management: A Systems Approach to Planning, Scheduling, and Controlling. 12th edn. Hoboken: Wiley.
• ISO (2019) ISO 22301:2019 Security and resilience - Business continuity management systems - Requirements.
• Smith, N. and Sipika, C. (1993) 'Back from the Brink: Post-Crisis Management', Long Range Planning, 26(1), pp. 103-112.
• Wack, P. (1985) 'Scenarios: Uncharted waters ahead', Harvard Business Review, 63(5), pp. 73-89.
• Courtney, H., Lovallo, D. and Clarke, C. (1997) 'Deciding how to decide', Harvard Business Review, 75(6), pp. 65-79.
• Teece, D.J., Pisano, G. and Shuen, A. (1997) 'Dynamic capabilities and strategic management', Strategic Management Journal, 18(7), pp. 509-533.
• Rigby, D.K., Sutherland, J. and Takeuchi, H. (2016) 'Embracing Agile', Harvard Business Review, 94(3), pp. 40-50.
• PMI (2017) A Guide to the Project Management Body of Knowledge (PMBOK® Guide). 6th edn. Newtown Square, PA: Project Management Institute.
• Hubbard, D.W. (2009) The Failure of Risk Management: Why It's Broken and How to Fix It. Hoboken, NJ: Wiley.
• COSO (2017) Enterprise Risk Management – Integrating with Strategy and Performance. AICPA.
• Kaplan, R.S. and Mikes, A. (2012) 'Managing Risks: A New Framework', Harvard Business Review, June 2012.
• Hubbard, D.W. (2020) How to Measure Anything in Cybersecurity Risk. 2nd edn. Wiley.
• Savage, S.L. (2002) The Flaw of Averages: Why We Underestimate Risk in the Face of Uncertainty. Wiley.
• Hillson, D. (2016) Practical Project Risk Management. 3rd edn. Boca Raton, FL: CRC Press.
• PMI (2017) A Guide to the Project Management Body of Knowledge (PMBOK Guide). 6th edn.
• COSO (2017) Enterprise Risk Management: Aligning Risk with Strategy and Performance.