Description
CFO Insights
Facing (and embracing) strategic risks
Risk management has undergone a refocusing in recent
years in an attempt to make its techniques and processes
more adaptable to shifts in business and the economy, and
more responsive to the demands of C-suite executives.
And those same executives, including CFOs, are finding
that by focusing on strategic risks, they are better
equipped to identify what could undermine their future
business, adapt to new challenges, and take advantage of
emerging opportunities.
The challenge is us
Part of the trouble many organizations have in navigating
strategic risks is inevitable; organizations are populated
by humans, and human thinking is inherently flawed.
The growing discipline of behavioral economics has
shed light on just how hard-wired humans are for some
key cognitive biases that tend to keep executives from
seeing the strategic risks that may be on the horizon. For
example:
What exactly are strategic risks? In short, they are the risks
that threaten to disrupt the assumptions at the core of
an organization’s strategy. Think everything from black
swans to political upheavals and financial crises, as well
as new technologies that can render a business model
obsolete. When asked to name specific risks that will
impact their business strategy over the next three years,
C-level executives surveyed by Forbes Insights on behalf
of Deloitte Touche Tohmatsu Limited (DTTL) ranked pace
of innovation (30%) and increased regulation (30%) as
the main ones, but many reported not fully applying their
risk sensing capabilities to strategic risks (see sidebar, “Risk
sensing underutilized for strategic threats”).1
The overconfidence bias convinces us to trust our gut
when we shouldn’t, and makes us unable to calibrate the
limits of our own knowledge.
We don’t know what we don’t know, and we overestimate the truth of what we believe. Often hard to spot and manage, strategic risks typically do not respond to traditional risk management approaches, such as hedging or mitigation. Since such risks can also point to an organization’s next opportunity, that forces executives to make a choice: “Are we going to try to resist this, avoid it, and push it off if possible? Or are we going to embrace it as an indicator of where the market is going and where our next big opportunity may be?” In this issue of CFO Insights, we’ll discuss the barriers to recognizing and responding to strategic risks and outline some of the tools available to help harness them. The availability bias encourages us to inflate the importance and likelihood of things we saw or read recently, giving us a distorted view of what is really important. The confirmation bias causes us to pay more attention to information that fits what we already believe while discounting information that may contradict what we currently believe. And perhaps worst of all, the optimism bias fools us into thinking that nothing bad will happen and all our plans will work out as we intend.2 1 . These and other biases can cause companies to misunderstand the likelihood of events that could reshape their businesses and confound their ability to respond to them. And if biological and cognitive biases don’t present enough barriers, some common organizational constraints—everything from poor internal communication to bureaucracy and groupthink—may conspire to prevent executives from making the choices they’d like to make with the kind of clarity they’d like to have. Tools for risk detection For these and other reasons, spotting strategic risks is tough, but increasingly valuable as many forward-looking companies attempt to connect risk more closely with strategy. They understand that every strategy, every strategic choice, carries risk. Moreover, having the ability to scan and monitor strategic risks on an ongoing basis and create regular, high-quality reporting can create a competitive advantage going forward. That’s because strategic risk management can also point to the next horizon.
Consider the automotive industry. Five or six years ago, that sector was just detecting the emergence of car sharing. Now, sharing cars is accepted not just in urban areas, but also increasingly in suburbs, and many companies are embracing the concept. They are using the strategic risk of consumers doing new things empowered by technology and supported by changing demographics as a new business opportunity, rather than viewing it simply as a market threat. To aid in the identification and tracking of emerging strategic risks—and future opportunities—companies have a number of tools at their disposal.
Specifically: Scenario planning can help organizations see a set of both risks and opportunities more broadly, to imagine potential futures that might challenge their current strategic assumptions, and to spot potential sources of risk that may not surface in other ways. By rigorously exploring uncertainties in the environment and involving multiple stakeholders, scenario planning can also address the cognitive biases that impede the risk/strategy discussion and offer alternative paths for when risks materialize. 2 Risk sensing technologies can also be useful in identifying and tracking potential strategic risks. There have been a number of advances over the last few years in data analytics and the ability to analyze huge sets of structured and unstructured data for a variety of risks, both internal and external.
For example, the ability of the Internet of Things to make the performance of physical objects visible digitally has allowed power plant operators to monitor the condition of key machinery in real time. Even more, they can then use that data to create accurate digital models of the machinery to examine how it would react in different scenarios, say if demand for electricity spiked at an unexpected time.3 Using such tools, organizations may also be able to monitor their environment for those signals, or changes, both inside and outside the company that point to new technologies, new regulations, new social trends, and new customer behaviors. Yet, while some 80% of companies surveyed in the Forbes Insights/DTTL report say they use risk-sensing tools, those tools are more focused on such risks as financial and compliance risks, rather than strategic risks.4 .
Risk sensing underutilized for strategic threats The pace of innovation, increased regulation, damage to reputation, and talent gaps are the leading risks to companies’ business strategy, according to a new global survey of C-level executives conducted with Forbes Insights on behalf of DTTL. Nevertheless, many are not using risk-sensing tools to detect and monitor strategic risks, which could leave organizations vulnerable to business model disruption, shareholder activism, and other challenges. “The majority of executives surveyed have risk-sensing capabilities in their organizations. However, these capabilities often overlook key elements, lack technical depth, or leave the organization open to the very risks that risk sensing should be protecting against,” says Henry Ristuccia, a Deloitte Advisory partner in Deloitte & Touche LLP, and global Governance, Regulatory and Risk leader, DTTL. The survey, Risk sensing: The (evolving) state of the art, found that about 80% of the 155 C-level executives asked about their companies’ risk-sensing capabilities use risk-sensing tools. However, the tools are applied most often to financial risk (71%), compliance risk (66%), and operational risk (65%), and are used less often to detect and monitor strategic risks (57%). When asked to name specific risk areas that will impact their business strategy over the next three years, survey respondents ranked pace of innovation (30%) and increased regulation (30%) as the main risks.
Talent and reputation, at 25% and 24%, respectively, also ranked high as future risks to strategy. Risk sensing, which involves the use of human insights and advanced analytics capabilities to identify, analyze, and monitor emerging risks, has become a key component of many organizations’ toolkits for managing risk. The survey found that two-thirds of respondents say they employ people with the knowledge needed to monitor, analyze, and act on risk-sensing data, while about one-third (36%) are less certain that they have the right people. Given their deeper talent pool, executives from the largest companies surveyed (those with at least $5 billion in revenue) most often agreed that they do have the personnel in place for risk sensing. Many executives believe both traditional and new tools are needed to have an effective risk-sensing program. But, when factoring in the pace of innovation risk, 49% of survey respondents indicate that using risk sensing to leverage data is the key way to mitigate the risk of being left behind.
Says Ristuccia: “A starting point for monitoring strategic risks would be to identify the long-term objectives of the organization—those, that if negatively impacted, would alter the key forces that drive a company’s sector. Those forces can be organized into domains, such as economic, regulatory, customer, technological, operational, funding, and research and development, and include scientific, engineering, or other advances that could affect basic drivers of value.” Who has a dedicated program to detect and monitor strategic risks? Not at all Full use of risksensing tools Source: “Risk sensing: The (evolving) state of the art,” based on 155 C-level respondents 3 . Horizon scanning can inform the discussion. In their recent article Pattern of disruption: Anticipating disruptive strategies in a world of unicorns, black swans, and exponentials, leading researchers from Deloitte’s Center for the Edge identified nine patterns of disruption— ways that disruptors created new value through a new approach under specific market conditions—that seem generalizable in both the past and the future.5 For example, by unbundling products and services or by shortening the value chain, competitors have been able to upend certain marketplaces—and some incumbents’ businesses. And while these patterns can’t describe every possible challenge a business will encounter, they do help make sense of the changing dynamics many companies are experiencing. Moreover, armed with this understanding, executives can start asking the right questions of their business and the world around them to not only anticipate changes, but also make the “unexpected” expected. Finally, a strategic risk decision framework can help executives and boards zero in on the risks that could upend the business or open up new opportunities.
Think about it: the problem for most business leaders is not a lack of information, it’s an inability to identify and distinguish the signal from the noise. In fact, a glut of data can make it harder to see strategic risks and can put executives and boards in a defensive posture. An effort should be made to not just present information, but to present it in ways consistent with people’s ability to manage and navigate it, and in ways that help break down built-in institutional challenges or biases to getting and acting on information.
This is where the combination of scenario planning, horizon scanning, and risk sensing can create a platform for early discovery and decisive action on potential threats. Whatever approach you choose, however, be prepared to confront your biases. No matter how experienced, no human is immune to cognitive or institutional biases. Consequently, at every strategic turn or important decision, ask what uncertainties or biases might be in play. Aggressively seek out information that challenges what you believe. And consider involving third parties who will constructively critique and challenge your point of view. 4 CFOs as risk integrators Because strategic risks can threaten the logic of management’s strategic choices, the leaders responsible for those choices should own them.
Obviously, the CFO is a crucial part of conversations about the future of the company, but his or her input is even more important given that traditional risk management remains critically important to good corporate governance. CFOs’ voices are magnified since they serve as strategic advisors on a host of issues—the allocation of resources against strategy, investment options, and capital decisions, and the management of a portfolio of financial risk assets— and in that capacity, they are well positioned to connect the CEO, the board, and other senior stakeholders in the conversation about strategic risks. Strategic risk is the next frontier of risk management, one that will generate a more nuanced conversation about the risks that are sometimes imposed on companies and the opportunities for new businesses. Armed with the right tools, leaders can accelerate how quickly they discover such risks and fit them into their ongoing risk management processes.
Those that do are going to see how strategic risk—and the ability to name it, track it, and deal with it—can turn into an important organizational resource going forward. Endnotes 1 Risk sensing: The (evolving) state of the art, Forbes Insights on behalf of Deloitte Touche Tohmatsu Limited (DTTL), October 2015. 2 “In the heat of corporate crisis: Mind over matter,” Marlo Karp and Rhoda Woo, Deloitte Review Issue 17, July 2015. 3 Stephen Lawson, “Cloud-based ‘digital twins’ could make power plants more efficient,” PC World, September 29, 2105, http://www.pcworld.com/ article/2987525/cloud-based-digital-twins-could-make-power-plants-moreefficient.html, accessed January 7, 2016. 4 Risk sensing: The (evolving) state of the art, Forbes Insights on behalf of Deloitte Touche Tohmatsu Limited (DTTL), October 2015. 5 “Pattern of disruption: Anticipating disruptive strategies in a world of unicorns, black swans, and exponentials,” John Hagel, John Seeley Brown, Maggie Wooll, Andrew de Maar, Deloitte University Press, September 2015. . eloitte LLP; Contacts Andrew Blau Managing Director, Strategic Risk Solutions Deloitte & Touche LLP ablau@deloitte.com Henry Ristuccia Partner; Global Governance, Regulatory and Risk Leader, DTTL Deloitte & Touche LLP hristuccia@deloitte.com Deloitte CFO Insights are developed with the guidance of Dr. Ajit Kambil, Global Research Director, CFO Program, Deloitte LLP; and Lori Calabro, Senior Manager, CFO Education & Events, Deloitte LLP. About Deloitte’s CFO Program The CFO Program brings together a multidisciplinary team of Deloitte leaders and subject matter specialists to help CFOs stay ahead in the face of growing challenges and demands. The Program harnesses our organization’s broad capabilities to deliver forward thinking and fresh insights for every stage of harnesses career – helping CFOs manage the CFOs stay ahead in the face of growing challenges and demands. The Programa CFO’s our lping CFOs manage the complexities of their roles, tackle their company’s most compelling complexities of their roles, tackle their company’s most compelling challenges, and adapt to strategic shifts in the market. nting, business, financial, investment, legal, tax, or other professional adviceinformation about Deloitte’s CFO Program, visit For more or services.
This on or action that may affect your business. Before making any decision or taking any action that may our website at: www.deloitte.com/us/thecfoprogram. s sustained by any person who relies on this publication. Follow us @deloittecfo This publication contains general information only and is based on the experiences and research of Deloitte practitioners. Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services.
This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this publication. About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities.
DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. Please see www.deloitte.com/about for a detailed description of DTTL and its member firms. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries.
Certain services may not be available to attest clients under the rules and regulations of public accounting. Copyright © 2016 Deloitte Development LLC. All rights reserved. Member of Deloitte Touche Tohmatsu Limited. 5 .
We don’t know what we don’t know, and we overestimate the truth of what we believe. Often hard to spot and manage, strategic risks typically do not respond to traditional risk management approaches, such as hedging or mitigation. Since such risks can also point to an organization’s next opportunity, that forces executives to make a choice: “Are we going to try to resist this, avoid it, and push it off if possible? Or are we going to embrace it as an indicator of where the market is going and where our next big opportunity may be?” In this issue of CFO Insights, we’ll discuss the barriers to recognizing and responding to strategic risks and outline some of the tools available to help harness them. The availability bias encourages us to inflate the importance and likelihood of things we saw or read recently, giving us a distorted view of what is really important. The confirmation bias causes us to pay more attention to information that fits what we already believe while discounting information that may contradict what we currently believe. And perhaps worst of all, the optimism bias fools us into thinking that nothing bad will happen and all our plans will work out as we intend.2 1 . These and other biases can cause companies to misunderstand the likelihood of events that could reshape their businesses and confound their ability to respond to them. And if biological and cognitive biases don’t present enough barriers, some common organizational constraints—everything from poor internal communication to bureaucracy and groupthink—may conspire to prevent executives from making the choices they’d like to make with the kind of clarity they’d like to have. Tools for risk detection For these and other reasons, spotting strategic risks is tough, but increasingly valuable as many forward-looking companies attempt to connect risk more closely with strategy. They understand that every strategy, every strategic choice, carries risk. Moreover, having the ability to scan and monitor strategic risks on an ongoing basis and create regular, high-quality reporting can create a competitive advantage going forward. That’s because strategic risk management can also point to the next horizon.
Consider the automotive industry. Five or six years ago, that sector was just detecting the emergence of car sharing. Now, sharing cars is accepted not just in urban areas, but also increasingly in suburbs, and many companies are embracing the concept. They are using the strategic risk of consumers doing new things empowered by technology and supported by changing demographics as a new business opportunity, rather than viewing it simply as a market threat. To aid in the identification and tracking of emerging strategic risks—and future opportunities—companies have a number of tools at their disposal.
Specifically: Scenario planning can help organizations see a set of both risks and opportunities more broadly, to imagine potential futures that might challenge their current strategic assumptions, and to spot potential sources of risk that may not surface in other ways. By rigorously exploring uncertainties in the environment and involving multiple stakeholders, scenario planning can also address the cognitive biases that impede the risk/strategy discussion and offer alternative paths for when risks materialize. 2 Risk sensing technologies can also be useful in identifying and tracking potential strategic risks. There have been a number of advances over the last few years in data analytics and the ability to analyze huge sets of structured and unstructured data for a variety of risks, both internal and external.
For example, the ability of the Internet of Things to make the performance of physical objects visible digitally has allowed power plant operators to monitor the condition of key machinery in real time. Even more, they can then use that data to create accurate digital models of the machinery to examine how it would react in different scenarios, say if demand for electricity spiked at an unexpected time.3 Using such tools, organizations may also be able to monitor their environment for those signals, or changes, both inside and outside the company that point to new technologies, new regulations, new social trends, and new customer behaviors. Yet, while some 80% of companies surveyed in the Forbes Insights/DTTL report say they use risk-sensing tools, those tools are more focused on such risks as financial and compliance risks, rather than strategic risks.4 .
Risk sensing underutilized for strategic threats The pace of innovation, increased regulation, damage to reputation, and talent gaps are the leading risks to companies’ business strategy, according to a new global survey of C-level executives conducted with Forbes Insights on behalf of DTTL. Nevertheless, many are not using risk-sensing tools to detect and monitor strategic risks, which could leave organizations vulnerable to business model disruption, shareholder activism, and other challenges. “The majority of executives surveyed have risk-sensing capabilities in their organizations. However, these capabilities often overlook key elements, lack technical depth, or leave the organization open to the very risks that risk sensing should be protecting against,” says Henry Ristuccia, a Deloitte Advisory partner in Deloitte & Touche LLP, and global Governance, Regulatory and Risk leader, DTTL. The survey, Risk sensing: The (evolving) state of the art, found that about 80% of the 155 C-level executives asked about their companies’ risk-sensing capabilities use risk-sensing tools. However, the tools are applied most often to financial risk (71%), compliance risk (66%), and operational risk (65%), and are used less often to detect and monitor strategic risks (57%). When asked to name specific risk areas that will impact their business strategy over the next three years, survey respondents ranked pace of innovation (30%) and increased regulation (30%) as the main risks.
Talent and reputation, at 25% and 24%, respectively, also ranked high as future risks to strategy. Risk sensing, which involves the use of human insights and advanced analytics capabilities to identify, analyze, and monitor emerging risks, has become a key component of many organizations’ toolkits for managing risk. The survey found that two-thirds of respondents say they employ people with the knowledge needed to monitor, analyze, and act on risk-sensing data, while about one-third (36%) are less certain that they have the right people. Given their deeper talent pool, executives from the largest companies surveyed (those with at least $5 billion in revenue) most often agreed that they do have the personnel in place for risk sensing. Many executives believe both traditional and new tools are needed to have an effective risk-sensing program. But, when factoring in the pace of innovation risk, 49% of survey respondents indicate that using risk sensing to leverage data is the key way to mitigate the risk of being left behind.
Says Ristuccia: “A starting point for monitoring strategic risks would be to identify the long-term objectives of the organization—those, that if negatively impacted, would alter the key forces that drive a company’s sector. Those forces can be organized into domains, such as economic, regulatory, customer, technological, operational, funding, and research and development, and include scientific, engineering, or other advances that could affect basic drivers of value.” Who has a dedicated program to detect and monitor strategic risks? Not at all Full use of risksensing tools Source: “Risk sensing: The (evolving) state of the art,” based on 155 C-level respondents 3 . Horizon scanning can inform the discussion. In their recent article Pattern of disruption: Anticipating disruptive strategies in a world of unicorns, black swans, and exponentials, leading researchers from Deloitte’s Center for the Edge identified nine patterns of disruption— ways that disruptors created new value through a new approach under specific market conditions—that seem generalizable in both the past and the future.5 For example, by unbundling products and services or by shortening the value chain, competitors have been able to upend certain marketplaces—and some incumbents’ businesses. And while these patterns can’t describe every possible challenge a business will encounter, they do help make sense of the changing dynamics many companies are experiencing. Moreover, armed with this understanding, executives can start asking the right questions of their business and the world around them to not only anticipate changes, but also make the “unexpected” expected. Finally, a strategic risk decision framework can help executives and boards zero in on the risks that could upend the business or open up new opportunities.
Think about it: the problem for most business leaders is not a lack of information, it’s an inability to identify and distinguish the signal from the noise. In fact, a glut of data can make it harder to see strategic risks and can put executives and boards in a defensive posture. An effort should be made to not just present information, but to present it in ways consistent with people’s ability to manage and navigate it, and in ways that help break down built-in institutional challenges or biases to getting and acting on information.
This is where the combination of scenario planning, horizon scanning, and risk sensing can create a platform for early discovery and decisive action on potential threats. Whatever approach you choose, however, be prepared to confront your biases. No matter how experienced, no human is immune to cognitive or institutional biases. Consequently, at every strategic turn or important decision, ask what uncertainties or biases might be in play. Aggressively seek out information that challenges what you believe. And consider involving third parties who will constructively critique and challenge your point of view. 4 CFOs as risk integrators Because strategic risks can threaten the logic of management’s strategic choices, the leaders responsible for those choices should own them.
Obviously, the CFO is a crucial part of conversations about the future of the company, but his or her input is even more important given that traditional risk management remains critically important to good corporate governance. CFOs’ voices are magnified since they serve as strategic advisors on a host of issues—the allocation of resources against strategy, investment options, and capital decisions, and the management of a portfolio of financial risk assets— and in that capacity, they are well positioned to connect the CEO, the board, and other senior stakeholders in the conversation about strategic risks. Strategic risk is the next frontier of risk management, one that will generate a more nuanced conversation about the risks that are sometimes imposed on companies and the opportunities for new businesses. Armed with the right tools, leaders can accelerate how quickly they discover such risks and fit them into their ongoing risk management processes.
Those that do are going to see how strategic risk—and the ability to name it, track it, and deal with it—can turn into an important organizational resource going forward. Endnotes 1 Risk sensing: The (evolving) state of the art, Forbes Insights on behalf of Deloitte Touche Tohmatsu Limited (DTTL), October 2015. 2 “In the heat of corporate crisis: Mind over matter,” Marlo Karp and Rhoda Woo, Deloitte Review Issue 17, July 2015. 3 Stephen Lawson, “Cloud-based ‘digital twins’ could make power plants more efficient,” PC World, September 29, 2105, http://www.pcworld.com/ article/2987525/cloud-based-digital-twins-could-make-power-plants-moreefficient.html, accessed January 7, 2016. 4 Risk sensing: The (evolving) state of the art, Forbes Insights on behalf of Deloitte Touche Tohmatsu Limited (DTTL), October 2015. 5 “Pattern of disruption: Anticipating disruptive strategies in a world of unicorns, black swans, and exponentials,” John Hagel, John Seeley Brown, Maggie Wooll, Andrew de Maar, Deloitte University Press, September 2015. . eloitte LLP; Contacts Andrew Blau Managing Director, Strategic Risk Solutions Deloitte & Touche LLP ablau@deloitte.com Henry Ristuccia Partner; Global Governance, Regulatory and Risk Leader, DTTL Deloitte & Touche LLP hristuccia@deloitte.com Deloitte CFO Insights are developed with the guidance of Dr. Ajit Kambil, Global Research Director, CFO Program, Deloitte LLP; and Lori Calabro, Senior Manager, CFO Education & Events, Deloitte LLP. About Deloitte’s CFO Program The CFO Program brings together a multidisciplinary team of Deloitte leaders and subject matter specialists to help CFOs stay ahead in the face of growing challenges and demands. The Program harnesses our organization’s broad capabilities to deliver forward thinking and fresh insights for every stage of harnesses career – helping CFOs manage the CFOs stay ahead in the face of growing challenges and demands. The Programa CFO’s our lping CFOs manage the complexities of their roles, tackle their company’s most compelling complexities of their roles, tackle their company’s most compelling challenges, and adapt to strategic shifts in the market. nting, business, financial, investment, legal, tax, or other professional adviceinformation about Deloitte’s CFO Program, visit For more or services.
This on or action that may affect your business. Before making any decision or taking any action that may our website at: www.deloitte.com/us/thecfoprogram. s sustained by any person who relies on this publication. Follow us @deloittecfo This publication contains general information only and is based on the experiences and research of Deloitte practitioners. Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services.
This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this publication. About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities.
DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. Please see www.deloitte.com/about for a detailed description of DTTL and its member firms. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries.
Certain services may not be available to attest clients under the rules and regulations of public accounting. Copyright © 2016 Deloitte Development LLC. All rights reserved. Member of Deloitte Touche Tohmatsu Limited. 5 .
