If I could lend one piece of advice to today's corporate leaders, it would be this: Develop a combined approach to strategy and risk. A convergence of factors has created this need:
- Increased exposure. Organizations have come under increased public scrutiny due to cross- border operations and stringent regulations in the wake of corporate trading scandals, heightened environmental awareness, and other catalyzing events. Regardless of size, enterprises participating in the global economy face similar challenges as they grapple with new and often inconsistent regulations. Additionally, activist stakeholders are aggressively challenging management on social responsibility, ethical leadership, and privacy policies.
- A massive shift of power to the customer. Customers — both consumers and businesses — are increasingly influencing the design and delivery of today's products and services, indirectly pressuring companies to develop new business models. Two main factors are triggering this shift: the entry of new customers into the global market and increased market transparency due to enhanced information access.
- Intensified global competition. Lower labor and production costs in the emerging markets of Brazil, Russia, India, and China have spiked a new level of competition worldwide. Developing nations are standing out as the main drivers of growth in global GDP, serving as both recipients and providers of new capital. Savvy multinationals are localizing products and services to gain market share. And record levels of M&A activity are transforming industries, creating efficient global giants.
- Pervasive information and technology. We are witnessing an explosion of digital information around the globe. In the first 300,000 years of civilization, the world produced an estimated 12 exabytes of information. By 1999, we were producing around 2 exabytes per year — or 800 megabytes per person for each of the world's 6.3 billion people.1 Driving this explosion are lower communications costs, exponential growth of computing power, improved price/performance ratios for storage, and new technologies like modeling and RFID.
- The changing global workforce. Information workers are in high demand as labor today is increasingly specialized and computer savvy. This shift toward information-oriented work will create a shortage of 10 million information workers in developed nations. As a result, global recruiters are targeting a qualified, accessible talent pool of information workers: an estimated 33 million college-educated professionals in 28 emerging nations worldwide.
These five trends illustrate that market dynamics are always changing, and they're doing so with increasing frequency. For organizations to survive and maintain competitive advantage, they need to make their business models more agile and innovative. A key tenet of agility is the ability to respond quickly, and a key tenet of innovation is the ability to understand potential opportunities. With a risk-based process approach, which incorporates a risk management methodology into the business process strategy, organizations can make significant strides in being more agile and opening the doors to greater opportunities for innovation.
Business leaders who alter their company's practices to overcome these challenges and seize the opportunities they present will sustain a winning trajectory in the global marketplace. Conversely, executives who treat these challenges as threats are destined to become market victims — followers who cede leadership to competitors.
To thrive, organizations must incorporate risk into planning their business strategy and executing on that strategy. Why? A combined approach to strategy and risk can ensure lower costs, more effective processes, and greater predictability and profitability.
Unfortunately the reality today, according to a Harvard Business Review article, is that "companies on average realize only about 60% of the potential financial performance their strategies promise — and more than one-third of executives place that figure at less than 50%."2 Can your organization beat the odds?
The Traditional Barriers to Linking Strategy and Risk
For over two decades, organizations have leveraged information technology to support numerous business processes. What has been overlooked, however, is arguably the most important process in ensuring an organization's success: linking strategy and execution. By and large, organizations have lacked a mechanism to translate their strategies, goals, and objectives into aligned execution at every level of the organization (see Figure 1).
The problem with risk and strategy management today: There's no transparency and too few conversations among all levels of the business — from risk managers and line-of-business directors to management and executives — ultimately leading to sub-optimal decisions
Managing — Not Just Developing — Strategy
While research has been conducted, numerous books have been published, and methodologies have been formulated for how to successfully develop and manage corporate strategy — including but not limited to concepts and tools such as balanced scorecards, strategy maps, and dashboards — organizations have struggled to leverage the full value of these offerings. Companies typically limit their thinking around these concepts to the office of the CEO and delegate requirements to an internal strategy team or a third-party strategy consultancy.
Often organizations assume that strategy management tools are designed purely to help them develop their corporate strategy. In reality, though, these tools are designed to help them formulate, articulate, and execute their strategy. True strategy management answers the question that most employees have: What does strategy mean to me? The outcome of an effective strategy management process ultimately allows for better strategy development; it's a single, cyclical process in which you are continuously providing feedback into strategy formulation through the day-to-day monitoring of existing strategic objectives, allowing you to refine, model, and optimize your business.
Making Strategy Management More Than an Annual, One-Off Task
In addition to the confusion between developing strategies and managing them, organizations that attempt to leverage traditional tools for managing strategy and execution often fail. They treat strategy as a once-a-year, top-down process, being prescriptive rather than collaborative and not accounting for the dynamic nature of business.
This approach does not support the flexibility and autonomy that employees tasked with execution need in order to interpret strategies appropriately and make better decisions. According to strategy management experts Robert Kaplan and David Norton, "only 5% of employees and only 50% of managers believe they have a clear understanding of their organization's strategy" — and how they contribute to it.3
Making Risk a Corporate Priority
Corporate strategy is not the only factor that has been left largely unattended without an effective benchmarking tool in place; risk management has also been a neglected organizational priority.
In recent years, risk has shown up on the corporate radar because of external conditions and events (corporate fraud scandals, for example) and an increase in globalization, forcing organizations to consider the associated risks of their every move. Still, only 50% of large organizations have an office focused on addressing risk — and even those organizations do not typically have the process support they need to coordinate activities across the enterprise to truly get a full view into the organization's risk.4 They are largely working from error-prone, manual processes and are unable to aggregate risk data — namely because risks are described using different naming conventions, definitions, and analysis methods. And because the processes are nonrepeatable and manual, they also aren't auditable.
Beyond that, business owners often don't have a formalized process for risk identification. So they operate reactively because the only risks they do identify pop up in cases when it's already too late to respond. There is no central process for learning from experience and creating best practices for risk prevention and remediation. Each group has a siloed view of the associated risk and lacks any context for the implications of that risk within the wider organization.
By focusing on only a few negative risks, the organization misses the benefits of taking a holistic approach that weighs risks and opportunities. Without resolving these problems, business owners are unable to embrace risk management. The result is that management and executives are left not knowing whether any unplanned events will keep them from meeting their projections — and are usually not focused on managing the set of risks that are most critical for their business.
|Companies need to ensure that strategy management and risk management operate hand in hand. Without aligning the two, businesses are limiting the full potential of their strategies, as they are executing without any knowledge of potential risks that could inhibit their success.
Why Strategy and Risk Must Be Aligned
To overcome these traditional barriers, companies need to ensure that strategy management and risk management operate hand in hand. Without aligning the two, businesses are limiting the full potential of their strategies as they are executing without any knowledge of potential risks that could inhibit their success.
A strategy developed and executed without understanding the associated risks is inherently flawed; continuing to manage these two activities independently — in a manual, siloed fashion without sufficient support from IT to automate and unify processes — is ineffective and inefficient. It is ineffective because you have not incorporated a risk management methodology into the process of developing your business process, thereby making the strategy vulnerable to unforeseen risk. It is inefficient because the efforts are siloed, manual, and costly, and they do not provide real-time risk monitoring. The result? You can't quickly respond to and remediate those risks.
To combine strategy and risk — to truly have a risk-intelligent business strategy — companies must increase the effectiveness of their strategies and initiatives so they can clearly understand their exposure to both strategic risk and execution risk:
- Strategic risk includes those risks associated with planning and developing your strategy to ensure you are undertaking the best approach. Companies have different strategic objectives — growing revenue, containing costs, or entering new markets, for example. No matter how solid each objective is, they all come with associated risks. Without focusing on those risks, how do you appropriately prioritize your multiple strategic objectives?
- Execution risk includes those risks associated with managing the day-to-day initiatives required to execute on your strategy. You've picked a strategy and are going forward with it, but how do you know what additional associated risks you might encounter along the way?
To help, SAP and Business Objects offer an integrated solution for risk-intelligent strategy management comprised of two critical applications: SAP Strategy Management and SAP GRC Risk Management.
How SAP and Business Objects Support Risk-Intelligent Strategy Management
The combination of SAP Strategy Management and SAP GRC Risk Management ensures that companies can manage both strategic and execution risk. The solutions help customers protect existing value and create new value by giving them a complete understanding of their key strategies and underlying risks.
Throughout all levels of the organization, these solutions lead to overall better transparency and predictability by creating better alignment between an organization's business units and functions and increasing the organization's ability to make more risk-intelligent decisions (see Figure 2):
- Employees can develop plans for executing on set business strategies in the context of their current risks.
- They can also monitor the execution of their plans with full visibility across the organization. Interdependency diagrams, for example, allow employees to understand how their work affects other colleagues, stakeholders, and departments.
- Employees can quickly measure ongoing progress toward their objectives, assess risk, and determine where efforts are most needed by leveraging a common methodology for managing key performance indicators (KPIs) and key risk indicators (KRIs) in the applications.
- In addition, organizations can be much more proactive in mitigating future risks by archiving risk mitigation strategies and initiatives within the applications.
SAP and BusinessObjects solutions support companies embarking on a complete risk-intelligent strategy management approach
Armed with these benefits — better contextual understanding for risk assessment and strategy execution, better insight into the internal network, better benchmarking metrics, and an improved ability to employ proven and repeatable processes — companies will respond more quickly and foresee potential obstacles to their success sooner. These best practices — combined with a culture of accountability — are enabling leading organizations around the globe to ensure their business viability and continuity. Risk-intelligent strategy solutions also prevent strategic risks that have the potential to result in dramatic — as high as 20% — market value declines (see sidebar).
I deliberately highlight a culture of accountability here because technology alone is insufficient; there is a reasonable amount of change management that must occur within organizations to fully leverage the applications. Companies need to be open to sharing information and insights, as well as creating a system of rewards for collaboration and system adoption. All told, a culture of accountability, coupled with insight gained from the applications, allows executives, managers, and analysts to spend more time executing on strategy and identifying optimal new business opportunities.
Consider this example: A car producer makes the profitable growth of its SUV product line the cornerstone of an aggressive growth strategy. Based on recent revenue figures displayed in a strategy scorecard, the SUV product line seems predestined to hit the ambitious revenue and profitability numbers. Simultaneously, however, the forward-looking risk assessment data in a risk management system indicates a surprisingly increased aggregated risk exposure for the SUV line. The SUV line is suffering from internally discovered production quality gaps, increased regulatory risks, and a changing market perception for this type of vehicle. Without the ability to match both the performance and risk insights from the two data silos, the producer might bet on the SUVs' seemingly solid growth objective and put its entire strategy at risk, missing its targets or even suffering significant financial losses. SAP's integrated approach to strategy and risk management ensures that business owners are focusing on the right initiatives to both drive execution of strategy and manage risk.
Risk and opportunity are two sides of the same coin. An organization assesses its opportunities and develops its strategies accordingly — but with every opportunity comes potential risk. In today's environment, organizations can no longer develop and manage strategy manually or without considering the associated risks. If they do so, even the best strategy will not be effectively executed because the strategy was not properly communicated and monitored within the organization, nor were the associated risks proactively addressed and remedied.
To increase their ability to respond more quickly and effectively to ever-changing market dynamics and the challenges and opportunities they present, organizations must move quickly to an integrated risk management and strategy management approach. SAP and Business Objects provide an integrated solution that equips companies with a consistent risk filter during both strategy development and strategy execution. This filter allows organizations to effectively identify risks that could prevent the success of certain strategies and then monitor those risks and their impact during execution.
Increasing a company's overall risk intelligence keeps strategic execution on track. Equipped with advanced risk management and strategy management tools, companies can build that critical risk intelligence, achieve their strategic goals, and minimize their losses.
- The Reporting and Analytics 2008 conference in Marseilles, October 28-30, 2008, and Las Vegas, November 17-19, 2008, for reporting strategies, requirements, and governance (www.sapreporting2008.com)
- "Is Business Objects the Next ERP?" (ERP Expert, Volume 1, Number 3, www.ERPexpertonline.com)
Stephanie Buscemi (firstname.lastname@example.org) is the Vice President of Marketing for Enterprise Performance Management and Governance, Risk, and Compliance at Business Objects, an SAP company. Stephanie joined SAP from Hyperion/Oracle, where she spent nearly a decade in marketing management, most recently as Senior Director of Global Marketing. Prior to Hyperion/Oracle, she worked at Business Objects, where she was instrumental in building Business Objects' US presence. Stephanie holds a bachelor's degree from the University of California, Los Angeles.