Risk management is important for any company of any size and, broadly, risk can be categorised into two main types, depending on what would happen if the risk turns into an issue. Thinking about risk impact in terms of a ship, some risks are operational, in that the emerging issue would damage the ship’s superstructure. Challenging, costly – but not critical. The other type of risk is strategic, and these are risks which could hole the ship below the waterline: they are potential sources of business failure.
Internal failure can be a source of risk, but it rarely brings down successful companies, so is not often a source of strategic risk. Overwhelmingly, what kills off companies at the top of their game comes from the outside: something happens to change their environment, they lose their strategic fit with their environment and so they fail. And it’s actually really common. Of the 500 companies that started the Standard & Poor’s index, 85% failed to survive forty years – less than the working life of the people in them – and these figures pre-date the 2007/8 crisis. Only one of the original 500 remains. In Europe, the average life expectancy of a company is currently around 12.5 years.
Companies need to be able to change at least as fast as their environment is changing. In a competitive situation, they need to be able to change faster than their competitors, and quite a bit faster than that if they are coming from behind. ‘Changing faster’ has two key components. First and foremost, they need foresight, to be able to see risk coming, to assess its implications and how much lead time they have to prepare. And they need the agility to adapt either the company or its environment, and to do that within the lead time in which the risk will become an issue. Foresight and agility work as a pair: the longer the foresight, the less agility the company needs, since it has longer to execute its decision-action cycle. The greater the agility and ‘change muscle’ of the organisation, the less foresight it can get away with, but clearly having both is preferable.
One way to identify strategic risk is to look at the strategic relationships which the company has. Based on an idea from biologist Maturana, some relationships are structural couplings, structural in that the relationship or coupling has the power to change the structure of both parties. The beak of the hummingbird is perfectly adapted to the shape of the flower where it gets its nectar, and the shape of the flower is perfectly adapted to the beak of the hummingbird which pollinates it, through many micro-adaptations over time. Transfer this to a business context, and all companies will have multiple structural couplings, and these are dynamic and adaptive for both parties. But, like the hummingbird and the flower, most of the adaptations between the two parties in each structural coupling are small, each party adapts a bit, forms a slightly altered perspective resulting from the change in relationship, and moves on. It’s all very gradual, so it’s hard to spot the changes – unless the organisation is specifically looking for them. In business, the changes in a structural coupling can occasionally be discontinuous and disruptive, or the accretion of small changes reaches some kind of tipping point and so becomes really obvious, but often it’s too late by then to do anything about it. This is previously unidentified strategic risk showing up as an issue, now. Outside of acts of God, accidents or events resulting from natural causes, a company’s structural couplings are the major source of its strategic risk.
If that premise is accepted, with a clear source of strategic risk, then identifying that strategic risk becomes much less dark art and much more management discipline. Companies have structural couplings with one or more markets, with partners, with competitors, or with regulators. Identifying strategic risk starts with the trends and drivers in the company’s environment, as scenario planning might. The key difference is in looking specifically and carefully at how those trends and drivers might affect the couplings which the company has. There are two ways in which the couplings might change in a way which drives strategic risk for the company.
The first is the accumulation of gradual shifts in the characteristics of the couplings which the company has. Is the balance of power shifting? Is the regulator starting to flex its muscle, and what might that mean? Is there a groundswell of public opinion which could affect policy at a national level? What is the direction of travel for a key market? The second is factors which have the potential to disrupt the coupling itself, which could be sectoral, economic, wider geo-political, the effect of disruptive or paradigm-shifting innovation, or action by third parties.
Foresight becomes a continual, rigorous assessment of the impact of trends and drivers on the structural couplings of the company, based on a series of indicators and ‘tripwire’ alerts. The couplings themselves provide a framework for interpreting and appraising potential impacts of the drivers, and what they could mean for the company. The further out the company can see, the longer it gets to decide and act, with much higher potential to be proactive or to shape the emerging situation in its favour. So it’s critical to build capabilities which can perform this environmental scanning and make its findings and conclusions available to key decisions.
As Drucker wrote: “Tomorrow always arrives. It is always different. And even the mightiest company is in trouble if it has not worked on the future. Being surprised by what happens is a risk that even the largest and richest company cannot afford, and even the smallest business need not run.” Looking outside the company and into the future, and by anticipating changes in structural couplings, strategic risk can be managed and survived and even turned to advantage.