I was recently talking to someone on the topic of strategy and risk. I made the assumption at the outset that we shared the same views of the relationship and which precedes the other. Over the course of our conversation it became clear we had differing views, and that my assumption was inherently flawed.
Reflecting back on this, I was reminded of how differently some view this relationship and how that influences what they hear in a conversation. Let me take you through some of the relationships I’ve encountered in recent years.
Those with this mindset view strategy as being the overarching driver of the business. It helps form objectives, and positions risk in the context of impacting those objectives. Strategy is also tied closely to overall value of the business. We wrote the COSO ERM framework with this mindset.
Those with this perspective view strategies as a way of operationalizing objectives. The will talk about having objective and strategies for bringing those to life. I find that those with this view have more an operations background.
I have found several in this camp of late. The telltale sign is when people talk about “risk strategies”. This may be reinforced in part by ISO 31000 that uses the term “risk treatment strategies”. Here the mindset is that strategies are how you address risk. I have been tripped up by this group when I talk about aligning strategy and risk because this group views strategies as a response. They see that strategies create value by managing risk. Most in this camp are highly risk-centric.
This final group views risk in the context of a control failure. They often take each control then ask the question “What’s the risk this control fails.” Those here tend to fall into the control-centric category.
Part of my reason for raising this comes from my view of other social media posts. Because I have aligned my thinking with the first scenario, I read these posts with that interpretation. I tried a recent experiment and read a post through the second scenario. The outcome is quite different. For instance, how would you interpret the sentence “How will your strategy hold up to emerging risks“ through different lenses.
My suggestion to you is that in any conversation on risk and strategy, try to validate the readers mindset. Don’t assume as I had recently done.