Strategic risk has at least two major categories, at least nine specific dimensions, and about 40 tools that can be applied to the categories and dimensions. One strategic risk tool is assumptions risk analysis [ARA], which provides comfort to boards and leaders that strategy has been appropriately vetted and is staying on track. Our risk culture research found that some executives actually thought it was acceptable to get a board to quickly (in 7 minutes) approve a strategic plan. Whether it is due to rushing or just not applying the right tools, leaving assumptions unknown or untested is not recommended. Stories (and investigative reports) about British Petroleum assuming certain safety technology would work at a certain sea depth, or Fukushima’s leaders assuming that an earthquake or tsunami could never get beyond a certain size, make for notable headlines and lifelong lessons. However, rather than just avoiding negative headlines, the goal in applying ARA to strategy is not to create a list of assumptions and risks, but to be more successful, minimize surprises, and to be more resilient.
Timing of Assumptions Risk Analysis
Drucker argued in his 1994 article, “The Theory of the Business,” that organizations should challenge their theory of the business every three years. The “theory” was all the assumptions that are made every day about the customer, the product, the supply chain, the business model, etc., in today’s disruptive world, every three years may not be nearly often enough. Each company and its board should determine whether this is a periodic exercise or if it should be applied to all major decisions.
Approaches to Strategic Assumption Risk Analysis
One simple and easy way to do ARA is to just ask straight up, “What are the assumptions in that decision or strategy?” Experienced leaders will recognize immediately that this approach can be sensitive. This method can still be done but is best left to someone with tact, credibility, and training.
A second version of flushing out the assumptions can be done via a simple flow / template approach that gets leaders to identify strategic objectives, confidence in meeting those objectives, and the related risks and assumptions. It is usually a short (but not seven minutes) discussion with a natural flow in thinking.
A third version of ARA is a cascading logic / systems approach. I prefer Schmidt’s logic as best described in his book Strategic Project Management Made Simple. The focus is on assumptions in numerous areas: goals, purposes, outcomes, and input. This flushes out more assumptions because the approach is broader that just one decision.
A fourth method that can be applied is Jim DeLoach’s contrarian approach (DeLoach is a global ERM leader at Protiviti). The approach is, in some ways, a supplement to the assumptions analysis because it takes the assumptions one more step and asks what might be the contrarian view of the strategy and related assumptions.
A final version of ARA is slightly more involved and is done in a workshop. This can be considered as just a longer approach and a more in-depth analysis than some of the approaches mentioned above. This approach starts with specific objectives such as earnings targets. Next, the targets and related objectives, assumptions, and risks are flushed out via workshop and lengthy discussion. I’ve seen one F100 company save themselves from embarrassing assumptions that, when flushed out, implied a clear impediment to meeting the targets. This approach, if applied timely, can give a company time to manage the risks and greatly increase the chances of meeting targets. This is the type of big upside risk win that ERM or ARA can provide. Ideally, companies could try to flush out risks and assumptions before they even set the targets.