Performance/Risk Integration
Management Model – PRIM2
Early Mover Series:
Analyzing Strategic Risk
Introduction
Protiviti’s white paper – Performance/Risk Integration Management Model – PRIM 2: The Convergence of Corporate
Performance Management and Risk Management – provides a framework for integrating strategy, performance
and risk management, and is available at www.protiviti.com. The central premise of that white paper is that a
company must consider how to implement an integrated approach and discipline to deploy strategy while also
anticipating and managing the associated opportunities and risks. This premise applies whether the company is
rapidly growing, focused on establishing sustainable competitive advantage or improving its bottom line.
This white paper is the first of Protiviti’s “Early Mover” series that will discuss various aspects of Protiviti’s
PRIM2 framework with the intent of helping companies become early movers in the marketplace. This paper
discusses how proactively identifying and evaluating the risks inherent in a company’s strategy will make the
strategy itself more robust and realistic, as well as improve the probability of the company achieving its strategic
objectives. Specifically, it discusses the importance of:
• Understanding the critical assumptions underlying the strategy and using contrarian analysis to
challenge those assumptions;
• Proactively identifying the uncertainties inherent in the strategy, with a focus on minimizing as much as
possible what we don’t know about the soft spots in the strategy and business plan and what lies ahead in
the planning horizon;
• Using the results of strategic risk analysis to drive monitoring of the external environment; and
• Keeping the risk assessment evergreen as the business environment changes.
When the strategy is made more robust and realistic through the consideration of the underlying risks, and its
execution is effectively measured and monitored, management and the board of directors will have increased
confidence that shareholder value not only will be created, but also protected. This critical balance enhances
corporate performance management and positions the enterprise to become an early mover.
Is Your Organization an Early Mover?
An “early mover” is a firm that quickly recognizes a unique opportunity or risk and uses that knowledge to
evaluate its options either before anyone else or along with other firms that likewise recognize the significance
of what’s developing in the market and seize the initiative. Early movers have the advantage of time, with more
decision-making options before market shifts invalidate critical assumptions underlying the strategy. Failing to
attain “early mover status,” as we’ve defined it, can be fatal in today’s complex business environment. Companies able to position themselves consistently as early movers have a competitive advantage, leading to superior
longer-term enterprise value performance. More important, they are more likely to survive a major market shift
than their less-aware, less-nimble and reluctant-to-move peers.
Protiviti • Early Mover Series: Analyzing Strategic Risk
1
Our use of the “early mover” term is broader than the focus on “first mover advantage,” as that advantage
typically refers to the initial significant occupant of a market segment. The “early mover” concept we’ve
introduced relates to recognizing market shifts affecting the validity of an enterprise’s critical strategic
assumptions and making conscious decisions on whether to act on them. Thus, an “early mover” can also
include a second mover. The dichotomy is not “first” versus “second.” It is “early” versus “late,” where
the market decides what “late” means. Simply stated, the stakes of being an early mover can be as high as
preserving the company’s right to play.1
Be Careful with What You Think You Know
Strategic risks are the risks that (a) the business model is not effectively aligned with the strategy or (b) one or
more future events may invalidate fundamental assumptions underlying the strategy. These risks can arise both
from internal process issues and disruptive change in the external business environment due to the actions of
competitors, changing customer wants, technological advances, changes in financial markets and the economy
and the actions of regulators, among other things.
“W hen a man finds a conclusion agreeable, he accepts it without argument, but when he
finds it disagreeable, he will bring against it all the forces of logic and reason. ”
– Thucydides
These risks can be lethal because they may be potential “enterprise value killers” and, more important, may not
be known to management and the board. For example, innovation of any kind can improve quality, create new
markets, reduce costs, extend a product range, replace products and services, and dramatically improve processes.
Innovation can be disruptive if it improves a competitor’s product or service in ways that the market does not
expect, typically by lowering price significantly or designing a product or service that transforms the way in
which the consumer’s needs are fulfilled. There are many examples of disruptive innovation – minicomputers
displaced mainframes, personal computers displaced minicomputers, desktop publishing displaced traditional
publishing, digital photography displaced chemical photography, laptops displaced personal computers, DVD
players displaced VHS players, LEDs displaced light bulbs, the Internet altered the business-to-consumer
experience – and the list goes on.
Disruptive innovation can present both an opportunity and a threat – an opportunity to leapfrog the competition as a result of creating or accelerating disruption, and a threat of being displaced due to reacting too late
to competitor actions and other market developments. This is why it is important that performance and risk
management capabilities enable the organization to attain “early mover” status when the company approaches
a crossroads where a “strategic inflection point”2 exists and the company’s market position could be harmed
significantly if the imminent opportunity or threat is not recognized by the right people and acted upon. A
strategic inflection point is the pivotal time in a company’s history when its fundamentals are about to change
and it must be nimble enough to preserve its right to play in the industry.
Under our Performance/Risk Integration Management Model (PRIM2), the governance process is the key to
helping the organization balance its entrepreneurial, opportunity-seeking activities for creating enterprise value
with the appropriate control mechanisms for protecting enterprise value, so that neither one is too disproportionately strong relative to the other. Some interpret this discussion as one of “slowing things down” or creating or
1
F
or those interested, Issue 7 of Volume 4 of The Bulletin, “Is Your Organization an Early Mover?,” explains the subject of an early mover.
2
This term is attributed to Andy Grove, former chief executive officer of Intel Corp., in his book, Only the Paranoid Survive, 1996.
Protiviti • Early Mover Series: Analyzing Strategic Risk
2
sustaining a risk-averse culture. That is dangerous thinking. The speed at which business is conducted in the current competitive environment suggests there will be times when the strategy should be revisited.
Effective governance should encourage managers to raise their hand and be heard at the crucial moment before
a critical mistake is made, particularly when there is significant disagreement among multiple constituencies over
competing information or metrics (e.g., budget and on-time delivery versus safety), internal alignment issues, or
questions regarding the validity of strategic assumptions. When addressing a balanced set of performance metrics,
there will always be tension in focusing on “making the numbers” over the short term versus managing for the
longer term, or when dealing with the effects of a constantly changing business environment. However, when the
stakes are high, there will be times when escalation to the highest levels of the organization may be in order and
matters may need to be discussed “in the pits” and not on the racetrack. On a day-to-day basis, these situations
will be infrequent. The sad irony is, unless personnel are insulated appropriately in terms of their careers and
compensation, these discussions may not arise until it is too late. If executive management is so focused on
executing the strategy blindly at all costs, then they may not be willing to pay attention to the warning signs.
There isn’t enough emphasis given to understanding the cost of executing a strategy and business model given
what we don’t know. A major reason for this lack of emphasis is human nature. Our filtering mechanisms tend
to place more emphasis on our beliefs and what we think we know than on what we don’t know. For example,
focusing on hypothetical “high-impact, low-likelihood” scenarios is viewed by many executives as an academic
exercise and, therefore, as a distraction to the real work of managing a business. Yet, if and when these scenarios
occur, some of them literally can “stop the show.”3 As the financial crisis taught us, speed is what matters. We saw
100-year-old companies evaporate or become nearly extinct in a matter of days, largely due to a pervasive collapse
in housing, which led to severe deterioration in loan portfolios and a loss of market confidence, reputation and
liquidity. At the same time, speed is what enables companies to gain competitive advantage by adopting “early
mover” status. Make no mistake, early movers will be those who endure and prosper in the future. They are the
ones who will have the advantage of time, with more decision-making options before market shifts invalidate
critical strategic assumptions. So when making decisions in our risky world, we had best be careful of placing too
much weight on what we think we know, because what we don’t know may be more important.
S peed is what enables companies to gain competitive advantage by adopting “early mover”
status. Make no mistake, early movers will be those who endure and prosper in the future.
So when making decisions in our risky world, we had best be careful of placing too much
weight on what we think we know, because what we don’t know may be more important.
A “black swan” event is a high-impact, hard-to-predict and rare event that is beyond the realm of normal
expectations in history, science, finance and technology. A concept introduced by Nassim Nicholas Taleb,4
black swans are a surprise to most observers because, due to their small probabilities, contemporary risk
assessment methodologies often ignore or do not consider them. Taleb makes the point that the actionoriented, pattern-recognition and other psychological biases that make people individually and collectively
blind to uncertainty and unaware of the massive role rare events can have in historical affairs add to the danger.
After the fact, a black swan event is often rationalized by hindsight, as if it should have been expected. Black
swans are the circumstances or potential outcomes not foreseen by an organization at a given point in time
that can hit when least expected. They fall into the category of events that reflect what we don’t know, giving
rise to the uncomfortable question, “Do we know what we don’t know?”
3
ee Issue 6 of Volume 4 of The Bulletin, “Risk Management: A Look Back and a Look Forward,” available at www.protiviti.com, for a
S
discussion of this topic.
4
The Black Swan, Nassim Nicholas Taleb, 2010.
Protiviti • Early Mover Series: Analyzing Strategic Risk
3
Integrating Risk Assessment into Strategy-Setting
Strategy-setting describes the enterprise’s source of competitive advantage, as expressed through its
differentiating capabilities and the infrastructure needed to execute those capabilities successfully. Therefore,
it focuses on how the entity will create value for its shareholders, customers, employees and other stakeholders
over a stated time horizon.
When setting strategy, it is critical to define the soft
spots, loss drivers and incongruities that are inherent in
GOVERN
the enterprise’s strategic objectives and could dramatically
Strategy,
affect performance and adversely impact execution. These
Risk Assessment
Integration
Capabilities
are the risks that really matter. Corporate strategy is
and Infrastructure
governed by the willingness of an organization to accept
risk in the pursuit of value creation, as well as its capacity to
bear that risk. There are risks inherent in every successful
organization’s business model for executing its strategy. This
is a good thing. A winning business model exploits to a significant extent the areas in which the company excels
relative to its competitors, including undertaking the risks inherent in executing the strategy.
A disciplined approach around protecting enterprise value should be integrated with the aspirational objectives
established through strategy-setting. This approach should entail a robust “think-out-of-the-box” process for
identifying and prioritizing the risks inherent in the strategy, identifying emerging risks, sourcing the risks
and enhancing the strategy using the knowledge and insights gained through the process. Together, the two
activities of strategy-setting and risk assessment facilitate the articulation of the critical assumptions underlying
the strategy. These assumptions often relate to such things as the state of the global and domestic economy,
expected competitor behavior, the regulatory environment, physical phenomena (e.g., earthquakes and weather),
customer behavior, supplier performance and availability of effective channels during the planning horizon.
Once these underlying assumptions are understood, management must consider relevant risk scenarios that
could invalidate the assumptions and thereby impact the viability of one or more components of the strategy.
Strategic Choices Always Involve Risk
One way to support an assertion that strategy-setting and risk assessment should be integrated is to understand
how and why risk is inherent in strategic choices. “Enterprise value” is the valuation placed upon an organization
by its stakeholders. While value can be expressed in different ways, shareholder value is a measure of choice for
Four Strategic Choices:
1. Create new opportunities by investing in new business activities promising attractive returns
relative to the cost of capital.
2. Improve performance by either (a) increasing returns on existing business activities by improving
policies, processes, competencies, reporting, technology and/or knowledge; or (b) acquiring a
company to hold on to a premium position or reduce costs.
3. Harvest existing value by withdrawing from business activities generating inadequate returns.
4. Balance the creation and protection of enterprise value by considering explicitly management’s
risk appetite as a tool for aligning the enterprise’s risk taking with its desired risk profile and adjust
over time as circumstances change.
Protiviti • Early Mover Series: Analyzing Strategic Risk
4
many executives of public companies. Using enterprise value as a context, we can better understand how integrating risk with strategy-setting can make a difference. There are four broad choices available to management in
strategy-setting that impact enterprise value. Each of these choices influences the risk/reward balance.
1. CREATE new opportunities by investing in new business activities promising attractive returns
relative to the cost of capital. Every successful business takes on risk in the pursuit of value-added
opportunities. When management decides to enter into new markets, invest in new products, acquire
another entity to reinvent the business model,5 build new plants to expand, accelerate disruptive change
through technological innovation or exploit other market opportunities, inherent in these decisions are
choices to take on risk. Often, these risks are compensated risks because the expected upside returns
are regarded as sufficient to warrant taking them. They represent bets management decides to make,
the board approves and, hopefully, investors support. A risk assessment is relevant to strategy-setting
when it provides assurance to directors and executive management that risks are taken with knowledge –
knowledge of the business, knowledge of the risks and knowledge of markets. Management should identify
the priority risks inherent in the actions planned under the strategy and discuss the significant risks with
the board. These steps signal to the board that management understands the performance variability and/or
loss exposure arising from committing to its plan and that the business case supports a point of view that
these risks are sufficiently compensated through the prospect for attractive returns. Effectively integrated
with strategy-setting, a risk assessment should invigorate opportunity-seeking behavior by increasing the
confidence of managers that they fully understand the downside and how much it might hurt if the outcome
desired by the strategy is not achieved, and that they have the capabilities at hand within the organization
to manage the risks they intend to take. This is where the articulation of the critical underlying strategic
assumptions comes into play. Decisions to take on more risk should be focused on generating higher
returns; the question is whether the resulting risks are acceptable as well as manageable at acceptable cost.
A risk assessment is relevant to strategy - setting when it provides assurance to
directors and executive management that risks are taken with knowledge – knowledge
of the business, knowledge of the risks and knowledge of markets.
2.Improve performance by either (a) increasing returns on existing business activities by improving policies, processes, competencies, reporting, technology and/or knowledge; or (b) acquiring a
company to hold on to a premium position or reduce costs.6 A robust, comprehensive risk assessment
for either a given business unit or prospective business target may identify risks that expose future revenue
streams and cash flows to unacceptable performance variability. A rigorous risk assessment enhances the
quality of the strategy and business plan (or merger integration plan) as well as their execution. For example,
one multinational organization with a strong presence in more than 70 countries integrates the first two steps
of its business risk management process – Identify Risk and Source Risk – with the risk assessment phase of its
annual business planning process. The organization examines the risk profile in each of its group companies
and evaluates how the business environment has changed or might change in the future. To develop a comprehensive risk profile, executives analyze both internal risk factors and external market situations to determine
where to focus the planning process and where the critical elements reside. This way they obtain useful insights as to the “soft spots” in the unit’s business plan, which tells them where to dig deeper. Once the risks are
sourced, action plans for mitigating them are developed. These plans often involve improvements in policies,
processes, people, reporting and systems to ensure that everything is properly aligned with the business plan.
Risk responses can also involve improved monitoring of the vital signs in the external environment to assure
continued validity of the critical strategic assumptions.
5
“The New M&A Playbook,” Clayton M. Christensen, Richard Alton, Curtis Rising and Andrew Waldeck, Harvard Business Review, March 2011.
6
Ibid.
Protiviti • Early Mover Series: Analyzing Strategic Risk
5
3. Harvest existing value by withdrawing from business activities generating inadequate returns.
Eventually, changing markets, customer preferences and competitor actions give rise to decisions to exit a
market or geographic area or to sell, liquidate or spin off a product group or business unit. These decisions
must be carefully evaluated. When an activity has generated (or is expected to generate) returns that do not
exceed a targeted rate of return or the cost of capital, managers need to understand the “relative riskiness”
of the activity relative to other units, geographies, products or markets. If performance of an activity or a
product is measured without considering the risk assumed in generating returns, an exit decision could result
in withdrawal from a business or discontinuation of a product that is actually generating superior “riskadjusted returns,” even though the gross returns, unadjusted for risk, may appear lackluster. The analysis
supporting this assessment could be as crude as a risk map prepared for each business unit or product, or as
sophisticated as deploying risk-adjusted performance measurement. An effective risk assessment will facilitate
an evaluation of the strategic alternatives as well as understand the consequences of taking action to mitigate
one risk relative to the impact on other risks. In addition to inadequate returns, decisions to exit a market or
discontinue a product or practice may be driven by a determination by management and the board that the
level of risk is excessive or unmanageable at acceptable cost.
r isk appetite represents executive management’s “view of the world” that drives
strategic choices, and is expressed over time through an entity’s actions or inactions.
4. BALANCE the creation and protection of enterprise value by considering explicitly management’s
risk appetite as a tool for aligning the enterprise’s risk taking with its desired risk profile and adjust
over time as circumstances change. Every organization has a risk appetite, whether it acknowledges it
explicitly or not. An organization’s risk appetite, or willingness to take risk, reflects both its capacity to bear
risk as well as a broader understanding of the level of risk that it can safely and successfully manage for an
extended period. Risk appetite represents executive management’s “view of the world” that drives strategic
choices, and is expressed over time through an entity’s actions or inactions. It is inherent in the organization’s strategy and in the execution of that strategy, in the form of both risks taken and risks avoided. It is
implicit in a company’s communications to the street, as investors can gauge the risk appetite of management based on the risks undertaken to fuel growth and create enterprise value. It is also a regulator driving the other three strategic choices, CREATE, IMPROVE and HARVEST. During the strategy-setting
process, companies that are serious about risk management strive to articulate their risk appetite and use the
assertions comprising their risk appetite statement as a frame of reference in strategic discussions. An effective risk assessment helps to ensure the company only takes those risks it is best equipped to manage within
the parameters of its risk appetite, while minimizing exposure to those areas considered off-strategy. The
question is: At what point does the company set its appetite for accepting risk of performance variability and/or
loss exposure? Is it at or short of the point of (a) cancelling projects and deferring maintenance, (b) a profit
warning, (c) a dividend cut, (d) the need to raise additional capital, (e) a loan default or ratings downgrade, or
(f) insolvency? Can we stress test appropriate scenarios against the point at which we have defined our risk appetite? Should we adjust our risk appetite as new opportunities for creating enterprise value arise?7
These are the four strategic choices – CREATE, IMPROVE, HARVEST and BALANCE – management
has available to build and preserve enterprise value over time.8 These four choices are interrelated. For
example, HARVEST may precede CREATE as part of a broader strategy to redirect capital to business
7
he focus of this discussion is on analyzing strategic risks; we will discuss the topic of risk appetite in a subsequent paper in this Early
T
Mover Series.
8
nother choice is to ADJUST the weighted average cost of capital (WACoC) required of the company by lenders and the capital
A
markets. WACoC is a determinant of shareholder value, as it is used to discount expected future cash flows to their present value. If a
company’s returns are greater than WACoC, it is adding value; if less, it is shedding value. In this context, WACoC is a benchmark for
investors to gauge where to put their money. In theory, if risk is reduced, the WACoC is lower; however, this concept is complex and
difficult to make actionable in practice.
Protiviti • Early Mover Series: Analyzing Strategic Risk
6
activities with a more attractive risk/reward balance. As noted above, BALANCE may be implicit in
decisions to CREATE, IMPROVE or HARVEST.
Risk is integral to all four strategic choices; therefore, risk assessment should be integrated with strategy-setting.
Because the relative risks inherent in individual business activities and opportunities vary, the strategy-setting
process should consider the risk equivalency of available alternatives. In addition, the critical assumptions
underlying the strategy provide a glimpse into management’s view of the future business environment. In this
context, risk assessment becomes a strategic tool when it contributes to this transparency, particularly when it
is conducted concurrently with strategy-setting and within the context of a risk appetite statement.
The Challenge in Analyzing Strategic Risks
Analyzing strategic risks isn’t easy for several reasons. We’ll discuss four of them, although we’ve alluded
to some already. First, strategic risks are not susceptible to precise measurement. Therefore, the analytical
framework applied to them must be more qualitative in nature than for financial or operational risks. For
example, interest rate risk is easier to quantify in terms of its impact on the business, taking into account
potential changes in the economy and market volatility. On the other hand, strategic risks arising from
invalid assumptions are more about obtaining sufficient knowledge regarding changes in economic trends,
competitors, customers, suppliers, regulators and other external factors by monitoring them to evaluate
whether disruptive change may be occurring or is about to occur. Such change may result in a deficient
strategy due to one or more critical underlying assumptions that are no longer valid.
S trategic risks are not susceptible to precise measurement; therefore, the analytical
framework applied to them must be more qualitative in nature than for financial or
operational risks.
Second, strategic risks have a longer time horizon than other risks. By contrast, operational risks typically have
a shorter horizon as they are often a function of the business planning cycle. Time horizon can be a significant
factor in determining the currency of the organization’s risk assessment in a rapidly changing environment,
and it also can impact management’s range of viable risk response options. For example, some issues, such as a
capacity shortage to a manufacturing company, can be quite severe over the short term. However, most risks,
including capacity, are less of an issue over the longer term because management has more flexibility to
make adjustments. Flexibility in terms of strategic options may be vital to sustaining a strategy over time.
Third, because an effective strategy is about pursuing the best bets in the context of the enterprise’s desired
risk/reward balance, strategic risks are often “compensated” risks because the potential for upside is sufficient
to warrant accepting the downside exposure. For example, the risks associated with initiating operations
in new markets, introducing new products or undertaking large research and development projects are
compensated risks because they are often inseparable from executing the enterprise’s strategy. By contrast,
uncompensated risks are one-sided because they offer the potential for downside with little or no upside
potential; that is, every foreseeable future outcome results in net cash outflows, creating a loss exposure
(such as environmental, health and safety risks where, over the long term, there is very little, if any, upside to
cutting corners and taking shortcuts that accumulate over time and create unacceptable risks). Our experience is that most people think of risks as “uncompensated.” That mind-set presents a challenge when
integrating risk assessment with the strategy-setting process, particularly when the assessment process has
traditionally focused on uncompensated risks.
Protiviti • Early Mover Series: Analyzing Strategic Risk
7
A t the root of every flawed strategy is one or more underpinning assumptions about
the future that eventually prove to be erroneous. – robert simons
Finally, strategic risks are more about what we don’t know. What sets strategic risks apart from other risks is
that they may arise from uncertainties requiring ongoing monitoring of the environment to ensure strategic
assumptions remain valid over time. “Industry dissonance” occurs when a company’s strategy no longer reflects
marketplace realities. Industry dissonance is the risk that strategic assumptions are lagging behind industry
realities and the corporate strategy does not reflect the new conditions.9 Whether it arises consciously or from
a lack of knowledge, this deficiency can be fatal. Competitive intelligence is an integral part of responding to
strategic uncertainties. If the intelligence function is not driven by factors relevant to the critical assumptions
underlying the strategy, the organization is at risk that intelligence gathered will miss the full picture.
Analyzing Strategic Risks – A Contrarian Approach
At the root of every flawed strategy is one or more underpinning assumptions about the future that eventually prove
to be erroneous.10 The financial crisis will long be a top-of-mind example of this business reality. The “volume-andspeed” business model in subprime lending pursued by many financial institutions assumed, among other things, a
stable housing market, suggesting housing prices were a critical driver of their success. If a risk assessment had been
performed at the time this strategy was formulated, it is likely questions would have arisen to challenge whether
it was realistic for management to expect this assumption to hold up over the time horizon addressed by the
strategy. A relevant risk scenario might have been as follows, assuming a strategic time horizon of three years:
A significant deterioration in all major segments of the housing market occurs in the United States over
the next three years, leading to a severe recession.
The likelihood of this scenario developing would have been evaluated based on historical trends, current
economic outlook and other factors. If an institution had paid heed to a scenario as described above, it would
likely have asked the tough questions around what would happen if the housing market, in fact, took a severe
hit. For example: Do we need a limit structure in place to set boundaries on our loan and counterparty
concentrations in this market segment to keep our exposure at an acceptable level? Do we need to examine
our loan underwriting and documentation standards? Do we need to look at how we are compensating people
who make lending decisions to ensure we are incenting sound behavior over time? How often should we stress
test our loan portfolio against this extreme scenario? Do we need an exit plan? These and other questions, and
the discussions they stimulate, might have led to a more robust strategy to protect enterprise value for those
institutions with the will and discipline to act according to a predetermined plan for managing risk.
One approach to analyzing strategic risks is to use contrarian assertions to strategic assumptions. Contrarian
thinking is driven by understanding the critical strategic assumptions and the scenarios that could impair or
invalidate them. The approach works as follows:
Define Strategic
Assumptions
9
10
Develop Contrarian
Statements
Analyze Contrarian
Statements
Articulate
Implications of
Contrarian
Statements
he term “industry dissonance” was developed by Ben Gilad in his book, Early Warning: Using Competitive Intelligence to Anticipate
T
Market Shifts, Control Risk, and Create Powerful Strategies. He attributed the term to Leonard Fuld. The author’s point is that firms that
dominate their markets experience difficulty in reacting to changes in the business environment.
“Stress Test Your Strategy,” Robert Simons, Harvard Business Review, November, 2010.
Protiviti • Early Mover Series: Analyzing Strategic Risk
8
Steps for Reviewing Critical Assumptions and Contrarian Statements:
1. Define the company’s strategic assumptions that are implicit in its strategy.
2. Select the most critical assumptions for further review.
3. For the selected assumptions, develop a corresponding contrarian statement.
4. Select the highest-impact contrarian statements for further review.
5. For the highest-impact contrarian statements, brainstorm relevant scenarios.
6. Consider relationships and similarities among scenarios to narrow down the list to a manageable level.
7. Rate the list of selected scenarios for impact, persistence and velocity.
8. For the scenarios with the most significant effect on the company, identify drivers evidencing that the
scenarios are developing or have occurred.
9. Identify key risk indicators (KRIs), trending metrics and other relevant information, monitoring
processes and techniques, and response readiness plans.
Define Strategic
Assumptions
STEPS 1 AND 2
Begin by defining your strategic assumptions. A useful analytical framework for strategic risks is to focus
on the impacts that could seriously damage the company – these are the impacts of disruptive change that
invalidate the critical assumptions underlying the strategy. While death, taxes and the sun rising and setting every
day are fundamental truths we can count on, most everything else is an assumption about the future. Strategic
assumptions represent management’s “view of the world” for the duration of the strategic planning horizon. They
pertain to such drivers as: the enterprise’s capabilities; competitor capabilities, behavior and actions; customer
preferences and bargaining power; supplier availability, performance and bargaining power; technological trends
and innovation; capital availability; legal and regulatory trends; and absence of catastrophic physical phenomena,
among other things. Each assumption generally contains an implicit expectation regarding one or more of
these (or other) drivers; collectively, all of the assumptions provide a foundation for understanding sources
of uncertainty in the strategy through identification of relevant scenarios. In effect, strategic assumptions are
management’s “white swans” because they reflect management’s views regarding the environment in which the
“extended end-to-end enterprise” will operate during the planning horizon.11
If the company uses a strategy articulation map in articulating its strategy, the assumptions can be developed
using this tool.12 A well thought-out SWOT (strengths, weaknesses, opportunities and threats) analysis is one
possible source of inputs into this exercise, as it is often used to identify the internal and external factors that are
favorable and unfavorable to achieving a desired end state or strategic objective. If the company doesn’t have
a clearly articulated strategy, the focus may be on the assumptions underlying its business model. Porter’s Five
Forces is an example of a framework that provides a useful context for identifying critical assumptions about a
11
Surviving and Thriving in Uncertainty: Creating the Risk Intelligent Enterprise, Frederick Funston and Stephen Wagner, 2010, pages 86-87.
12
“ Strategy articulation maps” are discussed on pages 4 and 5 of Protiviti’s white paper, Performance/Risk Integration Management Model –
PRIM2: The Convergence of Corporate Performance Management and Risk Management, available at www.protiviti.com.
Protiviti • Early Mover Series: Analyzing Strategic Risk
9
company’s relative positioning in its industry.13 All told, the key is to identify and constructively challenge the
key assumptions or drivers to making the strategy or business model work.
Once the strategic assumptions are identified, those most critical should be selected by management for further
analysis. While this is a matter of judgment, it boils down to selecting the assumptions that management would
most fear becoming invalid. In addition, an assumption germane to one strategic initiative may overlap with
an assumption defined for another strategic initiative. The alternative is to weight all assumptions the same, subjecting them all to further review. We do not recommend that approach. The purpose of a filtering exercise is
to eliminate assumptions that may not be as important as others.
In summary:
1. Define the company’s strategic assumptions that are implicit in its strategy.
2. Select the most critical assumptions for further review.
Develop Contrarian
Statements
STEPS 3 AND 4
Develop contrarian statements for the most critical assumptions. These statements are the “antithesis”
to the strategic assumptions (i.e., they negate the assumptions). If the strategic assumptions are management’s
“white swans,” the related contrarian statements are potential “black swans.”14 While we don’t necessarily
know the event or combination of events that could invalidate the assumptions during the strategic planning
horizon (or some other horizon), we can seek to understand more clearly how much it would hurt if they were
rendered invalid. This brainstorming exercise enables management to understand how bad the pain can get in
case management’s “worst case” scenarios aren’t severe enough. A contrarian statement is most useful when it
is specific enough to constitute a clearly stated scenario (i.e., a “contrarian scenario,” which refers to an event
or a combination of events that would undermine the assumption).
Once the contrarian statements are defined, management should select those that would have the greatest impact
on the company if they were to transpire. These are the contrarian statements management needs to examine more
closely, as they reflect the most likely impacts of disruptive change.
In summary:
3. For the selected assumptions, develop a corresponding contrarian statement.
4. Select the highest-impact contrarian statements for further review.
Analyze Contrarian
Statements
STEPS 5 – 8
For the highest-impact contrarian statements, analyze the plausible and not-so-plausible scenarios that
could make them happen. The contrarian statements with the highest impact are those that will create the
greatest opportunity or the most damage. These statements should reflect situations that would likely arise from
13
ompetitive Strategy: Techniques for Analyzing Industries and Competitors, Michael Porter, 1989, page 4. While the Five Forces model
C
represents a comprehensive view of how competitive behavior works, it implies, from the risk-return perspective, that risk-adjusted
rates of return should be constant across firms and industries, an assertion with which some do not agree.
14
Funston and Wagner, Surviving and Thriving in Uncertainty: Creating the Risk Intelligent Enterprise.
Protiviti • Early Mover Series: Analyzing Strategic Risk
10
events about which the organization currently lacks sufficient information and that management would likely
rationalize after the fact: “Why didn’t we see it coming?” The question is whether one or more of the critical
strategic assumptions require further review. In other words, does the high-impact contrarian statement reflect the
scenario(s) management deems relevant? If management isn’t satisfied that it does, further analysis is required.
In instances requiring additional analysis, management should focus on identifying other scenarios involving an
improbable event or a combination of events that could occur in the future and make the contrarian statement a
reality. One approach is to brainstorm these scenarios using exercises and processes that encourage out-of-the-box
thinking. To suit management’s purposes, scenarios may reflect the best case and worst case, and include those that
are credible and presumptive, as well as those that may be extreme, absurd and even unthinkable. For example,
some of the “structural determinants” underlying Porter’s Five Forces may contribute to formulating relevant
contrarian scenarios.15 Porter also suggests that an organization formulate competitor assumptions about itself,
the industry and other companies in it.16 Additional scenarios can be used to further refine management’s understanding of the impact of invalid assumptions on the profitability and viability of the company’s business model.
Impact identifies the scenarios that could have a large
and potentially catastrophic effect on the viability
of the company’s strategy and business model (i.e., a
disruptive change).
Persistence identifies those scenarios that will
continue to impact the company for a specified time
horizon (i.e., beyond the strategic planning horizon or
some other appropriate longer-term period).
Illustrative Evaluation of Scenarios
9
8
5
7
3
7
1
6
IMPACT
Once scenarios have been identified, management
should consider their relationships and similarities
and either combine scenarios or eliminate scenarios
based on its judgment. During this assessment, should
management determine that certain scenarios are
significantly more likely to occur, this consideration
would probably influence its selection of them.
However, it would be a mistake for management to rule
out extreme events that could significantly disrupt or
displace the company’s “ability to play.” All told, the
final list of scenarios should be a workable number
that is evaluated using appropriate attributes, such as
impact, persistence and velocity:
8
6
5
2
4
4
3
2
1
1
2
Fleeting
3
4
Temporary
5
6
Moderate
7
Enduring
8
9
Permanent
PERSISTENCE
3
4
Numerical references refer to different scenarios.
Size of bubbles represents the relative velocity
of the scenarios.
Velocity prioritizes scenarios for which the company needs to develop a rapid response requiring an effective
contingency plan. Many strategic risks have a low velocity (e.g., the disruptive displacement effect of a
competitor’s vastly superior new product concept doesn’t necessarily occur overnight).
Likelihood is not as significant a factor at this stage. It is already considered, at least implicitly, when management selects scenarios for analysis. Due to their nature, many strategic scenarios identified in contrarian thinking
are either inevitable or highly unlikely to occur. The inevitable assumptions, such as expected technological
trends or new regulations following a high-profile scandal, are likely already factored into management’s
thinking and business planning. Since the intent in analyzing strategic uncertainties is to move away from
the “known knowns” and focus on the things we don’t know enough about (including the improbable), an
15
Porter, Competitive Strategy, pages 5-29.
16
Ibid, pages 58-67.
Protiviti • Early Mover Series: Analyzing Strategic Risk
11
T he intent of analyzing strategic uncertainties is to move away from the “known
knowns” and focus on the things we don’t know enough about.
evaluation of likelihood generally does not result in distinguishable results. Accordingly, we consider persistence more relevant than likelihood when performing contrarian analysis. The higher the persistence, the
greater the potential disruptive displacement effect of the scenario. Therefore, the primary focus is on impact
and persistence, while velocity is considered a secondary factor.
Scenarios with the highest impact and persistence are further reviewed to identify the drivers evidencing that the
scenarios of concern are either developing or have occurred. This analysis may require additional perspective or
research directly related to the potential scenarios. It will feed the development of implication statements, the last
step of the contrarian analysis process.
In summary:
5. For the highest-impact contrarian statements, brainstorm relevant scenarios.
6. Consider relationships and similarities among scenarios to narrow down the list to a manageable level.
7. Rate the list of selected scenarios for impact, persistence and velocity.
8. For the scenarios with the most significant effect on the company, identify drivers evidencing that the scenarios
are developing or have occurred.
Articulate
Implications of
Contrarian
Statements
STEP 9
Articulate the implications of high-impact contrarian statements. This step is the payoff, the end game.
An implication statement represents the synthesis point of view: It resolves the conflict between the thesis (strategic assumption) and antithesis (contrarian statement) by reconciling their common truths and forming a new
proposition.17 In effect, implication statements address two questions – “What do we do if the critical assumption
underlying our strategy is no longer valid?” and “How would we know if our assumption is no longer valid?”
As with many strategic uncertainties, action plans arising from an implication statement will often include
implementing new trending and other metrics to monitor the vital signs germane to the strategic exposures we
are most concerned about. They also may result from consideration of multiple options for responding to the
improbable events that really matter. Here management decides on (a) the appropriate KRIs, trending metrics
and other information to be incorporated into the scope of the competitive intelligence function with the intent
of creating an early warning system,18 and (b) the appropriate response plans needed to increase the company’s
response readiness for high-velocity scenarios. A statement describing the steps management should take to
address the strategic uncertainties the company faces is called an “implication statement.”
In summary:
9. Identify KRIs, trending metrics and other relevant information, monitoring processes and techniques, and
response readiness plans.
17
Surviving and Thriving in Uncertainty: Creating the Risk Intelligent Enterprise, pages 86-87.
18
arly Warning: Using Competitive Intelligence to Anticipate Market Shifts, Control Risk, and Create Powerful Strategies, Ben Gilad, 2004,
E
pages 59-62. Maximizing the value of competitive intelligence is addressed in the second paper in Protiviti’s Early Warning Series.
Protiviti • Early Mover Series: Analyzing Strategic Risk
12
While we can never say with certainty that we know what we don’t know, we can apply techniques that force
knowledgeable managers to think strategically on a comprehensive basis by focusing on the big picture. The
“pre-mortem technique”19 we described earlier is an example of a process for getting managers engaged in contrarian, “devil’s advocate” thinking without encountering resistance. The idea is to assume a strategic assumption
is no longer valid, provide the reason(s) why from a point in time in the future, and explain what that development (i.e., an event or a combination of events) might mean. If management doesn’t like what it sees as a result of
this analysis, then steps should be taken to improve early warning capabilities and response readiness. Failure to
do so would be like flying at night into a fog bank without instrumentation or the ability to read instruments.
Following are examples of contrarian analysis using three familiar examples:
19
Strategy
Key Assumptions
Contrarian Statement
Implication Statement
For a financial institution:
Leverage cheap money to
achieve volume and speed
in lending to the
low-income housing sector
Increasing or stable
housing prices, continued
availability of cheap
money and continued
economic growth, among
other things
To the assumption
regarding increasing or
stable housing prices:
The housing market takes
a significant dive in all
major markets, hitting all
segments of the loan
portfolio
Monitor housing market
indicators in all major
markets with significant
loan portfolio concentrations, as well as test
housing prices by selling
selected assets from time
to time; evaluate adequacy
of underwriting standards
and ensure balanced
compensation structure
For a utility: Operate a
nuclear power station in
Japan near a quake zone by
the ocean located on a
bluff between 14 and 23
feet above sea level
Presume a worst-case
scenario of an earthquake
causing a tsunami of more
than 20 feet as extremely
low risk
A 40+ foot tsunami hits
the plant location site, a
1,000-year event based
on available geological
studies
Evaluate the plant’s safety
planning in light of a
catastrophic tsunami
scenario, including its
backup power facilities
for avoiding a loss of power
For a manufacturer: Reduce
costs and maximize quality
through a single-source
supplier for a significant
component part
Presume no significant
disruption of supply from
this particular supplier
A major catastrophe
creates a protracted
disruption in either the
supplier’s operations or
the logistics for transporting components from the
supplier’s plant to the
company’s facilities
Ascertain the adequacy of
the supplier’s evaluation of
exposure to second- and
third-tier suppliers and
contingency plans for dealing
with supply disruption, the
length of time the company
can operate at current levels
given the extent of inventory
it retains on hand, and the
supplier’s expected ability to
recover; if there is a significant gap between the
duration of the company’s
ability to sustain normal
operations and the supplier’s
expected recovery period,
consider the feasibility of
arranging alternative
suppliers
The Power of Intuition, Gary Klein, 2003, pages 98-101, 131.
Protiviti • Early Mover Series: Analyzing Strategic Risk
13
Why engage in contrarian thinking? As one author pointed out:
At some point your products will become obsolete, your customers’ tastes will change, or technology will
render your business model uncompetitive. Today’s successes will be tomorrow’s old news. The question
is not if, but when.20
It is evident that the time frame within which newer technologies and products are rendering older ones
obsolete is compressing, which makes the “when” even more unpredictable.
Examples of Disruptive Innovations
15-20 Years
2-5 Years
Cassettes
Compact Discs
MP3 Players/iPods
Mainframe Computers
Personal Computers
Laptops/Tablet PCs
CRT Analog TV Sets
Projection/Plasma TV Sets
LCD/LED TV Sets
Light Bulbs/Tube
Compact Fluorescent Lamps
LED Lighting
Landline Phones
Cell Phones
Smartphones
A disruptive change doesn’t always arise suddenly from an epic earthquake or a 1,000-year tsunami event. The
business model of the brick-and-mortar movie rental business has been under attack for years through other
alternatives offered to consumers. The vital question is whether a company can fall so in love with its business
model and strategy that it fails to recognize changing paradigms until it is too late. Or whether it can rationalize
away the improbable event without considering the consequences of being unprepared if the event were to happen.
While we don’t know for sure what will happen that could invalidate our strategic assumptions in the future,
we can count on the validity of our assumptions coming under question as the business environment changes
over time. The “contrarian thinking” process forces managers to think out of the box, challenge assumptions
constructively in a safe environment without fear of reprisals, and develop new ideas that can help make
the strategy more robust. Most important, the exercise may tell managers more about the knowledge and
information they need to obtain and monitor to address their uncertainty around what they don’t know –
laying the foundation for an early warning capability. The objective is clear: Avoid the “industry dissonance”
malady that can lead to failure to anticipate or recognize a “strategic inflection point.”
20
“Stress Test Your Strategy,” Simons.
Protiviti • Early Mover Series: Analyzing Strategic Risk
14
Do Probability Assessments Always Matter?
Before we wrap up our discussion of analyzing strategic uncertainties, the last two sections of this paper deal
further with two topics we’ve already touched on briefly. When evaluating strategic risks, how much emphasis
should be given to probabilities? While they can’t be ignored, the real question is how much weight should we
place on them. If management assumes that the events considered “most likely” are those that will always happen
and that no attention should be given to “high-impact, low-likelihood” events beyond “reassessing them at some
time in the future,” recent events such as the tragedy in Japan suggest they may be making a big mistake.
We’ve pointed out that one approach for management to consider is to address persistence and velocity when
evaluating “high-impact, low-likelihood” events. In addition, we add a third factor: response readiness:
• The velocity or speed to impact (i.e., do we expect the impact to be immediate or sudden, allowing for
very little reaction time, or will the effect smolder slowly over time before the wave crests and the full
impact is realized?)
• The persistence of the impact (i.e., what is the duration of time over which the effect of the event will
gather and sustain momentum, creating ongoing headline exposure?)
• The company’s response readiness (i.e., what is the organization’s resiliency in responding to the event?)
The latter factor should be considered when formulating implication statements.
T he question is not whether the “high-impact, low-likelihood” event will happen, but
what the organization will do if it does.
As noted earlier, the question here is not whether the “high-impact, low-likelihood” event will happen, but what
the organization will do if it does. How severely will the improbable event affect the company? Is the company
prepared? If yes, how does management know? Is there an effective response plan? Have viable strategic
alternatives been thought through? If the answer is no, what is the cost from a sustainability, reputation and
brand image standpoint if the improbable event were to occur and the company were unprepared? In just about
every case, this cost represents an uncompensated risk, meaning there is no upside if the improbable high-impact
event were to occur. In fact, the only “compensation” results from not expending any resources preparing for
the improbable. The “we don’t have time for this” mentality results in a lack of preparedness, which only makes
the effect worse. Sooner or later, every company faces a crisis. As a crisis is a severe manifestation of risk, crisis
management is the natural follow-on to risk management. Rapid response to sudden, unexpected events depends
upon the enterprise’s crisis management capabilities. Fires cannot be fought with a committee.
The good news is that strategic risks often have a low velocity. A competitor’s new product concept or customer
fulfillment process that is superior in quality with comparable cost or delivered faster at lower cost with comparable quality can be a game changer, leaving a company playing out a losing hand with its existing business
model. As we indicated earlier, this disruptive displacement effect doesn’t necessarily occur overnight. For
example, the displacement effect of automobiles didn’t occur until after Henry Ford invented the production line involving interchangeable parts and optimally planned logistics to create a finished product much
faster and at lower cost than handcrafting-type methods, making mass production and an affordable vehicle
feasible. Until that occurred, many were of the view the automobile was a rich man’s toy.
Protiviti • Early Mover Series: Analyzing Strategic Risk
15
A Single View of the Future Can be Very Risky
Given the complexity of the business environment, executives need to be careful to avoid overconfidence that
can be bred by a single or “official” view of the future. Overconfidence is a powerful source of illusions, and is
often driven by the degree of success managers have experienced and the quality and coherence of the storyline
they construct regarding the future they envision. “What if” scenario planning and stress testing are tools for
evaluating management’s “view of the future” by visualizing different future conditions or events, what their
consequences or effects might be like, and how the organization can respond to or benefit from them. Because
these tools avoid the “blind spot” of a single view of the future by focusing management on identifying the
likely direction and order of magnitude of the effects of changes that affect the drivers of the enterprise’s
revenues, costs, profits and market share, they are an important consideration in contrarian analysis.
O verconfidence is a powerful source of illusions, and is often driven by the degree of
success managers have experienced and the quality and coherence of the storyline they
construct regarding the future they envision.
Scenario planning starts by dividing knowledge into two broad domains:
Known
Knowns
Things we believe we know something about. These include established contracts,
demographic shifts, consumer behavior and other factors that essentially cast the past forward,
recognizing that the environment possesses some level of momentum and continuity.
Things we know could occur, but don’t know if or when. These events are uncertain in terms of
either their impact or likelihood. They represent true uncertainties such as future interest
rates, rates of innovation, market fads and fashions, and outcomes of political elections.
Known
Unknowns
Scenario planning can help management cope with uncertainty. The art of scenario planning lies in blending
the known with the unknown into a limited number of internally consistent views of the future spanning a
wide range of possibilities. Scenario planning and stress testing help management challenge assumptions and
expectations, address “what if” questions, and identify sensitive external environment factors that should be
monitored going forward. By deepening their understanding of the pain of the unexpected, management can
identify when contingency plans are required and reinforce the need for flexibility in executing the strategy.
Management must be committed to the scenario-planning exercise to ensure it is sufficiently robust and
discriminates the vital signs on which the company must focus.
Protiviti • Early Mover Series: Analyzing Strategic Risk
16
“I f everyone is thinking alike, someone isn’t thinking.” –
george S. patton
Summary
Extrapolating from the past into the future as if the status quo and what we know from the past gives us clues
as to how the future will unfold is fundamentally flawed. Such practices will not capture the turbulence and
displacement effect of market forces. Every organization should ask the following question: Do we devote
enough attention to thinking about what we don’t know? An indicator of the quality of the assessment process
is the extent to which the risks considered represent a potential event or combination of events that we
currently know to be possible, but it is unknown whether or not they will materialize. The more “unknowns”
a company is able to identify and evaluate in the risk assessment process, the more effective the process will be
and the more anticipatory and better prepared the company will be as it faces uncertainties in the future.
Because the business environment is constantly changing, strategy-setting is a dynamic process that never
ends. The same applies to risk assessment. In the aftermath of the financial crisis, it is clear that markets
and key stakeholders expect companies to understand their risks and risk management capabilities and to
align them with the corporate strategy. They want more transparency in reporting on the organization’s
key risks and approach to risk management. None of this is possible unless the enterprise first identifies and
prioritizes its most significant risks and implements actionable plans to manage them. This means integrating
risk assessment with strategy-setting, with a strong focus on improving the chances of delivering expected
performance. It means forcing thoughtful dialogue, leading to a more robust business strategy and continuous
improvement in the capabilities for managing critical enterprise and emerging risks. It means aligning
competitive intelligence with strategy-setting and the most current risk assessment results to create an early
warning capability. Simply stated, it means giving executive management early mover options.
The contrarian approach to analyzing strategic risks and scenario planning are effective tools for achieving
these outcomes. Through the process of integrating strategy-setting and risk assessment, executive management
and the board of directors can decide how to face potential disruptive change in the future – as a creator of, an
accelerator of, or a reactor to change. Understanding risks and how they are managed used to be the threshold
for most companies. Now the bar is raised. If no longer an afterthought to strategy-setting or an appendage
to performance management, risk management can instill greater confidence in the board of directors and
management that the corporate strategy can be successfully executed and the business plan and performance
goals achieved. Deciding what to do and how to do it only comes after the vital strategic risks are prioritized
through an effective risk assessment. If managers are not devoting sufficient time to thinking about the
unthinkable, they are not thinking strategically.
Protiviti • Early Mover Series: Analyzing Strategic Risk
17
Want to Know More?
As previously mentioned, Protiviti has published a white paper titled Performance/Risk Integration Management
Model – PRIM2: The Convergence of Corporate Performance Management and Risk Management. Whether a
company is rapidly growing, focused on establishing sustainable competitive advantage or improving its bottom
line, it must consider how an integrated approach and discipline to deploy strategy while also anticipating and
managing the associated opportunities and risks will improve its probability of achieving strategic objectives. In
this white paper, Protiviti discusses an enterprisewide program that places performance management, risk, and
risk management in a broader strategic context by:
• Creating real-time transparency into the operations of the enterprise to measure current performance
and predict future trends in order to establish and maintain alignment of strategy, risk management
capabilities and performance management processes in a changing business environment;
• Proactively identifying, sourcing and mitigating the risks inherent in the strategy, including the critical
underlying assumptions, and understanding how the enterprise’s risk profile relates to its risk appetite;
• Communicating and deploying strategy effectively in a consistent manner across the enterprise; and
• Ensuring the seamless integration of strategic plans, performance management and risk management in
the execution of the strategy.
The PRIM2 white paper is available at www.protiviti.com.
GOVERN
Strategy,
Capabilities
and Infrastructure
Integration
Risk Assessment
Key Metrics
and Targets
Corporate
Performance
Management
Infrastructure
Integrated
Business
Planning
t
e
Realign and
Achieve
E xe
cu
Ma
na
ge
Monitoring
and Evaluation
Protiviti • Early Mover Series: Analyzing Strategic Risk
18
About Protiviti
Protiviti (www.protiviti.com) is a global business consulting and internal audit firm composed of experts
specializing in risk, advisory and transaction services. We help solve problems in finance and transactions,
operations, technology, litigation, governance, risk, and compliance. Our highly trained, results-oriented
professionals provide a unique perspective on a wide range of critical business issues for clients in the Americas,
Asia-Pacific, Europe and the Middle East.
Protiviti has more than 60 locations worldwide and is a wholly owned subsidiary of Robert Half International
Inc. (NYSE symbol: RHI). Founded in 1948, Robert Half International is a member of the S&P 500 index.
Protiviti’s Services
PRIM2 is a framework for converging and integrating strategy-setting, performance management and risk
management with the objective of positioning the company as an early mover. Protiviti’s services help your
organization realize this convergence by delivering deep business insight based on a holistic view of the
enterprise. Our Corporate Performance Management (CPM) services address the business challenges facing
the corporate finance office and operational decision-makers throughout the organization. Using best-of-breed,
state-of-the-art CPM software, our clients have fast and easy access to trusted CPM financial, operational and
risk information, enabling a deep understanding of how value is created and protected, and delivering strategic
insight so decision-makers can better anticipate future business outcomes and receive better information for
decision-making.
We also recognize that risk is an important and vital aspect of managing an enterprise and delivering
performance against strategic objectives. Our comprehensive risk management services complement
our CPM solutions by helping companies improve their enterprisewide capabilities to identify, source,
measure, manage and monitor the critical risks inherent in their corporate strategy and business plans,
while incorporating the foundational risk management and controls provided by powerful governance,
risk and compliance (GRC) application software tools. The objective is to enhance strategy-setting and
performance management with the intent of positioning the enterprise to become an early mover.
For more information about the issues discussed in this white paper and Protiviti’s services, please contact:
Jim DeLoach
Managing Director
+1.713.314.4981
jim.deloach@protiviti.com
Jay Thompson
Managing Director
+1.713.314.4923
jay.thompson@protiviti.com
Protiviti is not licensed or registered as a public accounting firm and does
not issue opinions on financial statements or offer attestation services.
© 2011 Protiviti Inc. An Equal Opportunity Employer.
PRO-0711-101034