Linking the Strategy Execution System to
Continuous Improvement and Risk
Management
Robert S. Kaplan
Marvin Bower Professor of Leadership Development, Emeritus
Copyright © President & Fellows of Harvard College
Stage 4 of the Management System: Plan
Operations
TRANSLATE THE
STRATEGY
2
•
•
•
•
3
DEVELOP THE
STRATEGY
Strategy Map/Themes
Measures / Targets
Initiative Portfolios
Funding / Stratex
1
• Mission, Values,
Vision
• Strategy Formulation
TEST & ADAPT
ALIGN THE
ORGANIZATION
• Profitability Analysis
• Strategy
Correlations
• Emerging Strategies
• Business Units
• Support Units
• Employees
MONITOR & LEARN
4
6
PLAN OPERATIONS
• Strategy Reviews
• Operating Reviews
• Establish priorities for
process improvement
initiatives
• Risk Management
EXECUTION
Process
Initiative
5
Initiatives Are Short-Term Programs to Help Close
the Performance Gap .
OBJECTIVE
Improve Order
Fulfillment
Objectives articulate the
components of our strategy
MEASURE / TARGET
Target
Time from
order to
shipment
INITIATIVE
18
Time (hours)
Measure
12
12 hours
Actual
A gap
Implement
automated order
management
system
Target
Measures and targets track our progress
toward achieving and communicating the
intent of the objective.
Initiatives help close the gap
between our current and
desired performance.
Link process improvement programs to strategic objectives
Strategy Map
Balanced Scorecard
Theme: Operating Excellence
Financial
Profits &
RONA
Grow
Revenues
Customer
Fewer
Planes
Attract & Retain
More Customers
On-time
Service
Internal
Lowest
Prices
Achieve
Fast Ground
Turnaround
Objective
Profitability
•
Market Value
•
30% CAGR
•
Grow revenues
•
Seat Revenue
•
20% CAGR
•
Fewer planes
•
Plane Lease Cost
•
5% CAGR
•
Flight is on-time
•
•
#1
•
Lowest prices
•
FAA On-Time Arrival
Rating
Customer Ranking
•
#1
•
Attract and retain
more customers
•
•
# Repeat Customers
# Customers
•
•
70%
Increase 12%
annual
• Achieve fast
ground
turnaround
Ground Crew
Alignment
•
Strategic Systems
Crew Scheduling
Strategic Job
Ramp Agent
Target
•
•
Learning
Measurement
•
Ground crew aligned
with strategy
• On Ground
Time
• 30
Minutes
• On-Time Departure
• 90%
•
% Ground Crew
Stockholders
•
100%
•
Strategic Awareness
•
100%
Develop the
necessary skills
•
Strategic Job
Readiness
•
Develop the support
system
•
Yr 1 - 0%
Yr 3 - 90%
Yr 5 - 100%
•
100%
Info System
Availability
4
Can process improvements close the performance gap?
Ground Turnaround
Activities
Turnaround time
between flights
Current
minutes
per step
Wait for airline door to open
Unload passengers
Wait for cleaning crew to board
Clean airplane
Wait for cabin crew to board
Wait for first passenger to board
Load passengers
Wait for passenger info list
Close aircraft door
Detach boarding ramp
Total cycle time
3:16
5:14
0:24
10:48
4:11
4:06
17:32
1:58
0:57
1:39
50:05
Process improvements
Best practice
minutes per
step
0:00
4:38
0:18
7:40
0:00
0:00
14:00
0:13
0:09
0:43
27:41
A. Agent anticipates plane arrival time; waiting at
jetway for plane to dock
B. Stricter controls on carry-on bags, fewer
passengers moving back in aisle to find bags
C. Cleaning crew in position ahead of time
D. Standardized workflow, timing and methods,
such as prearranged kits
E. Visual signal from cabin crew to agent when
plane is ready to board
F. Active management of overhead storage bins
by flight crew
G. Passenger information list delivered by agent
following last passenger on board
H. Agent ready at aircraft to close door
5
Using the BSC and Quality Assessment Models (Baldrige, EFQM)
Together
Business Processes
Strategic
Balanced
Scorecard
(Competitive
Advantage)
Vital
(‘Hygiene’)
Improve to levels of
quality excellence
Maintain high quality
levels
Improve to minimum
acceptable quality
levels
Potential to cut back
current investment
Weak
Strong
Quality Assessment Model
6
Dashboards articulate the critical link between strategy
management and operations management.
Cause-and-Effect
Model of Each Key
Process
Strategy Map
Web-based Dashboard
of metrics used to
manage a Key Process
THEME linked to
PROCESS
PROCESS linked to
PROCESS
METRICS
METRICS improve
supports THEME
PROCESS
Identify operational processes key to executing strategy and manage those
processes with frequent feedback on dashboard KPIs
A dashboard for Discount Airline’s ground turnaround process
Task
Task Time
Open airline door
2:30
Unload passengers
5:10
Cleaning crew boards
0:20
Clean airplane
10:00
Cabin crew boards
4:00
First passenger boards
4:00
Boarding process complete 16:30
Passenger list confirmed
2:00
Close aircraft door
1:00
Detach boarding ramp
1:30
Total boarding time
8
47:00
VW do Brasil posts a dashboard of operational indicators on the wall
of its assembly plant
A display of Top 500 dealer performance indicators is posted in the
hall of VWB’s senior executive office suite.
With advances in technology, next-generation dashboards can now
fulfill the role of full-fledged performance management tools
Advanced
visualization
methods, with ability
to represent large,
complex data sets,
makes information
“actionable”
Alignment to
strategy – focused
on processes that
are key to overall
strategy execution
Pre-defined navigation
paths to facilitate analysis
and improve user
experience, improved
audit trails and data
transparency
Ability to display
data from multiple
sources, mix of
quantitative and
qualitative
information
11
Integrating Risk Management into the
Strategy Execution System
A emerging framework for risk management:
Category I: Preventable Risks from Employees’ Undesirable and Unauthorized
Actions; Breakdowns in Routine Operational Processes
Enterprises should strive to avoid having Category I risks occur.
The organization gets no benefits from allowing Category I risks to occur. They should
strive, in cost-efficient manner, to reduce their likelihood to zero.
Category II: Strategy Risks: Failing to Achieve the Enterprise’s Strategic
Objectives
The risks that the enterprise accepts to generate superior returns
The organization must identify the principal risk events from their strategy and
estimate their likelihood and impact
It can then reduce the likelihood and impact of Category II risks through use of key
risk indicator scorecards and cost-effective initiatives
Category III: External Risks from Uncertain, Uncontrollable Events
Events that managers can neither predict nor influence; often managers “don’t know
they don’t know” about such risk events
Managers, however, can take prior actions to mitigate the impact of these events
should they occur (e.g., build earthquake-proof structures; backup data centers in a
distant region; insure; hedge)
13
A emerging framework for risk management:
Category I Risks: Employees’ Unauthorized Behavior and Actions
o
o
o
o
o
o
o
o
o
o
theft of cash and information
unauthorized trading
failure to follow standard operating procedures
accounting irregularities
fraud
bribery and corruption
breakdowns in privacy and security
loss or destruction of information
discrimination and harassment
illegal and unethical behavior
14
Failures in Controlling Category I risks
• Siemens Bribery and Corruption Scandal: 2007-09
o Pay $1.6 billion in fines and profit returns to US and German authorities
o Pay $850 million for internal investigations by outside lawyers and accountants.
o Nine former members of Managing Board sued for $28.3 million for breaching
fiduciary duties
o Two former CEOs agree to pay more than $10 million to settle cases brought against
them.
• Société Générale: The Jérôme Kerviel Affair
o Upon discovery of Kerviel’s unauthorized positions, the bank privately and quickly
closes out the account, realizing losses of about €7 billion and books the loss against
2007 income.
o Société Générale has to raise €5.5 billion in new capital to cover the losses.
• UBS: Kweku Adoboli arrested in an illegal trading scheme that loses $2.3 billion
o UBS shares declined to the lowest level in two-and-a-half years; CEO, Oswald
Gruber, resigns on Sept. 24, 2011.
o “the rogue trader incident is merely the tip of the ‘casino mentality’ iceberg that has
existed at UBS for years.”
15
Managing Category I Risks: Events caused by employees deviating
from desired, legal, and ethical behavior, or failing to use
standardized operating procedures
These are risks that companies want to complete avoid. The goal is
to reduce the probability of their occurrence to ZERO!
Clear and frequently communicated Beliefs and Boundary Systems
•
Mission, Values, Codes of conduct
Strong internal controls (e.g., segregation of duties), monitored by
internal audit department, combined with standardized operating
procedures, should drive the probability of compliance and businessas-usual risks essentially to zero
16
Category II Risks: Events that threaten the achievement of strategic
objectives
The risks the company accepts to execute its strategy and generate
superior returns
•
BP drills for oil and gas 3 miles below surface of Gulf of Mexico
•
Boeing develops an entirely new aircraft, the Dreamliner:
•
o
Plane will be constructed with more than 50% composite materials (plastic)
o
Much of the design, engineering, fabrication and assembly shifted to Tier-1
suppliers
Jet Propulsion Laboratory launches unmanned missions to explore for
life on the surface of Mars
17
Companies accept Category II risks to execute their strategies and
generate superior returns
“Building great things means taking
risks. This can be scary and prevents
most companies from doing the bold
things they should. However, in a world
that’s changing so quickly, you’re
guaranteed to fail if you don’t take any
risks. We have another saying: “The
riskiest thing is to take no risks.” We
encourage everyone to make bold
decisions, even if that means being
wrong some of the time.”
18
18
Failures in controlling Category II Risks
BP drills for oil and gas 3 miles below surface of Gulf of
Mexico
19
One Post Mortem about the Explosion on the Deepwater Horizon rig
An investigative panel recently concluded:
“The disaster … can be attributed to “an organizational culture and
incentives that encourage cost cutting and cutting of corners – that reward
workers for doing it faster and cheaper, but not better”
20
Boeing’s Dreamliner: another strategy risk failure
In January 2011, Boeing announced the seventh delay in the delivery
schedule for its first 787 Dreamliner, pushing its initial delivery back at
least three years later than originally planned.
The causes can be traced back to two problems. First, Boeing decided to
outsource both the design and the manufacturing of the 787 to shift
the economic risk onto those suppliers. By outsourcing both the
design and the manufacturing, Boeing lost control of the development
process.
Second, Boeing had never before built an aircraft with composite
materials. It had previously used aluminum -- whose behavior in the
real world is much better understood.
Boeing admitted: "We made too many changes at the same time -- new
technology, new design tools and a change in the supply chain; we
outran our ability to manage the project effectively.”
21
Risk management is hard.
Experienced project manager (Gentry Lee) appointed as “Chief Systems
Engineer” for all JPL missions
“Risk mitigation is painful; not a natural
event for humans to perform.”
22
Balancing Innovation and Risk: The Message from Janus
“JPL engineers graduate from top schools at the top of their class.
They are used to being right in their design and engineering decisions.
I have to get them comfortable thinking about all the things that can go
wrong. … Innovation, looking forward, is absolutely essential, but
innovation needs to be balanced with reflecting backwards, learning
from experience about what can go wrong.”
23
Individual and Organizational Biases Prevent Companies from
Thinking and Planning for Risk Events
• We are overconfident about the accuracy of our forecasts and assessments
o
Consistently under-estimate the variance of future events
• We anchor our estimates to readily available evidence (e.g., housing prices
in US, until 2006, had not decreased in 40 years)
• We accept information that supports our initial position, the confirmation
bias, and suppress information that contradicts it, cognitive dissonance:
• When our actions do not seem to be working, we escalate our commitment
to the original course of action; we throw good money after bad, and fail to
recognize sunk costs.
• Group Think: we go along with the flow, suppressing objections to actions
that the leader and everyone else seems to endorse.
• We incubate more risk through the normalization of deviance as we learn to
accept minor failures and defects as normal; false alarms, rather than alerts
of imminent danger.
24
To overcome individual and organizational biases, effective risk
management requires:
Active and intrusive processes that:
• challenge existing assumptions about the
world within and outside the organization
• communicate risk information with the use of
distinct tools (risk maps, value-at-risk models,
stress tests etc.)
• complement, but do not displace, existing
management control practices
25
A Case Study in Risk Management: The Mars Explorer Project: EntryDescent-Landing (EDL) Stage
26
Companies need highly interactive and intrusive risk management
processes to overcome these individual and organizational biases
• Jet Propulsion Laboratory creates a 12 Person Risk Review Board for
each project (G. Lee serves as chairman)
o
o
Consists of experienced, respected technical experts who are
independent of the project
Conducts three full-scale 2 day reviews during the course of the project
Creates a culture of “intellectual confrontation”
Legitimizes rigorous questioning of the intended design
What bad things can happen to even good designs?
Creative paranoia – what can go wrong, what will you do if this
component fails?
Forces project team to view their work from a different perspective
Canadian utility, Hydro One, holds dozens of Risk Review Workshops each
year, facilitated by risk managers, at which employees identify and assess the
risks they see in the organization.
JP Morgan Chase embeds technically expert risk managers to help traders and
investment managers understand the risk consequences from their decisions.
o
•
•
27
The risk meetings quantify the likelihood and impact of risk events
Risk Map
Value-at-Risk
Probability of Gain or Loss
Liklihood
5
4
3
2
1
1
2
3
4
Consequence
5
95%
line
99%
line
Magnitude of loss (measured in “standard deviation” units)
28
Risk review meetings also recommend actions to reduce the
likelihood or mitigate the consequences of significant risk events
• Establish cost and time reserves for product development projects
• Identify cost-effective actions that reduce the likelihood or impact of the risk
event
• Assign an accountable manager to monitor each major risk
29
VW do Brasil uses its strategy map to identify risks to its strategy
91 risks
in total
11 risks
4 risks
7 risks
11 risks
24 risks
13 risks
5 risks
2 risks
4 risks
4 risks
38 risks
9 risks
1 risk
4 risks
13 risks
4 risks
3 risks
7 risks
18 risks
Identify Risk Events for each Strategic Objective on the Strategy
Map
Strategic
Objective
Achieve
Market
Share
Growth
Risk Event
Outcomes Risk Indicators
Industry
• Loss of
• Daily tracking
sales below
unit
of industry
expectations sales
volume and
due to
market share
political and • Loss of
numbers
economic
revenues (from
uncertainty
registrations)
triggered by
changes in
• Macrolaws, such as
economic
customs
reports
barriers and
other sales
• Market trend
restrictions
evaluations
Likelihood/
Consequence
5
4
3
2
1
X
1 2 3 4 5
Management
Controls
Accountable
Manager
• Monthly meeting
of Sales &
Marketing,
Finance,
Governmental
Affairs, Logistics,
and Human
Resources to
consider
alternative sales
and production
plans
• Mr. A.
Gonzalez
Director of
Governmental
Affairs
Identify Risk Events for each Strategic Objective on the Strategy
Map
Strategic
Objective
Guarantee
Reliable and
Competitive
Supplier =>
Manufacturer
Processes
Risk
Event
Outcomes Risk
Indicators
Deliveries
interruption
• Overtime
• Emergency
freight
• Quality
problems
• Production
losses
• Critical
items report
• Late
deliveries
• Incoming
defects
• Incorrect
component
shipments
Likelihood/
Consequence
5
4
3
2
1
X
1 2 3 4 5
Management Accountable
Controls
Manager
• Daily supply
• Mr. O. Manuel
chain meetings
with Logistics,
Director of
Purchasing, and
Manufacturing
Quality
Logistics
Assurance
• Monitor
suppliers’
tooling to
detect
deterioration
• Risk mitigation
initiative:
upgrade
supplier’s
tooling
• Risk mitigation
initiative:
identify and
select key
supply chain
executive at
each critical
supplier
Summary of Critical Strategic Risks at Volkswagen do Brasil
Numbers in table are fictitious, for illustrative purposes only.
Scale
Infra
Talent
Management
Operational
Excellence
Client / Market
Focus
Financial
Performance
Values
/Ethics
Infosys uses its strategy map to identify strategy risks
Nurture Infosys Values
Conduct Business Legally & Ethically
Be A Responsible Corporate Citizen
Enhance Shareholder Value
Improve Profits and Profitability
Achieve
Revenue Growth
Grow Key / Large
Accounts
Optimize Onsite
Offshore Mix
Increase Revenue
Productivity
Acquire & Manage
Large Deals
Reduce
Operational Cost
Leverage Solutions
& Alliances
Improve Rate
Realization
Improve Return On
Capital Investment
Broaden Business
Footprint
Strengthen Brand Position
Enhance Client Satisfaction
Innovation
Client Management
Execution Excellence
Risk Management
Identify & Incubate
New Business Ideas
Strengthen Client
Facing Processes
Improve Quality &
Productivity
Reduce & Manage
Operational Risk
Leverage & Reuse
Intellectual Property
Strengthen Internal
Collaboration
Improve Resource
Utilization
Improve BEF and Unit
Scalability
Improve Quality Of
Talent Recruited
Develop & Retain
Competencies
Strengthen
Performance Ethic
Develop Diversity in
Workforce
Improve Workforce Motivation
Develop Multiple Tiers Of Leadership
Scale State-Of-The-Art Technology Infrastructure
Scale State-Of-The-Art Physical Infrastructure
34
Identifying Strategic Risk Factors at Infosys
(Illustrative only)
Business Objectives
Financial performance
1. Achieve revenue growth
2. Sustain profitability
3. Increase revenue productivity
Client and market focus
External Risk Factors
Macro economic factors
Exchange rate fluctuations
Political environment
4. Grow client relationships
5.
6.
Differentiate client offerings
Broaden geographical footprint
Execution excellence
7. Leverage Global Delivery Model
8. Control operational costs
9. Improve quality & productivity
Organizational development
10. Develop and retain competencies
11. Develop global workforce
12. Develop 3 tiers of leadership
Competitive environment
Concentration of
revenues
Inflation and cost structure
Internal Risk Factors
Financial reporting risks
Liquidity and leverage
Contractual compliance
Compliance with local laws
Intellectual property
management
Engagement execution
Integration of subsidiaries
Immigration regulations
Human resource management
Security & business continuity
Culture, values and leadership
Technology obsolescence
Partial Key Risk Indicator Scorecard at Infosys
Risk Factor
Risk Event
Key Risk Indicator
Concentration of
Revenues
Major Customer
Default
• Key Customer Credit
Default Swap Rate
Immigration
Regulations
Protectionism Leads to • % of employees with dual
Denial of Work Permits
citizenship
and Work Visas
• # of employees that can
legally work in countries
outside India
Identifying, Mitigating and Managing Category II Risks
What can cause us not to achieve the strategic objectives on our strategy map?
For each objective, identify the key risk events and risk indicators for each
strategy map objective
Aggregate risk indicators into a Key Risk Indicator (KRI) scorecard
Set priorities for initiatives to mitigate the major risk events
37
Category III: The risk from non-controllable external events
What are the non-controllable external events that can cause the
strategy or the entire enterprise to fail?
Often these are risks that “we don’t know we don’t know”
Need for “risk envisionment”
o Scenario planning, War-gaming, Stress tests, and Tail risk meetings
38
What can a company learn from conducting a War Game?
• Divide senior management into 3-4 teams, each representing a
major competitive firm in the industry
• Establish a base line scenario, including the strategy-of-record for
own company
o Teams attempt to answer the question, “How would you attack our
company’s strategy if you were our competitor?
• Designed to identify the holes in the company’s strategy?
• Helps to overcome confirmation bias; tendency to find evidence that
supports current beliefs and desires and to ignore evidence that could
contradict them.
39
Scenario Planning: Why?
• Provide a rational process for defining the plausible boundaries of future
states of the world.
• Strategy workshops help us choose which game should we play in the
current environment? What should be the value proposition we offer to
targeted customers to position ourselves for competitive advantage?
• Scenario Analysis reveals that many possible future environments can exist.
How will our current strategy perform in the various possible futures?
40
Risk Management and the CEO
• When the music stops, in terms of liquidity, things will be complicated. But as
long as the music is playing, you’ve got to get up and dance.
We’re still dancing.
Chuck Prince, CEO of Citigroup
Financial Times (July 9, 2007)
• “Jamie Dimon is the Chief Risk Officer of J P Morgan Chase. He sets the tone at
the top.”
Barry Zubrow, CRO of J P Morgan Chase
• “Everyone does risk management in bad times. The strong test of risk
management is whether it works in good times. Will top management stand
behind the risk managers, avoiding temptation, and saying no to things that put
the enterprise at risk?”
M.D. Ranganath, Chief Risk Officer, Infosys
41