3 Best Practices for Factoring Risk into Your Strategic Planning Process

No one enjoys strategic planning exercises. They conjure images of a stuffy room filled with executives in dark suits, stacks of paper strewn across the table, and whiteboards covered in scribble. Even in the most collaborative organizations, each executive represents his own department as he vies for the few dollars set aside for yearly projects.

In the midst of the chaos, fact-based analysis is the best approach to setting a clear, realistic course for the organization.

The executives may want to implement sixty projects, but if the organization can only afford forty, then forty it is. They may not to want to upgrade the servers this year, but if the website falters on a weekly basis, then something must be done. These facts aren’t always fun, but they take much of the guesswork out of what needs to be accomplished in the upcoming cycle.

With its analytical approach, is it any wonder that ERM can provide tremendous value during the strategic planning process?

In fact, more than any other time, this is when ERM is needed the most.

Best Practices for factoring risks into your strategic planning process

Projects are implemented to bring about change, and change can always introduce risk. By involving ERM in the strategic planning process, the organization can better understand the potential impact of those projects before they are ever approved.

You can reduce risk in your organization and get the most out of your strategic planning process by following these three best practices.

1. Include all projects in the planning process. 

Even small projects can introduce big risks to the organization. Avoid fast-tracking the seemingly-simple projects; instead, include all of them in the same planning process to ensure visibility and traceability down the road. (Part 2 of this blog series will discuss how ERM can partner with project management to add value to project tracking.)

2. Utilize ERM to identify enterprise risks. 

When asked about risk, Sponsors often point to a problem they believe the project will solve. While this may be a valid problem, it may not be a risk to the organization. On the other hand, Sponsors rarely think of the risks the project could introduce or magnify. If he works in a silo, the Sponsor may not even realize the impact the change will have on other business areas.

For example, the project’s goal may be to create a new product for the coming year. While the product may be a great addition to the company’s lineup, it may stretch existing resources and increase the organization’s liability exposure. That doesn’t mean it’s not worth pursuing, just that certain risks may need to be addressed before, during, or after implementation (e.g. increase training for personnel and/or purchase more liability coverage).

The ERM team is better suited to observe and analyze these risks than any other group within the organization, as they can provide an unbiased perspective. Include them in this early stage to ensure your executives have all the facts when they start the planning process. This will also ensure the ERM team is aware of any risks that should be addressed as projects are implemented.

3. Utilize ERM to understand the cumulative risk effect. 

Some projects may impact the same risk area, such as the organization’s reputation or finances. While individually they may pose a low likelihood of occurrence and a low level of impact, small issues with each of the projects can accumulate, creating a large problem for the organization.

For example, a business that is heavily regulated by the state or federal government has a low risk tolerance for consumer complaints. During planning, executives decide to implement several new processes to help streamline the customer experience. Each project would introduce little risk, with only a few complaints expected. However, if all of the projects are pursued in the same year, the number of complaints could grow exponentially, opening the door to regulatory fines and increased oversight.

ERM should be included in the strategic planning process to help identify this cumulative risk effect of the projects being selected. In response, ERM may advise against implementing multiple projects that could impact the same area, especially if it is crucial to the organization (as reputation often is). If avoidance is not an option, ERM can help executives plan to transfer or mitigate the risk. This proactive approach to risk management can make the difference between a successful organization and one that is constantly in clean-up mode.

(Click here to learn more about risk response strategies to consider after identifying risks during the strategic planning process.)

strategic planning

A Good Beginning

Only by including ERM in the strategic planning process can organizations ensure they are getting the most out of their projects while avoiding unwanted consequences. However, the planning process is only the beginning stage for projects.

Has your organization considered risk during strategic planning? 

If so, were any projects altered, delayed or abandoned altogether after factoring risks into the decision? 

Let us know in the comments section below, or join the conversation on LinkedIn. And check back soon for part 2 of this blog where we’ll look at ways ERM can continue to identify and reduce enterprise risks throughout the project lifecycle.

We trust this blog has been helpful. Thank you for stopping by!

About the author

Ashley Jones recently joined ERM Insights by Carol. She graduated from Florida State University in 2003 with a B.A. in Risk Management and Insurance and obtained the Project Management Professional (PMP) designation in May 2012. Ashley has fourteen years of experience in the fields of insurance and risk management, most notably as a Senior Risk Analyst within the ERM department of a $7+ billion property and casualty insurance company. When she’s not working on project or risk management, Ashley is busy writing and blogging on a wide variety of topics.

, , , , , , ,

Related Posts

3 Comments. Leave new

  • I think this approach is OK but traditional and limited. Why do I say that?
    First because our research shows that many organisations are too risk averse – many are paying dividends or buying back shares rather than investing in growth bets
    Second because our research shows a risk perception gap exists – either between the Board & the ExCo or between the ExCo & operational management or both
    So ERM needs to help management make sucessull growth decisions by doing 2 things
    1. separate the noise from the signal to ensure management focus on what really matters – for example – out of all the high impact & high probability risks which of them have a velocity that is higher than managements ability to respond – its only those that they need to take action on now
    2. enable a balanced risk reward trade-off in big growth bet decisions – for example by ensuring all capex submissions identify key risks, KRIs to track them and contingency plans to respond if the project deviates from plan thus enabling management to evaluate a holistic proposal and make decisions with certainty

    • Hi, Ian. Thanks for commenting. You provide some good context that is helpful. I agree that companies are have (sometimes large) gap in perception of risk-taking behavior. Which is why I wrote a post on making Risk Appetite actionable: http://erminsightsbycarol.com/risk-appetite-tolerance-decision-making/.

      Also, I am a HUGE believer in using risk velocity to help prioritize on where resources need to be focused. However, I would not agree that only risks with a high velocity should be acted upon now. It all depends on the company and how long it will take to reduce risks that currently not high. For example, a risk is identified and assessed as having a velocity 18 months out, but it will take the company over 12 months to put actions or processes in place to manage the risk, I would suggest that this risk get prioritized for action.

      Of course, I noticed that both of your action items relate back to understanding the desired risk-taking appetite, determining the risk associated with specific objectives (whether projects, business objectives, or a change in process), and making the decision based on the comparison between these two things.

      So I have to ask, Ian. In reality, a blog post isn’t going to be all-inclusive. But I think when you see how risk is approached in other posts, we are in agreement. Thanks again for commenting!

  • I totally agree with what you said. I think that it is very important to include all projects in the planning process. I think that by doing this we can avoid problems or issues. Thanks for sharing this article.


Leave a Reply

Your email address will not be published. Required fields are marked *

Fill out this field
Fill out this field
Please enter a valid email address.