Aside Posted on Updated on
“Strategy is always linked to risk. We could say that risk is the other side of strategy coin. For each strategic objective exists a strategic risk. But even if many different methodologies and approaches are focusing on improving the risk management or on improving the strategy management, none of them clearly offer a solution for linking both management processes.
At ACSA (Airport Company of South Africa), we were using an ISO 13000 framework to manage our risks, and the balanced scorecard methodology to track and execute our strategy. But, again, both processes were not talking to each other. Therefore we have been working on linking both strategy management and risk management processes, and we came out with the following 3 steps approach:
The first phase consists on identifying, for each expected strategic outputs:
- the strategic objectives: they are the strategic input that ACSA has to be achieve in order to obtain those expected strategic outputs. They answer the question “WHAT do we need to achieve?”
- the strategic initiatives: they are the strategic projects that ACSA has to implement in order to reach the strategic objectives. They answer the question “HOW are we going to achieve those objectives?”
The second phase is about identifying the key risks for each one of those strategic objectives and strategic initiatives:
- Risks related with strategic objectives: we ask ourself “What if we don’t achieve this objective?” “What could happen?”
- Risks related with strategic initiatives: we ask ourself “What can go wrong in this initiative?” “What can be the consequence?”
The third and last step relates more with a classical risk management process: risk identification, description, control, rating, treatment, etc.
You will find in the slide-share below some details and illustration of this breakthrough link between strategy and risk management processes”
Wasfie Ismail, Group Manager – Strategic Planning at ACSA