(light upbeat music)
-: There is no such thing as a risk-free strategy.
No matter what option you choose
or how you decide to implement it, there will be risk.
Whether risk concerns intellectual property,
economic conditions, or employee morale,
you must attempt to identify and assess your risks
and determine what actions you can take to manage them.
It's important to remember that every person
has their own risk appetite,
the risk they are comfortable with.
A company board or senior management is no different.
Your job is to ensure that they have a good picture
of the strategy's risks
so they can determine if it is below their threshold.
The process is actually quite straightforward,
but does require a framework for analysis
and consistent application.
Don't slip up at step one, like Borders did.
The bookstore chain filed for bankruptcy in 2011
after years of declining sales.
In their 2003 annual report, Borders' two strategic themes
were to grow domestically
by expanding the core superstore business
and, secondly, expand into international markets
with 1,200 bookstores in six countries.
Somehow, Borders failed to identify or mitigate
a key risk to their business model: digital sales.
And in hindsight, it was extremely obvious.
Jeff Bezos started Amazon in 1995 in Seattle.
By 1999, Amazon had generated $610 million
in online sales of books and CDs.
Things got worse for Borders in 2007
when the Kindle was launched and e-books were born.
The lesson is, you can't mitigate
a risk you never identified in the first place.
The next step in the risk management framework
is to understand the causes of a risk.
Companies sometimes get this wrong.
I worked for a large food manufacturer in Australia
that identified the most important input
into the manufacturing process was steam.
The risk management strategies in place
included installing a secondary boiler
in case the main one failed,
having the necessary spare parts in store all the time,
and training of maintenance staff
in every aspect of the steam boiler
so that issues could be quickly fixed.
Then, one day, there was a catastrophic accident
at the terminal of the biggest gas supplier
to southern Australia.
No one at work had ever asked
what would happen if the gas stopped.
I can still remember a lot of sleepless nights
working out how to get a gas boiler to run on diesel fuel.
So, make sure you try to identify
all the possible causes for the identified risk.
Step three is to assess consequences.
What is important here
is to get a second and third opinion on them.
A doctor will tell you
that a consequence of blocked arteries is a stroke.
A lawyer will tell you the consequence of not having a will
is expensive legal bills.
Work through all the consequences in a team
and consider both direct and indirect consequences.
A direct consequence might be a loss of sales.
An indirect one could be damage to an organization's brand.
The best way to map them out
is to use a table to assess consequence in key categories
like financial, personnel, resourcing,
stakeholder value, and so on.
In order to prioritise risks, you need to rate them.
This is done by combining the consequence of a risk
with the likelihood of its occurrence.
With some risks, the likelihood or probability
can be determined through statistical analysis.
And with other risks, the assessment will be subjective.
As with consequences, it is best to get a range of opinions
where your assessment of consequences is subjective.
So, to recap, all strategies have risks,
so you must identify and assess them
and form a plan to manage them.
Start with identifying your risks
and then determining your causes.
Next, assess the likely consequence
if the risk was to occur
and, finally, the likelihood of it occurring.
Once you have drawn your risk rating table,
rate the risks so that you can prioritise them
in terms of which require the most resource and time
to determine the course of action to minimise those risks.