How to manage strategic risk in decision-making

What it is about

How to build strategic risk management into the decision-making process to improve the resilience and competitiveness of organizations.

Session summary

The speaker starts from a definition: strategic risk arises from failing to weigh threats properly when planning and executing strategy, or from failing to adapt to changes in the markets and economies where the institution operates. He sets it apart from market, credit and operational risk by its medium- and long-term horizon and by the fact that measuring it combines quantitative and qualitative analysis. He proposes grouping events into seven types (geopolitical, macroeconomic, competitive, regulatory, technological, internal, and environmental, social and governance) and governing them with an enterprise risk management framework, with three lines of defense and clear roles for the board, the risk committee and senior management.

The practical part describes an annual survey of senior management that rates each factor by impact, probability and speed of materialization, and a risk appetite statement with appetite, tolerance and capacity zones, with early-warning indicators, escalation and action plans with an owner and a date. It includes two cases from the Colombian industry, the pension system reform and cyberattacks, and four principles for building risk into decisions: appetite in planning, aligned compensation, joint assessment of new initiatives and a framework reviewed as a living document. The questions covered how to weight the variables in the rating and what to ask senior management when identifying risks.

Topics covered

• What strategic risk is and how it differs from traditional risks
• The seven types of strategic risk events
• Corporate governance and the three lines of defense in enterprise risk management
• Annual survey of senior management: impact, probability and speed
• Appetite, tolerance and capacity, with indicators and early warnings
• Practical cases: pension system reform and cyberattacks
• How to build strategic risk into planning and compensation