(Photo by Javier Grixo on Unsplash)

Strategy and risk management form a powerful partnership.

At least, they should.

Most companies dismiss their risk management function as a reactive force – a check-the-boxes department that worries too much about problems that don't always materialize.

Yet, defining strategy is ultimately an act of risk-taking. It would logically follow that risk management – the act of tuning risk/reward tradeoffs, searching for upside opportunities and downside exposures – would work arm-in-arm with strategy in order to map the ideal path through that uncertain future.

Simply put: companies that don't treat risk management as a partner to strategy are missing out on a key asset.

Sitting with strategy

To loosely summarize Michael Porter's seminal 1996 essay on the topic, strategy is a matter of figuring out what a company will build or what service it will provide. It defines the overall plan for a business. (Porter discerns this from operations, which is more of the how-it's-done.) Strategy isn't just a one-off exercise, either; it requires constant review and adjustment over time, adapting to shifts in business climate and understanding how new technologies change the landscape. Managing strategy is ultimately a future-looking exercise.

Related, risk management is dedicated to identifying and preparing for possible future outcomes. It's as close as you'll get to having a corporate crystal ball. In many cases, your company's risk function can raise questions long before investors, regulators, or opposing counsel compel you to answer. That gives you the chance to address those matters while they are still small and manageable – long before remediation leads to a hefty price tag and before an incident becomes an embarrassing PR story.

When applied properly, then, risk management can inform and refine strategic planning. Its contribution begins with reviewing the strategic goal to see whether it should be bolder, more reserved, or pointed in a slightly different direction. Once that's settled, risk management maps the ideal path to that goal – accounting for the potential downsides, and figuring out whether to accept the potential downside in exchange for the potential upside. The end-result is a smoother trip to the strategic goal.

This isn't limited to shorter-term matters, either. Risk management is also the ideal strategic partner for longer-range planning. When the risk function is allotted proper scope, team members can explore the distant horizon of technology changes and regulatory shifts.

Why risk is misunderstood

Taking a wider view, risk management suffers because of its dual nature: it is theoretical in foresight (accounting for what may happen) yet practical only in hindsight (picking through the wreckage of what has happened, and what we can learn from it).

Western business culture's toxic positivity makes it easy to wave off risk management's warnings as a morale-killer, and treat the post-disaster analysis as an unwelcome reminder of bad news. What should be a learning opportunity to prevent future such incidents is instead considered "too little, too late" – usually expressed with a frustrated question of why risk management didn't provide some kind of warning.

What's worse is when a company heeds the warnings and nothing happens. The non-event is treated as a waste of preparation, even if the alternative would have been a crisis. Some execs prefer the drama of a hero saving the day in the heat of the moment.

Risk practitioners unwittingly contribute to the stigma of being worriers since we are, in fact, often focused on preventative action. (The over-optimistic people in nearby departments focus only on the upsides, leaving us to ponder the downsides… but we still look bad in the process.)

Take operational risk as an example: most writings and presentations in this area concern avoiding downside exposures. These are all great materials, mind you. Great and necessary materials written by experienced risk professionals who are sharing their wisdom. But it reinforces risk management's perceived role as a problem-chaser.

Modern finance breaks this stereotype by concerning itself with the bigger picture of risk-taking – seeing upsides and downsides alike. Traders have spent decades honing their risk management practices into something just shy of an art form. The plus side is that they've thoroughly documented what they've learned. The minus side is that those materials are so industry-specific as to limit their wider applicability. (A rare bridging title in this arena is Aaron Brown's excellent Red-Blooded Risk.) Someone wishing to build on traders' risk management wisdom therefore has three mountains to climb – "understanding what traders do", "seeing how this works in my field", and then "educating others in my field" – before they can set about putting that knowledge to good use. Hence why those lessons have seen little light beyond the trading floor.

How to reframe it

To understand the full scope of risk management's role, and to reframe risk management as a partner in strategy, we can remind ourselves of the key questions this field is meant to explore:

1. "Are we in a position to take on more risk?" Are we being too conservative in our future plans?
2. "Should we change course?" Maybe a different goal would serve us better?
3. "What incidents can we see on the horizon?" Could we handle this loss? Or are we in over our head?
4. "Are we being honest with ourselves?" Are we cherry-picking metrics and evaluations, and ignoring problems, to paint a rosier picture?

Company leadership will note that your risk management department is spending most of their time on question 3. Specifically, they're in firefighting mode – keeping up with clerical work like managing risk registers and chasing down departments for self-assessment data. If you streamline their work, you'll free them up to be proactive intelligence gatherers and advisors who can more effectively tackle questions 1, 2, and 4.

Once the risk management function is operating at its full scope, it's time to involve them as a partner in strategic decision-making. The earlier they're involved, the better.

Your strategic planning already involves scenario analysis; your risk management team can enhance that effort and widen its scope. They can work with strategists to tune the risk/reward tradeoff of any potential new direction by exploring the four questions above. (Those questions will require hard, honest answers. Save the everything's-fine message for outward-facing PR and marketing messages.)

Risk professionals also have a role to play here. It's time for us to more openly talk about upside gain. We're already thinking about it and it's often implied in our work; we need to be more explicit if we want to drive home our strategic value.

We also need to be more proactive about researching our industry vertical and related fields. Let's make sure we include topics such as regulation and emerging technology so we can see what's around the curve.

Given that, this would be a good time for us to expand our knowledge. We're already experts about risk in our respective fields; we should also take the time to study risk in other domains. Especially domains which don't expressly use the term "risk management". You can look to any field that needs to make decisions under incomplete information and time pressure.

We need this more than ever

The world has become more connected over the past thirty years and the pace of business has sped up as a result. Every wave of emerging tech creates new opportunities and new dangers. Combined, this leads to greater uncertainty, making strategy both more important and more difficult to manage.

Companies that see their activity through the lens of risk-taking, and see risk management as an element of strategy, are in a stronger position to address this widening strategic gap.