Performance/Risk Integration Management Model – PRIM2 · Performance/Risk Integration Management...

Performance/Risk Integration Management Model – PRIM2

Early Mover Series: Analyzing Strategic Risk

1PRotiviti • Early Mover Series: Analyzing Strategic Risk

IntroductionProtiviti’s white paper – Performance/Risk Integration Management Model – PRIM2: The Convergence of Corporate Performance Management and Risk Management – provides a framework for integrating strategy, performance and risk management, and is available at www.protiviti.com. The central premise of that white paper is that a company must consider how to implement an integrated approach and discipline to deploy strategy while also anticipating and managing the associated opportunities and risks. This premise applies whether the company is rapidly growing, focused on establishing sustainable competitive advantage or improving its bottom line.

This white paper is the first of Protiviti’s “Early Mover” series that will discuss various aspects of Protiviti’s PRIM2 framework with the intent of helping companies become early movers in the marketplace. This paper discusses how proactively identifying and evaluating the risks inherent in a company’s strategy will make the strategy itself more robust and realistic, as well as improve the probability of the company achieving its strategic objectives. Specifically, it discusses the importance of:

• Understanding the critical assumptions underlying the strategy and using contrarian analysis to challenge those assumptions;

• Proactively identifying the uncertainties inherent in the strategy, with a focus on minimizing as much as possible what we don’t know about the soft spots in the strategy and business plan and what lies ahead in the planning horizon;

•Using the results of strategic risk analysis to drive monitoring of the external environment; and

•Keeping the risk assessment evergreen as the business environment changes.

When the strategy is made more robust and realistic through the consideration of the underlying risks, and its execution is effectively measured and monitored, management and the board of directors will have increased confidence that shareholder value not only will be created, but also protected. This critical balance enhances corporate performance management and positions the enterprise to become an early mover.

iS YouR oRgAnizAtion An EARlY MovER?

An “early mover” is a firm that quickly recognizes a unique opportunity or risk and uses that knowledge to evaluate its options either before anyone else or along with other firms that likewise recognize the significance of what’s developing in the market and seize the initiative. Early movers have the advantage of time, with more decision-making options before market shifts invalidate critical assumptions underlying the strategy. Failing to attain “early mover status,” as we’ve defined it, can be fatal in today’s complex business environment. Compa-nies able to position themselves consistently as early movers have a competitive advantage, leading to superior longer-term enterprise value performance. More important, they are more likely to survive a major market shift than their less-aware, less-nimble and reluctant-to-move peers.


Our use of the “early mover” term is broader than the focus on “first mover advantage,” as that advantage typically refers to the initial significant occupant of a market segment. The “early mover” concept we’ve introduced relates to recognizing market shifts affecting the validity of an enterprise’s critical strategic assumptions and making conscious decisions on whether to act on them. Thus, an “early mover” can also include a second mover. The dichotomy is not “first” versus “second.” It is “early” versus “late,” where the market decides what “late” means. Simply stated, the stakes of being an early mover can be as high as preserving the company’s right to play.1

BE CAREful with whAt You think You know

Strategic risks are the risks that (a) the business model is not effectively aligned with the strategy or (b) one or more future events may invalidate fundamental assumptions underlying the strategy. These risks can arise both from internal process issues and disruptive change in the external business environment due to the actions of competitors, changing customer wants, technological advances, changes in financial markets and the economy and the actions of regulators, among other things.

These risks can be lethal because they may be potential “enterprise value killers” and, more important, may not be known to management and the board. For example, innovation of any kind can improve quality, create new markets, reduce costs, extend a product range, replace products and services, and dramatically improve processes. Innovation can be disruptive if it improves a competitor’s product or service in ways that the market does not expect, typically by lowering price significantly or designing a product or service that transforms the way in which the consumer’s needs are fulfilled. There are many examples of disruptive innovation – minicomputers displaced mainframes, personal computers displaced minicomputers, desktop publishing displaced traditional publishing, digital photography displaced chemical photography, laptops displaced personal computers, DVD players displaced VHS players, LEDs displaced light bulbs, the Internet altered the business-to-consumer experience – and the list goes on.

Disruptive innovation can present both an opportunity and a threat – an opportunity to leapfrog the competi-tion as a result of creating or accelerating disruption, and a threat of being displaced due to reacting too late to competitor actions and other market developments. This is why it is important that performance and risk management capabilities enable the organization to attain “early mover” status when the company approaches a crossroads where a “strategic inflection point”2 exists and the company’s market position could be harmed significantly if the imminent opportunity or threat is not recognized by the right people and acted upon. A strategic inflection point is the pivotal time in a company’s history when its fundamentals are about to change and it must be nimble enough to preserve its right to play in the industry.

Under our Performance/Risk Integration Management Model (PRIM2), the governance process is the key to helping the organization balance its entrepreneurial, opportunity-seeking activities for creating enterprise value with the appropriate control mechanisms for protecting enterprise value, so that neither one is too disproportion-ately strong relative to the other. Some interpret this discussion as one of “slowing things down” or creating or

1 For those interested, Issue 7 of Volume 4 of The Bulletin, “Is Your Organization an Early Mover?,” explains the subject of an early mover.

2 This term is attributed to Andy Grove, former chief executive officer of Intel Corp., in his book, Only the Paranoid Survive, 1996.

“ WHEn A MAn FInDS A COnCLUSIOn AGREEAbLE, HE ACCEPTS IT WITHOUT ARGUMEnT, bUT WHEn HE

FInDS IT DISAGREEAbLE, HE WILL bRInG AGAInST IT ALL THE FORCES OF LOGIC AnD REASOn.”

– Thucydides


sustaining a risk-averse culture. That is dangerous thinking. The speed at which business is conducted in the cur-rent competitive environment suggests there will be times when the strategy should be revisited.

Effective governance should encourage managers to raise their hand and be heard at the crucial moment before a critical mistake is made, particularly when there is significant disagreement among multiple constituencies over competing information or metrics (e.g., budget and on-time delivery versus safety), internal alignment issues, or questions regarding the validity of strategic assumptions. When addressing a balanced set of performance metrics, there will always be tension in focusing on “making the numbers” over the short term versus managing for the longer term, or when dealing with the effects of a constantly changing business environment. However, when the stakes are high, there will be times when escalation to the highest levels of the organization may be in order and matters may need to be discussed “in the pits” and not on the racetrack. On a day-to-day basis, these situations will be infrequent. The sad irony is, unless personnel are insulated appropriately in terms of their careers and compensation, these discussions may not arise until it is too late. If executive management is so focused on executing the strategy blindly at all costs, then they may not be willing to pay attention to the warning signs.

There isn’t enough emphasis given to understanding the cost of executing a strategy and business model given what we don’t know. A major reason for this lack of emphasis is human nature. Our filtering mechanisms tend to place more emphasis on our beliefs and what we think we know than on what we don’t know. For example, focusing on hypothetical “high-impact, low-likelihood” scenarios is viewed by many executives as an academic exercise and, therefore, as a distraction to the real work of managing a business. Yet, if and when these scenarios occur, some of them literally can “stop the show.”3 As the financial crisis taught us, speed is what matters. We saw 100-year-old companies evaporate or become nearly extinct in a matter of days, largely due to a pervasive collapse in housing, which led to severe deterioration in loan portfolios and a loss of market confidence, reputation and liquidity. At the same time, speed is what enables companies to gain competitive advantage by adopting “early mover” status. Make no mistake, early movers will be those who endure and prosper in the future. They are the ones who will have the advantage of time, with more decision-making options before market shifts invalidate critical strategic assumptions. So when making decisions in our risky world, we had best be careful of placing too much weight on what we think we know, because what we don’t know may be more important.

A “black swan” event is a high-impact, hard-to-predict and rare event that is beyond the realm of normal expectations in history, science, finance and technology. A concept introduced by nassim nicholas Taleb,4 black swans are a surprise to most observers because, due to their small probabilities, contemporary risk assessment methodologies often ignore or do not consider them. Taleb makes the point that the action-oriented, pattern-recognition and other psychological biases that make people individually and collectively blind to uncertainty and unaware of the massive role rare events can have in historical affairs add to the danger. After the fact, a black swan event is often rationalized by hindsight, as if it should have been expected. black swans are the circumstances or potential outcomes not foreseen by an organization at a given point in time that can hit when least expected. They fall into the category of events that reflect what we don’t know, giving rise to the uncomfortable question, “Do we know what we don’t know?”

SPEED IS WHAT EnAbLES COMPAnIES TO GAIn COMPETITIVE ADVAnTAGE bY ADOPTInG “EARLY MOVER”

STATUS. MAKE nO MISTAKE, EARLY MOVERS WILL bE THOSE WHO EnDURE AnD PROSPER In THE FUTURE.

SO WHEn MAKInG DECISIOnS In OUR RISKY WORLD, WE HAD bEST bE CAREFUL OF PLACInG TOO MUCH

WEIGHT On WHAT WE THInK WE KnOW, bECAUSE WHAT WE DOn’T KnOW MAY bE MORE IMPORTAnT.

3 See Issue 6 of Volume 4 of The Bulletin, “Risk Management: A Look back and a Look Forward,” available at www.protiviti.com, for a discussion of this topic.

4 The Black Swan, nassim nicholas Taleb, 2010.


intEgRAting RiSk ASSESSMEnt into StRAtEgY-SEtting

Strategy-setting describes the enterprise’s source of competitive advantage, as expressed through its differentiating capabilities and the infrastructure needed to execute those capabilities successfully. Therefore, it focuses on how the entity will create value for its shareholders, customers, employees and other stakeholders over a stated time horizon.

When setting strategy, it is critical to define the soft spots, loss drivers and incongruities that are inherent in the enterprise’s strategic objectives and could dramatically affect performance and adversely impact execution. These are the risks that really matter. Corporate strategy is governed by the willingness of an organization to accept risk in the pursuit of value creation, as well as its capacity to bear that risk. There are risks inherent in every successful organization’s business model for executing its strategy. This is a good thing. A winning business model exploits to a significant extent the areas in which the company excels relative to its competitors, including undertaking the risks inherent in executing the strategy.

A disciplined approach around protecting enterprise value should be integrated with the aspirational objectives established through strategy-setting. This approach should entail a robust “think-out-of-the-box” process for identifying and prioritizing the risks inherent in the strategy, identifying emerging risks, sourcing the risks and enhancing the strategy using the knowledge and insights gained through the process. Together, the two activities of strategy-setting and risk assessment facilitate the articulation of the critical assumptions underlying the strategy. These assumptions often relate to such things as the state of the global and domestic economy, expected competitor behavior, the regulatory environment, physical phenomena (e.g., earthquakes and weather), customer behavior, supplier performance and availability of effective channels during the planning horizon. Once these underlying assumptions are understood, management must consider relevant risk scenarios that could invalidate the assumptions and thereby impact the viability of one or more components of the strategy.

StRAtEgiC ChoiCES AlwAYS involvE RiSk

One way to support an assertion that strategy-setting and risk assessment should be integrated is to understand how and why risk is inherent in strategic choices. “Enterprise value” is the valuation placed upon an organization by its stakeholders. While value can be expressed in different ways, shareholder value is a measure of choice for

Four Strategic Choices:

1. CREATE new opportunities by investing in new business activities promising attractive returns relative to the cost of capital.

2. IMPROVE performance by either (a) increasing returns on existing business activities by improving policies, processes, competencies, reporting, technology and/or knowledge; or (b) acquiring a company to hold on to a premium position or reduce costs.

3. HARVEST existing value by withdrawing from business activities generating inadequate returns.

4. bALAnCE the creation and protection of enterprise value by considering explicitly management’s risk appetite as a tool for aligning the enterprise’s risk taking with its desired risk profile and adjust over time as circumstances change.

GOVERN

Risk AssessmentStrategy,

Capabilities and Infrastructure

Integration


many executives of public companies. Using enterprise value as a context, we can better understand how integrat-ing risk with strategy-setting can make a difference. There are four broad choices available to management in strategy-setting that impact enterprise value. Each of these choices influences the risk/reward balance.

1. cReATe new opportunities by investing in new business activities promising attractive returns relative to the cost of capital. Every successful business takes on risk in the pursuit of value-added opportunities. When management decides to enter into new markets, invest in new products, acquire another entity to reinvent the business model,5 build new plants to expand, accelerate disruptive change through technological innovation or exploit other market opportunities, inherent in these decisions are choices to take on risk. Often, these risks are compensated risks because the expected upside returns are regarded as sufficient to warrant taking them. They represent bets management decides to make, the board approves and, hopefully, investors support. A risk assessment is relevant to strategy-setting when it provides assurance to directors and executive management that risks are taken with knowledge – knowledge of the business, knowledge of the risks and knowledge of markets. Management should identify the priority risks inherent in the actions planned under the strategy and discuss the significant risks with the board. These steps signal to the board that management understands the performance variability and/or loss exposure arising from committing to its plan and that the business case supports a point of view that these risks are sufficiently compensated through the prospect for attractive returns. Effectively integrated with strategy-setting, a risk assessment should invigorate opportunity-seeking behavior by increasing the confidence of managers that they fully understand the downside and how much it might hurt if the outcome desired by the strategy is not achieved, and that they have the capabilities at hand within the organization to manage the risks they intend to take. This is where the articulation of the critical underlying strategic assumptions comes into play. Decisions to take on more risk should be focused on generating higher returns; the question is whether the resulting risks are acceptable as well as manageable at acceptable cost.

2. impRove performance by either (a) increasing returns on existing business activities by improv-ing policies, processes, competencies, reporting, technology and/or knowledge; or (b) acquiring a company to hold on to a premium position or reduce costs.6 A robust, comprehensive risk assessment for either a given business unit or prospective business target may identify risks that expose future revenue streams and cash flows to unacceptable performance variability. A rigorous risk assessment enhances the quality of the strategy and business plan (or merger integration plan) as well as their execution. For example, one multinational organization with a strong presence in more than 70 countries integrates the first two steps of its business risk management process – Identify Risk and Source Risk – with the risk assessment phase of its annual business planning process. The organization examines the risk profile in each of its group companies and evaluates how the business environment has changed or might change in the future. To develop a compre-hensive risk profile, executives analyze both internal risk factors and external market situations to determine where to focus the planning process and where the critical elements reside. This way they obtain useful in-sights as to the “soft spots” in the unit’s business plan, which tells them where to dig deeper. Once the risks are sourced, action plans for mitigating them are developed. These plans often involve improvements in policies, processes, people, reporting and systems to ensure that everything is properly aligned with the business plan. Risk responses can also involve improved monitoring of the vital signs in the external environment to assure continued validity of the critical strategic assumptions.

A RISK ASSESSMEnT IS RELEVAnT TO STRATEGY-SETTInG WHEn IT PROVIDES ASSURAnCE TO

DIRECTORS AnD ExECUTIVE MAnAGEMEnT THAT RISKS ARE TAKEn WITH KnOWLEDGE – KnOWLEDGE

OF THE bUSInESS, KnOWLEDGE OF THE RISKS AnD KnOWLEDGE OF MARKETS.

5 “The new M&A Playbook,” Clayton M. Christensen, Richard Alton, Curtis Rising and Andrew Waldeck, Harvard Business Review, March 2011.

6 Ibid.


3. hARvesT existing value by withdrawing from business activities generating inadequate returns. Eventually, changing markets, customer preferences and competitor actions give rise to decisions to exit a market or geographic area or to sell, liquidate or spin off a product group or business unit. These decisions must be carefully evaluated. When an activity has generated (or is expected to generate) returns that do not exceed a targeted rate of return or the cost of capital, managers need to understand the “relative riskiness” of the activity relative to other units, geographies, products or markets. If performance of an activity or a product is measured without considering the risk assumed in generating returns, an exit decision could result in withdrawal from a business or discontinuation of a product that is actually generating superior “risk-adjusted returns,” even though the gross returns, unadjusted for risk, may appear lackluster. The analysis supporting this assessment could be as crude as a risk map prepared for each business unit or product, or as sophisticated as deploying risk-adjusted performance measurement. An effective risk assessment will facilitate an evaluation of the strategic alternatives as well as understand the consequences of taking action to mitigate one risk relative to the impact on other risks. In addition to inadequate returns, decisions to exit a market or discontinue a product or practice may be driven by a determination by management and the board that the level of risk is excessive or unmanageable at acceptable cost.

4. BALANce the creation and protection of enterprise value by considering explicitly management’s risk appetite as a tool for aligning the enterprise’s risk taking with its desired risk profile and adjust over time as circumstances change. Every organization has a risk appetite, whether it acknowledges it explicitly or not. An organization’s risk appetite, or willingness to take risk, reflects both its capacity to bear risk as well as a broader understanding of the level of risk that it can safely and successfully manage for an extended period. Risk appetite represents executive management’s “view of the world” that drives strategic choices, and is expressed over time through an entity’s actions or inactions. It is inherent in the organiza-tion’s strategy and in the execution of that strategy, in the form of both risks taken and risks avoided. It is implicit in a company’s communications to the street, as investors can gauge the risk appetite of manage-ment based on the risks undertaken to fuel growth and create enterprise value. It is also a regulator driv-ing the other three strategic choices, CREATE, IMPROVE and HARVEST. During the strategy-setting process, companies that are serious about risk management strive to articulate their risk appetite and use the assertions comprising their risk appetite statement as a frame of reference in strategic discussions. An effec-tive risk assessment helps to ensure the company only takes those risks it is best equipped to manage within the parameters of its risk appetite, while minimizing exposure to those areas considered off-strategy. The question is: At what point does the company set its appetite for accepting risk of performance variability and/or loss exposure? Is it at or short of the point of (a) cancelling projects and deferring maintenance, (b) a profit warning, (c) a dividend cut, (d) the need to raise additional capital, (e) a loan default or ratings downgrade, or (f) insolvency? Can we stress test appropriate scenarios against the point at which we have defined our risk ap-petite? Should we adjust our risk appetite as new opportunities for creating enterprise value arise?7

These are the four strategic choices – CREATE, IMPROVE, HARVEST and bALAnCE – management has available to build and preserve enterprise value over time.8 These four choices are interrelated. For example, HARVEST may precede CREATE as part of a broader strategy to redirect capital to business

7 The focus of this discussion is on analyzing strategic risks; we will discuss the topic of risk appetite in a subsequent paper in this Early Mover Series.

8 Another choice is to ADJUST the weighted average cost of capital (WACoC) required of the company by lenders and the capital markets. WACoC is a determinant of shareholder value, as it is used to discount expected future cash flows to their present value. If a company’s returns are greater than WACoC, it is adding value; if less, it is shedding value. In this context, WACoC is a benchmark for investors to gauge where to put their money. In theory, if risk is reduced, the WACoC is lower; however, this concept is complex and difficult to make actionable in practice.

RISK APPETITE REPRESEnTS ExECUTIVE MAnAGEMEnT’S “VIEW OF THE WORLD” THAT DRIVES

STRATEGIC CHOICES, AnD IS ExPRESSED OVER TIME THROUGH An EnTITY’S ACTIOnS OR InACTIOnS.


activities with a more attractive risk/reward balance. As noted above, bALAnCE may be implicit in decisions to CREATE, IMPROVE or HARVEST.

Risk is integral to all four strategic choices; therefore, risk assessment should be integrated with strategy-setting. because the relative risks inherent in individual business activities and opportunities vary, the strategy-setting process should consider the risk equivalency of available alternatives. In addition, the critical assumptions underlying the strategy provide a glimpse into management’s view of the future business environment. In this context, risk assessment becomes a strategic tool when it contributes to this transparency, particularly when it is conducted concurrently with strategy-setting and within the context of a risk appetite statement.

thE ChAllEngE in AnAlYzing StRAtEgiC RiSkS

Analyzing strategic risks isn’t easy for several reasons. We’ll discuss four of them, although we’ve alluded to some already. First, strategic risks are not susceptible to precise measurement. Therefore, the analytical framework applied to them must be more qualitative in nature than for financial or operational risks. For example, interest rate risk is easier to quantify in terms of its impact on the business, taking into account potential changes in the economy and market volatility. On the other hand, strategic risks arising from invalid assumptions are more about obtaining sufficient knowledge regarding changes in economic trends, competitors, customers, suppliers, regulators and other external factors by monitoring them to evaluate whether disruptive change may be occurring or is about to occur. Such change may result in a deficient strategy due to one or more critical underlying assumptions that are no longer valid.

Second, strategic risks have a longer time horizon than other risks. by contrast, operational risks typically have a shorter horizon as they are often a function of the business planning cycle. Time horizon can be a significant factor in determining the currency of the organization’s risk assessment in a rapidly changing environment, and it also can impact management’s range of viable risk response options. For example, some issues, such as a capacity shortage to a manufacturing company, can be quite severe over the short term. However, most risks, including capacity, are less of an issue over the longer term because management has more flexibility to make adjustments. Flexibility in terms of strategic options may be vital to sustaining a strategy over time.

Third, because an effective strategy is about pursuing the best bets in the context of the enterprise’s desired risk/reward balance, strategic risks are often “compensated” risks because the potential for upside is sufficient to warrant accepting the downside exposure. For example, the risks associated with initiating operations in new markets, introducing new products or undertaking large research and development projects are compensated risks because they are often inseparable from executing the enterprise’s strategy. by contrast, uncompensated risks are one-sided because they offer the potential for downside with little or no upside potential; that is, every foreseeable future outcome results in net cash outflows, creating a loss exposure (such as environmental, health and safety risks where, over the long term, there is very little, if any, upside to cutting corners and taking shortcuts that accumulate over time and create unacceptable risks). Our expe-rience is that most people think of risks as “uncompensated.” That mind-set presents a challenge when integrating risk assessment with the strategy-setting process, particularly when the assessment process has traditionally focused on uncompensated risks.

STRATEGIC RISKS ARE nOT SUSCEPTIbLE TO PRECISE MEASUREMEnT; THEREFORE, THE AnALYTICAL

FRAMEWORK APPLIED TO THEM MUST bE MORE qUALITATIVE In nATURE THAn FOR FInAnCIAL OR

OPERATIOnAL RISKS.


Finally, strategic risks are more about what we don’t know. What sets strategic risks apart from other risks is that they may arise from uncertainties requiring ongoing monitoring of the environment to ensure strategic assumptions remain valid over time. “Industry dissonance” occurs when a company’s strategy no longer reflects marketplace realities. Industry dissonance is the risk that strategic assumptions are lagging behind industry realities and the corporate strategy does not reflect the new conditions.9 Whether it arises consciously or from a lack of knowledge, this deficiency can be fatal. Competitive intelligence is an integral part of responding to strategic uncertainties. If the intelligence function is not driven by factors relevant to the critical assumptions underlying the strategy, the organization is at risk that intelligence gathered will miss the full picture.

AnAlYzing StRAtEgiC RiSkS – A ContRARiAn APPRoACh

At the root of every flawed strategy is one or more underpinning assumptions about the future that eventually prove to be erroneous.10 The financial crisis will long be a top-of-mind example of this business reality. The “volume-and-speed” business model in subprime lending pursued by many financial institutions assumed, among other things, a stable housing market, suggesting housing prices were a critical driver of their success. If a risk assessment had been performed at the time this strategy was formulated, it is likely questions would have arisen to challenge whether it was realistic for management to expect this assumption to hold up over the time horizon addressed by the strategy. A relevant risk scenario might have been as follows, assuming a strategic time horizon of three years:

A significant deterioration in all major segments of the housing market occurs in the United States over the next three years, leading to a severe recession.

The likelihood of this scenario developing would have been evaluated based on historical trends, current economic outlook and other factors. If an institution had paid heed to a scenario as described above, it would likely have asked the tough questions around what would happen if the housing market, in fact, took a severe hit. For example: Do we need a limit structure in place to set boundaries on our loan and counterparty concentrations in this market segment to keep our exposure at an acceptable level? Do we need to examine our loan underwriting and documentation standards? Do we need to look at how we are compensating people who make lending decisions to ensure we are incenting sound behavior over time? How often should we stress test our loan portfolio against this extreme scenario? Do we need an exit plan? These and other questions, and the discussions they stimulate, might have led to a more robust strategy to protect enterprise value for those institutions with the will and discipline to act according to a predetermined plan for managing risk.

One approach to analyzing strategic risks is to use contrarian assertions to strategic assumptions. Contrarian thinking is driven by understanding the critical strategic assumptions and the scenarios that could impair or invalidate them. The approach works as follows:

Define Strategic Assumptions

Develop Contrarian Statements

Analyze Contrarian Statements

Articulate Implications of

Contrarian Statements

AT THE ROOT OF EVERY FLAWED STRATEGY IS OnE OR MORE UnDERPInnInG ASSUMPTIOnS AbOUT

THE FUTURE THAT EVEnTUALLY PROVE TO bE ERROnEOUS. – RoBeRT simoNs

9 The term “industry dissonance” was developed by ben Gilad in his book, Early Warning: Using Competitive Intelligence to Anticipate Market Shifts, Control Risk, and Create Powerful Strategies. He attributed the term to Leonard Fuld. The author’s point is that firms that dominate their markets experience difficulty in reacting to changes in the business environment.

10 “Stress Test Your Strategy,” Robert Simons, Harvard Business Review, november, 2010.


Begin by defining your strategic assumptions. A useful analytical framework for strategic risks is to focus on the impacts that could seriously damage the company – these are the impacts of disruptive change that invalidate the critical assumptions underlying the strategy. While death, taxes and the sun rising and setting every day are fundamental truths we can count on, most everything else is an assumption about the future. Strategic assumptions represent management’s “view of the world” for the duration of the strategic planning horizon. They pertain to such drivers as: the enterprise’s capabilities; competitor capabilities, behavior and actions; customer preferences and bargaining power; supplier availability, performance and bargaining power; technological trends and innovation; capital availability; legal and regulatory trends; and absence of catastrophic physical phenomena, among other things. Each assumption generally contains an implicit expectation regarding one or more of these (or other) drivers; collectively, all of the assumptions provide a foundation for understanding sources of uncertainty in the strategy through identification of relevant scenarios. In effect, strategic assumptions are management’s “white swans” because they reflect management’s views regarding the environment in which the “extended end-to-end enterprise” will operate during the planning horizon.11

If the company uses a strategy articulation map in articulating its strategy, the assumptions can be developed using this tool.12 A well thought-out SWOT (strengths, weaknesses, opportunities and threats) analysis is one possible source of inputs into this exercise, as it is often used to identify the internal and external factors that are favorable and unfavorable to achieving a desired end state or strategic objective. If the company doesn’t have a clearly articulated strategy, the focus may be on the assumptions underlying its business model. Porter’s Five Forces is an example of a framework that provides a useful context for identifying critical assumptions about a

11 Surviving and Thriving in Uncertainty: Creating the Risk Intelligent Enterprise, Frederick Funston and Stephen Wagner, 2010, pages 86-87.12 “Strategy articulation maps” are discussed on pages 4 and 5 of Protiviti’s white paper, Performance/Risk Integration Management Model –

PRIM2: The Convergence of Corporate Performance Management and Risk Management, available at www.protiviti.com.

Steps for Reviewing Critical Assumptions and Contrarian Statements:

1. Define the company’s strategic assumptions that are implicit in its strategy.

2. Select the most critical assumptions for further review.

3. For the selected assumptions, develop a corresponding contrarian statement.

4. Select the highest-impact contrarian statements for further review.

5. For the highest-impact contrarian statements, brainstorm relevant scenarios.

6. Consider relationships and similarities among scenarios to narrow down the list to a manageable level.

7. Rate the list of selected scenarios for impact, persistence and velocity.

8. For the scenarios with the most significant effect on the company, identify drivers evidencing that the scenarios are developing or have occurred.

9. Identify key risk indicators (KRIs), trending metrics and other relevant information, monitoring processes and techniques, and response readiness plans.

STEPS 1 AND 2Define Strategic Assumptions


company’s relative positioning in its industry.13 All told, the key is to identify and constructively challenge the key assumptions or drivers to making the strategy or business model work.

Once the strategic assumptions are identified, those most critical should be selected by management for further analysis. While this is a matter of judgment, it boils down to selecting the assumptions that management would most fear becoming invalid. In addition, an assumption germane to one strategic initiative may overlap with an assumption defined for another strategic initiative. The alternative is to weight all assumptions the same, sub-jecting them all to further review. We do not recommend that approach. The purpose of a filtering exercise is to eliminate assumptions that may not be as important as others.

In summary:

1. Define the company’s strategic assumptions that are implicit in its strategy.

2. Select the most critical assumptions for further review.

develop contrarian statements for the most critical assumptions. These statements are the “antithesis” to the strategic assumptions (i.e., they negate the assumptions). If the strategic assumptions are management’s “white swans,” the related contrarian statements are potential “black swans.”14 While we don’t necessarily know the event or combination of events that could invalidate the assumptions during the strategic planning horizon (or some other horizon), we can seek to understand more clearly how much it would hurt if they were rendered invalid. This brainstorming exercise enables management to understand how bad the pain can get in case management’s “worst case” scenarios aren’t severe enough. A contrarian statement is most useful when it is specific enough to constitute a clearly stated scenario (i.e., a “contrarian scenario,” which refers to an event or a combination of events that would undermine the assumption).

Once the contrarian statements are defined, management should select those that would have the greatest impact on the company if they were to transpire. These are the contrarian statements management needs to examine more closely, as they reflect the most likely impacts of disruptive change.

In summary:

3. For the selected assumptions, develop a corresponding contrarian statement.

4. Select the highest-impact contrarian statements for further review.

For the highest-impact contrarian statements, analyze the plausible and not-so-plausible scenarios that could make them happen. The contrarian statements with the highest impact are those that will create the greatest opportunity or the most damage. These statements should reflect situations that would likely arise from

13 Competitive Strategy: Techniques for Analyzing Industries and Competitors, Michael Porter, 1989, page 4. While the Five Forces model represents a comprehensive view of how competitive behavior works, it implies, from the risk-return perspective, that risk-adjusted rates of return should be constant across firms and industries, an assertion with which some do not agree.

14 Funston and Wagner, Surviving and Thriving in Uncertainty: Creating the Risk Intelligent Enterprise.

STEPS 3 AND 4Develop Contrarian Statements

STEPS 5 – 8Analyze Contrarian Statements


events about which the organization currently lacks sufficient information and that management would likely rationalize after the fact: “Why didn’t we see it coming?” The question is whether one or more of the critical strategic assumptions require further review. In other words, does the high-impact contrarian statement reflect the scenario(s) management deems relevant? If management isn’t satisfied that it does, further analysis is required.

In instances requiring additional analysis, management should focus on identifying other scenarios involving an improbable event or a combination of events that could occur in the future and make the contrarian statement a reality. One approach is to brainstorm these scenarios using exercises and processes that encourage out-of-the-box thinking. To suit management’s purposes, scenarios may reflect the best case and worst case, and include those that are credible and presumptive, as well as those that may be extreme, absurd and even unthinkable. For example, some of the “structural determinants” underlying Porter’s Five Forces may contribute to formulating relevant contrarian scenarios.15 Porter also suggests that an organization formulate competitor assumptions about itself, the industry and other companies in it.16 Additional scenarios can be used to further refine management’s under-standing of the impact of invalid assumptions on the profitability and viability of the company’s business model.

Once scenarios have been identified, management should consider their relationships and similarities and either combine scenarios or eliminate scenarios based on its judgment. During this assessment, should management determine that certain scenarios are significantly more likely to occur, this consideration would probably influence its selection of them. However, it would be a mistake for management to rule out extreme events that could significantly disrupt or displace the company’s “ability to play.” All told, the final list of scenarios should be a workable number that is evaluated using appropriate attributes, such as impact, persistence and velocity:

impact identifies the scenarios that could have a large and potentially catastrophic effect on the viability of the company’s strategy and business model (i.e., a disruptive change).

persistence identifies those scenarios that will continue to impact the company for a specified time horizon (i.e., beyond the strategic planning horizon or some other appropriate longer-term period).

velocity prioritizes scenarios for which the company needs to develop a rapid response requiring an effective contingency plan. Many strategic risks have a low velocity (e.g., the disruptive displacement effect of a competitor’s vastly superior new product concept doesn’t necessarily occur overnight).

Likelihood is not as significant a factor at this stage. It is already considered, at least implicitly, when manage-ment selects scenarios for analysis. Due to their nature, many strategic scenarios identified in contrarian thinking are either inevitable or highly unlikely to occur. The inevitable assumptions, such as expected technological trends or new regulations following a high-profile scandal, are likely already factored into management’s thinking and business planning. Since the intent in analyzing strategic uncertainties is to move away from the “known knowns” and focus on the things we don’t know enough about (including the improbable), an

11

2

2

3

3

4

4

5

5

6

6

7

7

8

8

9

9

TemporaryFleeting

Numerical references refer to different scenarios.Size of bubbles represents the relative velocity of the scenarios.

PERSISTENCE

IMPA

CT

Moderate Enduring Permanent

3

7 5

1

4

68

2

3

4

Illustrative Evaluation of Scenarios

15 Porter, Competitive Strategy, pages 5-29.16 Ibid, pages 58-67.


evaluation of likelihood generally does not result in distinguishable results. Accordingly, we consider per-sistence more relevant than likelihood when performing contrarian analysis. The higher the persistence, the greater the potential disruptive displacement effect of the scenario. Therefore, the primary focus is on impact and persistence, while velocity is considered a secondary factor.

Scenarios with the highest impact and persistence are further reviewed to identify the drivers evidencing that the scenarios of concern are either developing or have occurred. This analysis may require additional perspective or research directly related to the potential scenarios. It will feed the development of implication statements, the last step of the contrarian analysis process.

In summary:

5. For the highest-impact contrarian statements, brainstorm relevant scenarios.

6. Consider relationships and similarities among scenarios to narrow down the list to a manageable level.

7. Rate the list of selected scenarios for impact, persistence and velocity.

8. For the scenarios with the most significant effect on the company, identify drivers evidencing that the scenarios are developing or have occurred.

Articulate the implications of high-impact contrarian statements. This step is the payoff, the end game. An implication statement represents the synthesis point of view: It resolves the conflict between the thesis (stra-tegic assumption) and antithesis (contrarian statement) by reconciling their common truths and forming a new proposition.17 In effect, implication statements address two questions – “What do we do if the critical assumption underlying our strategy is no longer valid?” and “How would we know if our assumption is no longer valid?” As with many strategic uncertainties, action plans arising from an implication statement will often include implementing new trending and other metrics to monitor the vital signs germane to the strategic exposures we are most concerned about. They also may result from consideration of multiple options for responding to the improbable events that really matter. Here management decides on (a) the appropriate KRIs, trending metrics and other information to be incorporated into the scope of the competitive intelligence function with the intent of creating an early warning system,18 and (b) the appropriate response plans needed to increase the company’s response readiness for high-velocity scenarios. A statement describing the steps management should take to address the strategic uncertainties the company faces is called an “implication statement.”

In summary:

9. Identify KRIs, trending metrics and other relevant information, monitoring processes and techniques, and response readiness plans.

17 Surviving and Thriving in Uncertainty: Creating the Risk Intelligent Enterprise, pages 86-87.18 Early Warning: Using Competitive Intelligence to Anticipate Market Shifts, Control Risk, and Create Powerful Strategies, ben Gilad, 2004,

pages 59-62. Maximizing the value of competitive intelligence is addressed in the second paper in Protiviti’s Early Warning Series.

STEP 9

Articulate Implications of

Contrarian Statements

THE InTEnT OF AnALYzInG STRATEGIC UnCERTAInTIES IS TO MOVE AWAY FROM THE “KnOWn

KnOWnS” AnD FOCUS On THE THInGS WE DOn’T KnOW EnOUGH AbOUT.


While we can never say with certainty that we know what we don’t know, we can apply techniques that force knowledgeable managers to think strategically on a comprehensive basis by focusing on the big picture. The “pre-mortem technique”19 we described earlier is an example of a process for getting managers engaged in con-trarian, “devil’s advocate” thinking without encountering resistance. The idea is to assume a strategic assumption is no longer valid, provide the reason(s) why from a point in time in the future, and explain what that develop-ment (i.e., an event or a combination of events) might mean. If management doesn’t like what it sees as a result of this analysis, then steps should be taken to improve early warning capabilities and response readiness. Failure to do so would be like flying at night into a fog bank without instrumentation or the ability to read instruments.

Following are examples of contrarian analysis using three familiar examples:

19 The Power of Intuition, Gary Klein, 2003, pages 98-101, 131.

Strategy Key Assumptions Contrarian Statement Implication Statement

For a financial institution: Leverage cheap money to achieve volume and speed in lending to the low-income housing sector

For a utility: Operate a nuclear power station in Japan near a quake zone by the ocean located on a bluff between 14 and 23 feet above sea level

For a manufacturer: Reduce costs and maximize quality through a single-source supplier for a significant component part

Increasing or stable housing prices, continued availability of cheap money and continued economic growth, among other things

Presume a worst-case scenario of an earthquake causing a tsunami of more than 20 feet as extremely low risk

Presume no significant disruption of supply from this particular supplier

To the assumption regarding increasing or stable housing prices: The housing market takes a significant dive in all major markets, hitting all segments of the loan portfolio

A 40+ foot tsunami hits the plant location site, a 1,000-year event based on available geological studies

A major catastrophe creates a protracted disruption in either the supplier’s operations or the logistics for transport-ing components from the supplier’s plant to the company’s facilities

Monitor housing market indicators in all major markets with significant loan portfolio concentra-tions, as well as test housing prices by selling selected assets from time to time; evaluate adequacy of underwriting standards and ensure balanced compensation structure

Evaluate the plant’s safety planning in light of a catastrophic tsunami scenario, including its backup power facilities for avoiding a loss of power

Ascertain the adequacy of the supplier’s evaluation of exposure to second- and third-tier suppliers and contingency plans for dealing with supply disruption, the length of time the company can operate at current levels given the extent of inventory it retains on hand, and the supplier’s expected ability to recover; if there is a signifi-cant gap between the duration of the company’s ability to sustain normal operations and the supplier’s expected recovery period, consider the feasibility of arranging alternative suppliers


Why engage in contrarian thinking? As one author pointed out:

At some point your products will become obsolete, your customers’ tastes will change, or technology will render your business model uncompetitive. Today’s successes will be tomorrow’s old news. The question is not if, but when.20

It is evident that the time frame within which newer technologies and products are rendering older ones obsolete is compressing, which makes the “when” even more unpredictable.

A disruptive change doesn’t always arise suddenly from an epic earthquake or a 1,000-year tsunami event. The business model of the brick-and-mortar movie rental business has been under attack for years through other alternatives offered to consumers. The vital question is whether a company can fall so in love with its business model and strategy that it fails to recognize changing paradigms until it is too late. Or whether it can rationalize away the improbable event without considering the consequences of being unprepared if the event were to happen.

While we don’t know for sure what will happen that could invalidate our strategic assumptions in the future, we can count on the validity of our assumptions coming under question as the business environment changes over time. The “contrarian thinking” process forces managers to think out of the box, challenge assumptions constructively in a safe environment without fear of reprisals, and develop new ideas that can help make the strategy more robust. Most important, the exercise may tell managers more about the knowledge and information they need to obtain and monitor to address their uncertainty around what they don’t know – laying the foundation for an early warning capability. The objective is clear: Avoid the “industry dissonance” malady that can lead to failure to anticipate or recognize a “strategic inflection point.”

Examples of Disruptive Innovations

Cassettes

Mainframe Computers

CRT Analog TV Sets

Light Bulbs/Tube

Landline Phones

Compact Discs

Personal Computers

Projection/Plasma TV Sets

Compact Fluorescent Lamps

Cell Phones

MP3 Players/iPods

Laptops/Tablet PCs

LCD/LED TV Sets

LED Lighting

Smartphones

15-20 Years 2-5 Years

20 “Stress Test Your Strategy,” Simons.


Do PRoBABilitY ASSESSMEntS AlwAYS MAttER?

before we wrap up our discussion of analyzing strategic uncertainties, the last two sections of this paper deal further with two topics we’ve already touched on briefly. When evaluating strategic risks, how much emphasis should be given to probabilities? While they can’t be ignored, the real question is how much weight should we place on them. If management assumes that the events considered “most likely” are those that will always happen and that no attention should be given to “high-impact, low-likelihood” events beyond “reassessing them at some time in the future,” recent events such as the tragedy in Japan suggest they may be making a big mistake.

We’ve pointed out that one approach for management to consider is to address persistence and velocity when evaluating “high-impact, low-likelihood” events. In addition, we add a third factor: response readiness:

•The velocity or speed to impact (i.e., do we expect the impact to be immediate or sudden, allowing for very little reaction time, or will the effect smolder slowly over time before the wave crests and the full impact is realized?)

•The persistence of the impact (i.e., what is the duration of time over which the effect of the event will gather and sustain momentum, creating ongoing headline exposure?)

•The company’s response readiness (i.e., what is the organization’s resiliency in responding to the event?)

The latter factor should be considered when formulating implication statements.

As noted earlier, the question here is not whether the “high-impact, low-likelihood” event will happen, but what the organization will do if it does. How severely will the improbable event affect the company? Is the company prepared? If yes, how does management know? Is there an effective response plan? Have viable strategic alternatives been thought through? If the answer is no, what is the cost from a sustainability, reputation and brand image standpoint if the improbable event were to occur and the company were unprepared? In just about every case, this cost represents an uncompensated risk, meaning there is no upside if the improbable high-impact event were to occur. In fact, the only “compensation” results from not expending any resources preparing for the improbable. The “we don’t have time for this” mentality results in a lack of preparedness, which only makes the effect worse. Sooner or later, every company faces a crisis. As a crisis is a severe manifestation of risk, crisis management is the natural follow-on to risk management. Rapid response to sudden, unexpected events depends upon the enterprise’s crisis management capabilities. Fires cannot be fought with a committee.

The good news is that strategic risks often have a low velocity. A competitor’s new product concept or customer fulfillment process that is superior in quality with comparable cost or delivered faster at lower cost with com-parable quality can be a game changer, leaving a company playing out a losing hand with its existing business model. As we indicated earlier, this disruptive displacement effect doesn’t necessarily occur overnight. For example, the displacement effect of automobiles didn’t occur until after Henry Ford invented the produc-tion line involving interchangeable parts and optimally planned logistics to create a finished product much faster and at lower cost than handcrafting-type methods, making mass production and an affordable vehicle feasible. Until that occurred, many were of the view the automobile was a rich man’s toy.

THE qUESTIOn IS nOT WHETHER THE “HIGH-IMPACT, LOW-LIKELIHOOD” EVEnT WILL HAPPEn, bUT

WHAT THE ORGAnIzATIOn WILL DO IF IT DOES.


A SinglE viEw of thE futuRE CAn BE vERY RiSkY

Given the complexity of the business environment, executives need to be careful to avoid overconfidence that can be bred by a single or “official” view of the future. Overconfidence is a powerful source of illusions, and is often driven by the degree of success managers have experienced and the quality and coherence of the storyline they construct regarding the future they envision. “What if” scenario planning and stress testing are tools for evaluating management’s “view of the future” by visualizing different future conditions or events, what their consequences or effects might be like, and how the organization can respond to or benefit from them. because these tools avoid the “blind spot” of a single view of the future by focusing management on identifying the likely direction and order of magnitude of the effects of changes that affect the drivers of the enterprise’s revenues, costs, profits and market share, they are an important consideration in contrarian analysis.

Scenario planning starts by dividing knowledge into two broad domains:

Scenario planning can help management cope with uncertainty. The art of scenario planning lies in blending the known with the unknown into a limited number of internally consistent views of the future spanning a wide range of possibilities. Scenario planning and stress testing help management challenge assumptions and expectations, address “what if” questions, and identify sensitive external environment factors that should be monitored going forward. by deepening their understanding of the pain of the unexpected, management can identify when contingency plans are required and reinforce the need for flexibility in executing the strategy. Management must be committed to the scenario-planning exercise to ensure it is sufficiently robust and discriminates the vital signs on which the company must focus.

Things we believe we know something about. These include established contracts, demographic shifts, consumer behavior and other factors that essentially cast the past forward, recognizing that the environment possesses some level of momentum and continuity.

Things we know could occur, but don’t know if or when. These events are uncertain in terms of either their impact or likelihood. They represent true uncertainties such as future interest rates, rates of innovation, market fads and fashions, and outcomes of political elections.

Known Knowns

Known Unknowns

OVERCOnFIDEnCE IS A POWERFUL SOURCE OF ILLUSIOnS, AnD IS OFTEn DRIVEn bY THE DEGREE OF

SUCCESS MAnAGERS HAVE ExPERIEnCED AnD THE qUALITY AnD COHEREnCE OF THE STORYLInE THEY

COnSTRUCT REGARDInG THE FUTURE THEY EnVISIOn.


SuMMARY

Extrapolating from the past into the future as if the status quo and what we know from the past gives us clues as to how the future will unfold is fundamentally flawed. Such practices will not capture the turbulence and displacement effect of market forces. Every organization should ask the following question: Do we devote enough attention to thinking about what we don’t know? An indicator of the quality of the assessment process is the extent to which the risks considered represent a potential event or combination of events that we currently know to be possible, but it is unknown whether or not they will materialize. The more “unknowns” a company is able to identify and evaluate in the risk assessment process, the more effective the process will be and the more anticipatory and better prepared the company will be as it faces uncertainties in the future.

because the business environment is constantly changing, strategy-setting is a dynamic process that never ends. The same applies to risk assessment. In the aftermath of the financial crisis, it is clear that markets and key stakeholders expect companies to understand their risks and risk management capabilities and to align them with the corporate strategy. They want more transparency in reporting on the organization’s key risks and approach to risk management. none of this is possible unless the enterprise first identifies and prioritizes its most significant risks and implements actionable plans to manage them. This means integrating risk assessment with strategy-setting, with a strong focus on improving the chances of delivering expected performance. It means forcing thoughtful dialogue, leading to a more robust business strategy and continuous improvement in the capabilities for managing critical enterprise and emerging risks. It means aligning competitive intelligence with strategy-setting and the most current risk assessment results to create an early warning capability. Simply stated, it means giving executive management early mover options.

The contrarian approach to analyzing strategic risks and scenario planning are effective tools for achieving these outcomes. Through the process of integrating strategy-setting and risk assessment, executive management and the board of directors can decide how to face potential disruptive change in the future – as a creator of, an accelerator of, or a reactor to change. Understanding risks and how they are managed used to be the threshold for most companies. now the bar is raised. If no longer an afterthought to strategy-setting or an appendage to performance management, risk management can instill greater confidence in the board of directors and management that the corporate strategy can be successfully executed and the business plan and performance goals achieved. Deciding what to do and how to do it only comes after the vital strategic risks are prioritized through an effective risk assessment. If managers are not devoting sufficient time to thinking about the unthinkable, they are not thinking strategically.

“IF EVERYOnE IS THInKInG ALIKE, SOMEOnE ISn’T THInKInG.” – geoRge s. pATToN


wAnt to know MoRE?

As previously mentioned, Protiviti has published a white paper titled Performance/Risk Integration Management Model – PRIM2: The Convergence of Corporate Performance Management and Risk Management. Whether a company is rapidly growing, focused on establishing sustainable competitive advantage or improving its bottom line, it must consider how an integrated approach and discipline to deploy strategy while also anticipating and managing the associated opportunities and risks will improve its probability of achieving strategic objectives. In this white paper, Protiviti discusses an enterprisewide program that places performance management, risk, and risk management in a broader strategic context by:

•Creating real-time transparency into the operations of the enterprise to measure current performance and predict future trends in order to establish and maintain alignment of strategy, risk management capabilities and performance management processes in a changing business environment;

•Proactively identifying, sourcing and mitigating the risks inherent in the strategy, including the critical underlying assumptions, and understanding how the enterprise’s risk profile relates to its risk appetite;

•Communicating and deploying strategy effectively in a consistent manner across the enterprise; and

•Ensuring the seamless integration of strategic plans, performance management and risk management in the execution of the strategy.

The PRIM2 white paper is available at www.protiviti.com.

GOVERN

Risk AssessmentStrategy,

Capabilities and Infrastructure

Integration

Key Metrics and Targets

Integrated Business Planning

Monitoring and Evaluation

Corporate Performance Management Infrastructure

Realign and Achieve

Execute

Manage

ABout PRotiviti

Protiviti (www.protiviti.com) is a global business consulting and internal audit firm composed of experts specializing in risk, advisory and transaction services. We help solve problems in finance and transactions, operations, technology, litigation, governance, risk, and compliance. Our highly trained, results-oriented professionals provide a unique perspective on a wide range of critical business issues for clients in the Americas, Asia-Pacific, Europe and the Middle East.

Protiviti has more than 60 locations worldwide and is a wholly owned subsidiary of Robert Half International Inc. (nYSE symbol: RHI). Founded in 1948, Robert Half International is a member of the S&P 500 index.

PRotiviti’S SERviCES

PRIM2 is a framework for converging and integrating strategy-setting, performance management and risk management with the objective of positioning the company as an early mover. Protiviti’s services help your organization realize this convergence by delivering deep business insight based on a holistic view of the enterprise. Our Corporate Performance Management (CPM) services address the business challenges facing the corporate finance office and operational decision-makers throughout the organization. Using best-of-breed, state-of-the-art CPM software, our clients have fast and easy access to trusted CPM financial, operational and risk information, enabling a deep understanding of how value is created and protected, and delivering strategic insight so decision-makers can better anticipate future business outcomes and receive better information for decision-making.

We also recognize that risk is an important and vital aspect of managing an enterprise and delivering performance against strategic objectives. Our comprehensive risk management services complement our CPM solutions by helping companies improve their enterprisewide capabilities to identify, source, measure, manage and monitor the critical risks inherent in their corporate strategy and business plans, while incorporating the foundational risk management and controls provided by powerful governance, risk and compliance (GRC) application software tools. The objective is to enhance strategy-setting and performance management with the intent of positioning the enterprise to become an early mover.

For more information about the issues discussed in this white paper and Protiviti’s services, please contact:

© 2011 Protiviti Inc. An Equal Opportunity Employer.

PRO-0711-101034 Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer attestation services.

Jim DeLoach Managing Director +1.713.314.4981 [email protected]

Jay Thompson Managing Director +1.713.314.4923 [email protected]

Performance/Risk Integration Management Model – PRIM2 · Performance/Risk Integration Management...

Documents

Transcript of Performance/Risk Integration Management Model – PRIM2 · Performance/Risk Integration Management...