Fundamentals of Risk Management

Core business processes
227
strategy and tactics
Business strategy is the statement of what the organization intends to achieve and 
how it plans to achieve it, and is based on the strategic decisions about the future of 
the organization. Establishing a detailed business strategy enables the organization 
to deliver its mission, objectives, strategy and plans. The overall objective of risk 
management input into strategy is to ensure effective and efficient strategy and
strategic decisions that will deliver the desired outcomes.
The main risk management input into business strategy is likely to be risk assess-
ment. This is a critical component for the formation of strategy. Risk assessment of 
the existing strategy and any proposed new strategy should be undertaken. If clear 
strategic options are present, then a risk assessment of each of the viable options 
should be undertaken individually.
Some organizations exist in a very competitive marketplace that is undergoing 
significant technological changes. In these circumstances, there are significant risks 
associated with the business and huge strategic decisions have to be taken. Often, 
these decisions are related to developments in technology that challenge the way in 
which the organization delivers customer solutions. Changes in technology can require 
huge and speculative investment decisions and these decisions establish the tactics 
that will be implemented. The investment decisions may be speculative because of 
untested new technology or because there are alternative technologies available.
A risk assessment of strategic options needs to be undertaken, including an ana-
lysis of stakeholder expectations, existing customer requirements and existing staff 
skills, as well as a strengths, weaknesses, opportunities and threats (SWOT) analysis. 
The strategic options available to the company might include joint ventures, out-
sourcing the work, sub-contracting or investing in new technologies.
Detailed risk assessment of strategic options will ensure that the board has the 
best available information in order to make correct strategic decisions. Events and 
other circumstances that could reduce the successful delivery of strategy should be 
identified during the risk assessment. The organization will then be able to decide the 
controls that should be put in place to optimize the likely impact if any of these risks 
materialize.
Often, strategic objectives will relate to the development of a business sector and 
the reputation of the organization within that sector. In this way, the enhancement
of reputation and the development of individual brands become opportunity risks 
for the organization. The fundamental importance of brand and reputation is con-
sidered in more detail in Chapter 20.
Tactics are the means by which the organization will deliver the business strategy. 
Tactics need to be correctly selected, implemented and controlled to ensure the
effectiveness and efficiency of operations and they should also deliver reliability of 
financial reporting and compliance with applicable laws and regulations. The intended 
outcome is effective, efficient and compliant core business processes.
Changes to core processes are delivered by projects, and the importance of risk 
management in projects is discussed in Chapter 31 of this book. When undertaking 
a project, the organization needs to be concerned about the risks within the project 
that could stop it being delivered on time, within budget and to specification.

---