Representatives of different sectors of the economy – our clients among them – often ask us, as risk management consultants, whether there are simple and clear methods, accessible even to non-specialists, that would help to assess, at least roughly, the risks of developing new strategic business lines, large investment plans and the like. Sometimes up to ten possible strategies are evaluated while a strategy is being developed. Each of them carries its own set of risks, often catastrophic ones. So is there a way to display quickly and concisely the business risks that stand in the way of your organization's strategic goals? How can you describe in a few pages the details of these risks and the actions to reduce or eliminate them, set and allocate the timeframes for the work, define the measures of success and name the people responsible for delivering it?

This can be done by building a risk map of your organization or of a separate strategic line of business development.

What is a risk map and why is it useful?

A risk map is a graphical and textual description of a limited number of an organization's risks, arranged in a rectangular table. One "axis" of the table shows the impact or significance of the risk, and the other shows the probability or frequency of its occurrence. Figure 1 shows an example of a risk map.

What you can do yourself: the process of building a risk map.

In general, risk mapping is part of a systematic methodology covering all aspects of a company's activity, which makes it possible to identify an organization's risks, prioritize them and assess them quantitatively (split them into classes). The methods consultants use when drawing up a risk map include interviews, formal and informal questionnaires, industry reviews and studies, analysis of the company's documentation, numerical assessment methods and so on. It should be noted that when financial risks are being assessed, a quantitative analysis of the company's financial statements is what matters most. Naturally, the individual characteristics of the client company and its needs dictate the appropriate method of collecting and analyzing data.

We will describe an example of a do-it-yourself risk mapping process aimed at identifying the risks that are critical for an organization (those that threaten its existence), bringing only the main steps to the fore. These steps include initial training, defining the boundaries of the analysis, forming the team, time horizons, scenario analysis and ranking, setting the risk tolerance boundary, drawing up an action plan, and quantitative assessment and modeling techniques.

Initial training.

When drawing up an organization's risk map, it is very important that at least one or two of the company's employees complete training in the basics of risk management. They will later help establish a dialogue among the team members and lead the whole team through the mapping process. This calls for preliminary training, which can last from one to five days. In our experience, the best result is achieved when the introductory workshops last two to three days. The role of such a trained employee is that of the manager of the risk mapping process inside the company, keeping the team constantly focused on the goal. Where specialist subject expertise is required, an expert can be brought into the team. Of course, if your organization has a large number of competent specialists, this will strengthen the team.

Do not entrust the work to amateurs. If you do not intend to engage consultants, train your own employees.

Boundaries of the analysis.

The boundaries of the analysis, which determine which areas of business decision-making the mapping affects, are set at the initial stage of the process. Risk management consultants also do this at the first stage of surveying an organization. In the example under consideration we will define the boundaries as the identification, prioritization and understanding of all the risks that prevent the achievement of corporate strategic goals in implementing a specific strategic plan. Note that the boundaries of the analysis can be as broad or as narrow as the organization wishes. However, a balance must be kept between the breadth of the boundaries, the depth of the information and the value of the information that will be obtained from the risk mapping process. For example, the value of a single risk map for the whole company may be considerably lower than the value of risk maps for each business unit or for some single business entity of the company, or it may be the other way round.

First decide on the objectives, the availability and the cost of information. Only then outline the boundaries of the analysis for building the risk map.

Composition of the team.

The composition of the team is critical to the success of the risk mapping process. When the work is carried out by professional consultants, the team (working group) usually includes the company's top management, that is, those specialists who have the experience and expert knowledge. In the case of do-it-yourself risk mapping, the consultant is in essence the "collective intelligence" of the organization's top management, guided by the trained employees. Experience shows that a team works effectively when it consists of six to ten people.

Only once the boundaries of the analysis have been set can you decide who joins the team. When mapping a company's strategic risks, for example, the team includes the chief executive, the head of the finance department, the head of treasury, the heads of the legal, internal control and IT departments, and the head of the strategic planning department, if the company has one. If the company already has a risk management department, its head is of course included in the working group.

For narrower boundaries, such as identifying and mapping the risks of a specific division or operating business unit, the team will consist of the top managers of that division's management team. Or, if the risks of a particular area of activity such as e-commerce are being analyzed, the team will be formed from senior representatives of the relevant functional areas and of those divisions whose interests are affected.

Most importantly, the team should represent the institutional knowledge of its company as fully as possible and should include top management.

Scenario analysis and ranking.

At this step the team conducts a guided brainstorming session to identify all the company's potential risks under the given development strategy, together with the scenarios that accompany their occurrence. Once they have been identified, the risks and scenarios are discussed, a consensus is reached and a written description of the scenarios is prepared. The key elements of each scenario are the company's "vulnerability" (the object of risk), the "trigger mechanism" (the risk factors) and the "consequences" (the size of possible losses).

A vulnerability, or object of risk, is an asset of the company that is exposed to potential threats. Trigger mechanisms (risk factors) cause negative consequences for the objects of risk. Consequences are expressed in terms of the nature and size of the losses resulting from the vulnerability of the object of risk and the nature of the trigger mechanism. It also happens that seemingly dissimilar scenarios and trigger mechanisms that lead to identical consequences for the object of risk are combined into a single scenario when viewed from a bird's-eye perspective. Already at this stage of the work you should try to understand whether the multitude of minor risks, which employees of an organization typically identify when working independently, can be combined into groups, and on what basis this can be done.

When a limited number of scenarios has been identified and a consensus reached, the team should rank the scenarios in terms of "impact" and "probability". The team defines both impact and probability in terms that are relevant to the organization. For example, in qualitative terms the four impact ranks can be defined in descending order as (1) catastrophic, (2) critical, (3) significant and (4) marginal. The probability ranks, of which our map has six, are likewise defined in qualitative terms from "almost impossible" to "almost certain to occur". Both probability and significance can, in principle, also be assessed by the company quantitatively. The team may use any quantitative definitions, but this procedure is much more complex and requires considerable time for analysis.

Setting the risk tolerance boundary.

The critical risk tolerance boundary, a thick broken line, separates those risks that are currently tolerable from those that require constant monitoring, and right now. Business risks located above and to the right of the boundary are considered "intolerable" and require direct management attention. When an organization's strategy is being developed, it is desirable to understand, before the strategy is adopted, how to manage or eliminate them, and whether doing so would reduce the profitability of the business to the point where the strategy becomes unattractive. Threats located below and to the left of the boundary are currently considered tolerable (this does not mean that they will not need to be managed at all).

The risk tolerance boundary shifts depending on the organization's risk appetite. When risks are classified by significance and probability, even without a numerical assessment, it is possible to estimate roughly the amount of financial loss from a given risk, which makes it possible to determine to some extent the organization's risk appetite and to set the risk tolerance boundary on the map.

And here is the risk map!

The final step in building the map is to place the business risks on the risk map according to their impact rank and probability rank, that is, in essence, to classify the risks by two parameters. In the more general and more complex case there may be three or five such parameters, and then you cannot do without mathematics. In our example there are two parameters, and the team seeks to place each risk in the appropriate impact/probability cell. Only one risk goes into each cell.

It is important to understand that the ultimate value of an organization's risk map lies not in determining the exact impact or probability level of a specific threat, but in the position of one threat relative to the other threats, and in their position relative to the risk tolerance boundary. Now, in order to adopt the strategy in question, if its profitability suits us, it is important to understand how to move all the risks lying in the red-purple "intolerance" zone into the green zone.

Action plan.

Risks lying above the tolerance boundary require direct attention right now. It is therefore important to develop specific action plans to reduce the size or the probability of losses from the risk concerned. It is also necessary to set target indicators and a measure of success in managing the risk, set dates for achieving the targets and appoint the people responsible. The purpose of the action plan in this case is to work out how to move each "intolerable" risk to the left and down into the "tolerable zone". Here it should be noted that the cost of such a move must be weighed against its benefits, and that a sharp reduction of a company's risks may also cause it to lose most of its profitability.

Quantitative assessment and modeling.

The degree of detail required in the analysis is specific to each risk and varies from one risk to another, and it depends mainly on the objectives the organization pursues. If Western banks often fight over fractions of a percent when assessing possible losses, then even our banks, let alone enterprises in the real sector of the economy, do not yet need such precision. In general, when a fairly wide range of business risks is assessed, substantial detail is not required or cannot be produced. Other risks and action plans will require more detailed study and quantitative assessment than can be achieved through questionnaires, brainstorming sessions, study of industry data and the like.

For risks that require additional analysis, sophisticated quantitative assessment and modeling methods should be used.

The risk map: a picture or a process?

From the standpoint of risk management technology, building a risk map does not complete the management process but only begins it. Moreover, your company's risk map is a "living organism" that reacts to the decisions made and the operations carried out. It lives and develops along with your business: new risks appear together with new opportunities, and some of the old risks lose their relevance and become insignificant for your business. It is therefore important that the process of risk mapping and refining the map be built into the organization's activities.

This will make it possible to update the company's risks as often as necessary. The "scheduled update" period is usually one year, and sometimes it is tied to seasonal cycles, if the business has them, and so on. However, as soon as even weak signals appear of events that could strongly affect the company's objects of risk, their effect on the company's risk map should be assessed outside any regular schedule.

Creating value for the company.

Risk mapping should be used to test existing strategies in the context of the company's realized and unrealized risks and its opportunities to generate profit, and to support management decisions on developing new strategic lines.

Consider traditional approaches to strategic planning. While most companies carry out some type of formal strategic planning (they are all well known), companies have no business process for identifying, assessing and integrating opportunities and risks, that is, a kind of "learning strategy". This can easily be illustrated by the example of e-commerce, where traditional strategic planning methods cannot cope with the speed of change. The nature of technological change indicates that the assumptions (profitability and risks) considered correct for many of today's decisions will very probably no longer be so in six months, and will bear no resemblance to those that will hold in three years.

There is a gap between those who usually conduct the strategic planning process and those who deal with clients and are responsible for the actual wins or business losses in day-to-day operations. Traditional "strategic planners" rely on knowledge available at a particular point in time, while line management relies on "live" knowledge based on actual market dynamics, which can be called a "learning strategy". Business success depends on the quality of decisions made in the dynamic present. A permanent risk mapping process aimed at the company's strategy can eliminate or reduce the gap between the "strategy planners" and line managers by incorporating "live" market information about where the company's competitive advantage can actually be realized.

Thus, risk mapping is a powerful analytical tool for understanding a company's business risks and prioritizing them. In addition, in many cases the risk map is a source of economic value for the company, since it is already clear that this methodology can be applied beyond the risk management process itself. It plays an important role in strategic and current planning, in implementing existing business strategies and in assessing future ones.