VYSOKÁ ŠKOLA EKONOMICKÁ V PRAZE Fakulta mezinárodních vztah ů
DIPLOMOVÁ PRÁCE
2009 Bc. Róbert Oláh
VYSOKÁ ŠKOLA MEZINÁRODNÍCH EKONOMICKÁ V PRAZE FAKULTA MEZINÁRODNÍCH VZTAH Ů
Vedlejší specializace: Finan č ní Manažer
Strategic Risk Management and its application in Porsche AG
Autor diplomové práce: Bc. Robert Olah
Vedoucí diplomové práce: Doc. Ing. Jiří Hnilica, Ph.D.
Rok obhajoby: 2010
PROHLÁŠENÍ:
Prohlašuji, že jsem diplomovou práci na téma „Strategic Risk Management and its application in Porsche AG“ vypracoval samostatně. Veškerou použitou literaturu a podkladové materiály uvádím v přiloženém seznamu zdrojů.
V Praze, 3. Listopadu 2009 Podpis: ……….
PODĚKOVÁNÍ:
Rád bych poděkoval vedoucímu mé diplomové práce, Doc. Ing. Jiří Hnilicovi, Ph.D., za velmi podnětné rady, připomínky a odborné vedení při zpracování této práce. Děkuji také své rodině a
známým za velkou podporu v průběhu celého studia.
Content
Introduction... 7
1 Risk and Uncertainties ... 9
1.1 General risk categorization ... 12
1.2 Risk in multinational environment... 13
1.3 Accidents as risks? ... 15
1.3.1 Level 1 Accidents – Unlikely Mental Associations... 16
1.3.2 Level 2 Accidents – Looking for something, found it in an unexpected way... 17
1.3.3 Level 3 Accidents – Looked for one thing, found something else ... 17
1.3.4 Level 4 Accidents – Not looking for anything, found something valuable... 18
2 Strategic Risk ... 19
2.1 Industry Risk... 23
2.2 Technology Risk ... 25
2.3 Brand Risk ... 26
2.4 Competitor Risk ... 28
2.5 Customer Risk... 29
2.6 New Project Risk ... 31
2.7 Market Stagnation Risk ... 32
2.8 Environmental Risk... 33
3 Risk Management / Strategic Risk Management ... 35
3.1 Importance of Risk Management... 35
3.2 Definition of (Strategic) Risk Management ... 35
3.3 Risk Management process ... 37
3.3.1 Risk identification and categorization... 38
3.3.2 Risk evaluation... 40
3.3.3 Risk Control... 45
3.3.4 Risk Monitoring and reporting ... 51
3.4 Integration of Risk Management framework into the organization ... 51
3.5 Risk Management effectiveness ... 53
4 Porsche AG –Company Study... 55
4.1 Company profile ... 56
4.2 International activities analysis... 58
4.3 Risk identification and current control applied by Porsche... 61
4.3.1 Strategic risk identification and control by Porsche ... 61
4.3.2 Financial risk identification and control by Porsche... 67
4.3.3 Operational risk identification and control by Porsche ... 70
4.4 Risk evaluation using risk map ... 72
4.5 Proposed risk control... 73
Conclusion ... 75
Porsche AG Conclusion... 76
Sources... 77
List of Tables ... 84
Appendices... 85
Introduction
Risk! How do most people perceive this word? It is understandable that in the world of unprecedented changes amplified by a difficult economic environment, most businesses and their leaders perceive the risk as something negative, with devastating effects on individuals, companies and in some cases on whole economies.
These days, even those people who do not come across the word ‘risk’ very often are becoming more and more aware of its negative consequences. However, risk does not always have devastating results; it can simply be described as a deviation from goals. Does it always have to be only one way? The answer to this question is no. In most cases risk can have an upside potential when one is fully aware of the risk and its potential negative impact. Understandably, in the Chinese language, risk is portrayed by two symbols, one of which means danger and the other opportunity. This method of presenting risk enables people to consider not only its negative side but also the positive/opportunistic consequences it can have. One could even argue that this simple fact creates stronger and more courageous entrepreneurial spirit, which in Asian countries is very pertinent and moreso amongst Chinese people than any other race. Additionally, a saying by Wayne Gretzky: “You miss 100% of shots you don’t take” applies to entrepreneurs as well as to the business environment in general, and portrays the fact that without risk there can hardly be any benefit.
Due to the fact that risk can provide opportunistic situations, the main question that arises from this is: How does it happen? It is not the risk itself that provides the gains, instead it is its identification and management. With companies growing in size and the impact of internationalization and interdependencies, firms that want to succeed must learn how to mange operational risk, as well as strategic risk. Strategic risk, which encompasses an array of external events and trends can devastate a company’s growth trajectory and shareholders’ value, but, on the other hand, can also create significant market opportunities as seen in the case of Apple’s iTunes and Amazon.com. Both risk management and strategic risk management are becoming a crucial part of corporate strategic decision making and will be outlined in this paper.
The main objective of this thesis is not only to describe and categorize risk but also to look at Porsche AG and determine how they deal with strategic risks. The thesis primarily focuses on the following four areas:
• Description and categorization of risks
• Strategic risks
• Importance of Risk Management
• Strategic risks faced by Porsche AG and their mitigation.
The first chapter defines both risk and uncertainty and looks at the major differences between the two. It also deals with accidents and their interconnection to the risk aversion as well as detailing specific accidents which have been noticed, understood, and have led to significant inventions (e.g. Corn Flakes, Penicillin and Viagra).
Strategic risks are discussed in the second chapter. Based on research, it can be said that there is a pressing need to focus not only upon limiting the effects of more common and predictable financial risks, but also upon risks that are hardly predictable and for which loss quantification is very difficult. It is for this reason that strategic risk has grown significantly in the last couple of years. In this chapter those risks that are hardly quantifiable are categorized in eight major classes: Industry Risk, Technology Risk, Brand Risk, Competitor Risk, Customer Risk, Project Risk, Stagnation Risk, and Environmental Risk. The sub chapters relating to each of these risk classifications include relevant business examples as well as the main measures that are often taken to counter these.
The third chapter highlights the importance of risk management, defines strategic risk management and identifies its process. It also looks at how frameworks such as COSO, FERMA, and AS/NZS 4360:2004 address the importance of linking risk management processes with strategic management, as well as describing different approaches of embedding a risk management framework into the organization. Additionally, throughout an empirical study, the reader can gain an insight into the effectiveness of risk management and its influence on businesses in both the United States and the United Kingdom.
The practical part of this thesis is detailed in the final chapter with an analysis of Porsche AG.
The main spotlight is on risk identification and controls applied by Porsche. Additionally, identified risks are evaluated using the risk map.
1 Risk and Uncertainties
Due to the growing importance of risk management, there are many definitions of risk. However, no single definition is universally accepted. The majority of definitions focus on risk as a source of hazard and unexpected deviations of goals, usually a consequence of not carrying out the requirements. Risk definition is most often associated with something negative, especially in
“old-school” risk management theories.
Risk has always been linked with unanticipated or negative variations of business outcome variables such as costs, revenues, profits, market share, and share price. In general, risk has always been associated with negative outcome.1 Risks with such associations are called down- side risks. However, more modern risk management practices point out that risk can have positive effects as well. As another important definition of risk is “internal and external uncertainties, events, or circumstances that the company must understand and manage effectively as it executes its strategies to achieve business objectives and create shareholder value”2. Risks that lead a company to a favourable outcome are called up-side risks.
Every risky decision involves the future state of affairs in a business and is based on incomplete information. The outcomes and consequences of this decision are unknown. Some authors distinguish between risk and uncertainty in the following way: Risk is a situation in which the future values of an attribute of an industry or firm are unknown, but the probability distribution of these future values is known; Uncertainty is a situation where the future values of an attribute of an industry or firm are known, however, the probability distribution of these future values is unknown.3 Therefore, the main difference between the risk and uncertainty rests in knowing the probability distribution before making a decision that will affect future values or attributes of an industry or firm. Uncertainty is also described as a lack of certainty. It is the subjective interpretation of a probability by decision makers and analysts of problems in the organization.
Therefore, the same decision can be proposed to different people and will be perceived differently by each person. Decision makers see different possible outcomes and their probabilities. If risk definition is approached through probability, then it can be said that a firm
1 Miller K.D.: A framework for integrated Risk Management in international business, Journal of International business Studies, Vol. 23, No. 2,second quarter 1992, pp. 311-331
2 Andersen, T.J.: Perspectives on Strategic Risk Management; Copenhagen Business School Press 2006, p.31
3 Knight F.H.: Risk, uncertainty and profit; Augustus M Kelley 1971, ISBN: 067800031X
or industry is risky when its future value cannot be characterized by a single point, but rather by a probability distribution of possible outcomes.4 For example if the level of competition in an industry is uncertain and risky, then at some point in the future there will be a 5% chance of rivalry being very high, a 25% chance of rivalry being high, a 40% chance of being moderate, a 25 % chance that it will be low and a 5% chance that it will be very low. Similar distributions might exist for other opportunities, threats, use of resources, ability to execute strategy, share value, and so on these values vary across industries, so how can one decide which industry is less risky? In any discussion of risk, risk tolerance must not be forgotten. As mentioned before, risk is always perceived differently. What is risky for one manager might not be risky for another manager. Every person has a different risk tolerance that is derived from their contribution to the company.
After having evaluated probabilities in the previous example, how can risk actually be measured? Consider the following scenario: There is a choice of entering two industries, and the decision of which one will be based on the level of rivalry (the assumption is that all the other outcomes such as profit, costs, etc. are the same). Another industry has a 10 percent chance that the rivalry in the industry will be very high, a 20 percent chance of rivalry being high, a 40 percent chance of rivalry being low and a 10 percent chance that it will be very low. Both cases are shown in a Table 1 below.5
In order to evaluate and compare these cases values need to be assigned to each probable state of occurrence; these values range from 5 (the worst case scenario –very high industry rivalry) to 1 (the best case scenario –very low industry rivalry).
Standard deviation will be used to measure the risk. This measures the distortion of set of data from the norm (from its mean). The more scattered the data is, the higher the deviation.6
4 Copenhagen Business School, Strategic risk management: 3rd class presentation by Torben Juul Andersen
5 Copenhagen Business School, Strategic risk management: 3rd class presentation by Torben Juul Andersen
6 http://www.investopedia.com/terms/s/standarddeviation.asp 12.7.2008
Where:
Pi = probability of outcome Vi = value of outcome
= mean of al outcomes N = number of outcomes
Table 1: Example of industry riskiness
CASE 2 CASE 1
Probability of an outcome 2
Value of an outcome
Probability of an outcome 1
Value of an outcome
0,10 5 - rivalry VERY HIGH 0,05 5 - rivalry VERY HIGH 0,20 4 - rivalry HIGH 0,25 4 - rivalry HIGH 0,40 3 - rivalry MODERATE 0,40 3 - rivalry MODERATE 0,20 2 - rivalry LOW 0,25 2 - rivalry LOW 0,10 1 - rivalry VERY LOW 0,05 1 - rivalry VERY LOW
ST deviation 1,0954 0,9487
In general, the greater the dispersion of possible future values of company attributes, the greater the risk associated with these attributes. The standard deviation of the second case is 1,0954, which is higher than that of the first case (0,948). Therefore, the decision to enter the second industry carries higher risk of rivalry. The dispersion of data is higher from the mean, meaning there is a good probability of rivalry being very low (a positive factor). On the other hand, there is the same high probability of rivalry being very high. To sum up, higher standard deviation means higher dispersion of data, which in turn means a flatter chart of probability distribution as we can see in a Table 2 below. The flattest chart has the highest variance7, and the chart with sharpest peak has the lowest variance/standard deviation.
7 Square of the standard deviation
Table 2: Various probability distribution Chart
1.1 General risk categorization
Many authors have grappled with many different definitions and descriptions of risk. Baird and Thomas (1990) argue that risk is multidimensional and that it is important to distinguish between managerial risk and organizational risk. Managerial risk is when managers make choices associated with uncertain outcomes. These risks derive from decisions made by management.
Organizational risks are when organizations face volatile income streams that are associated with turbulent and unpredictable environments. (e.g. complex environment, lack of resources)8. Managerial risks elaborate on organizational risks. All decision makers make their decisions based on an assessment of organizational risks. General categorization, used by Torben Juul Andersen, of the organizational risks is following: strategic risk, operations risk, economic risk and hazard. They can be both endogenous and exogenous (see table 3).
8McGee J., Thomas H., Wilson D.: Strategy: Aanalysis and practice; McGraw Hill Higher Education 2005
Table 3: Organizational risks
Source: Copenhagen Business School, Strategic Risk Management: 2nd class presentation by Torben Juul Andersen
1.2 Risk in multinational environment
Companies in international environments are being exposed to many different situations which are affecting their attributes of margins, cash flow, sales, profits, and production; basically, the companies’ entire existence. The following image demonstrates some of the exposures that corporations are being exposed to in international markets. These exposures differ in importance and weight for every industry.
Table 4: Risk Exposure in Multinational Environment
Source: Copenhagen Business School, Strategic Risk Management: 2nd class presentation by Torben Juul Andersen
Due to increased liberalization, companies are able to sell more internationally and to use more resources from different parts of the world. Communication and information technology are reducing the geographical distance and facilitating coordination, manufacturing, cost optimalization, distribution and sourcing. Global companies can profit from global network of their affiliates where they can exploit big cost advantages, specifically being able to source internationally.
As mentioned at the beginning of this section, multinational corporations are facing a wide scope of risks. If a company operates in more than one country, it has to take into consideration not only the risks that it is facing in that specific country, but also the risks that the company is being exposed to in other countries. It is mainly the financial and market related exposures caused by changes in exchange rates, interest rates, commodity prices, macro-economical uncertainties, and other similar variables. Toben Juul Andersen classifies risks into the following three generic categories:
• General environment risks – are comprised of factors that characterize the physical context for global business operations and trends in the overall socio- economic system including influences from political sentiments, macro- economical conditions, regulatory interventions, natural phenomena, man-made disaster, terrorist events, natural disasters, hazards, etc.
• Industry risks – influence the competitive situation of the specific industrial context in which the corporation operates. This is comprised of elements that are particular to the industry such as: competitors’ moves, changing customer needs, industry specific regulation, technological trends, new business initiatives, input market uncertainties, etc.
• Company specific risks – relate to internal conditions prevailing within the organization itself and are manifested through the way work is organized, people are motivated, decisions are made, and actions are controlled. The main risks in this category are: operational disruptions, technological breakdowns, inefficient decision making, human failures, fraudulent acts, negligence, etc.9
9 ANDERSEN, T.J.: Perspectives on Strategic Risk Management; Chapter 7: An integrative Framework for Multinational Risk Management, pages 133-134. Copenhagen Business School Press 2006
Table 5: General risk classification
1.3 Accidents as risks?
Accident: nonessential quality or circumstance;
1. an event or circumstance occurring by chance or arising from unknown or remote causes; lack of intention or necessity; an unforeseen or unplanned event or condition;
2. sudden event or change occurring without intent or volition through carelessness, unawareness, ignorance, or a combination of causes and producing unfortunate results;
3. an adventitious characteristic, that is either inseparable from individual and the species or separable from the individual but not from species; broadly, any fortuitous or nonessential property, fact or circumstance (~of appearance) (~of reputation) (~of situation).10
Accidents have led many companies to success. According to Robert Austin from Harvard Business School, many innovations are based on accidental occurrence11. Accidents actually happen in the business world quite often and have led to some very significant innovations.
Austin states that innovation leads to genuinely novel outcomes based on something
10 Webster’s third New International Dictionary; Merriam-Webster Inc. 1960
11 Gilbert S.J.: Accidental Innovator, Q&A with Robert D. Austin, Harvard Business School Working Knowledge July 5th 2006
inexperienced.12 Such a novelty is hard to create since people are limited by their routines and habits. “Positive” accidents are most of the time linked with innovation and creativity, and are truly specific for creative economy firms (e.g. VIPP, Bang and Olufsen, Moonshine shop as an independent department of The Boeing Company, etc.); firms that create something unexpected, with the same functionality as something produced before, but that are more expensive and more desirable by customers. As Michal Porter says: “Buy mine, it is more expensive - but ‘better’ ”.13
Many major, life altering innovations happened as accidents in situations where, if risk would have been eliminated totally, the innovation might not have occurred. Therefore, people that have used penicillin, owned a framed picture in their home, used 3M notes, cooked with a microwave, or enjoyed potato chips and cornflakes should appreciate low risk control and openness to tries, randomness and uncertainty.
When discussing beneficial accidents and innovation, we have to disregard the negative and undesirable parts of the definition and its’ understanding. Austin asserts in his article that the accidents vary in intensity and that a four level scale exists:
1.3.1 Level 1 Accidents – Unlikely Mental Associations
This kind of accident is difficult to describe. The best way to understand it is to use the example of finding the structure of benzene molecules by August Kekulé von Stradonitz, a founder of structural organic chemistry.
“I was sitting writing on my textbook, but the work did not progress; my thoughts were elsewhere. I turned my chair to the fire and dozed…the atoms were gambolling before my eyes…My mental eye, rendered more acute by repeated visions of the kind, could now distinguish larger structures of manifold conformation: long rows sometimes more closely fitted together all twining and twisting in snake-like motion. But look! What was that? One of the snakes had seized hold of its own tail, and the form whirled mockingly before my eyes. As if
12 Austin R.D., Devin L., Sullivan E.: Accidental Innovation; Harvard Business School Note 607-082, February 2007
13 Mention during class of ‘Managing in Creative Economy’ by Robert D. Austin at Copenhagen Business School. Robert D.
Austin was visiting professor from Harvard Business School
by a flash of lightning I awoke…and spent the rest of the night working out the consequences of the hypothesis.”14
Kekulé was working on discovering something and he did, thanks to a random dream that he did not ignore as a consequence of being overloaded with work.
1.3.2 Level 2 Accidents – Looking for something, found it in an unexpected way
The perfect example of this sort of accident is that of a medication used to lower cholesterol. In 1991, Schering-Plough scientists were looking for a drug that would block a certain cholesterol- producing enzyme in the body. They noticed in a test on hamsters that one molecule, while failing to block that enzyme, nonetheless lowered cholesterol… [The] scientists [had] stumbled onto a new approach for reducing cholesterol.
This is very good example of finding something unexpected. What could have happened if the test was being performed by a computer? A computer would most likely pinpoint this discovery as an error, rather than as a positive alternative use for the medication. The scientist founds what they wanted, but in a different way they expected to find it.
1.3.3 Level 3 Accidents – Looked for one thing, found something else
Level 3 accidents can be easily associated with the negative definition of accidents. A good example of this kind of accident is the discovery of the artificial sweetener NutraSweet by James Schlatter, an organic chemist at G. D. Searle, who was working on a treatment for gastric ulcers.
The accident occurred during his research when a chemical reaction caused a spill of methanol and aspartame. This wasn’t the finding. The main part of discovery came after Schlatter wanted to pick up a piece of paper. Before picking up the piece of paper he licked his finger and happened to taste the chemicals. After being surprised at what may have caused that sweet taste, he went back to track what substances were responsible, and went on to invent NutraSweet.
14 WEISBERG, R.W.; Creativity: Understanding Innovation in Problem Solving, Science, Invention, and the Art; Wiley 2006.
ISBN: 978-0-470-03622-8
Another good example of a level 3 accident is Viagra. The first oral treatment for erectile dysfunction was developed accidentally by scientists at Pfizer Laboratories and was green- lighted for use by the FDA on March 27, 1998.
"Originally, we were testing Sildenafil, the active drug in Viagra, as a cardiovascular drug and for its ability to lower blood pressure,'' stated Dr. Brian Klee, senior medical director at Pfizer, to French news agency AFP. "But one thing that was found during those trials is that people didn't want to give the medication back because of the side effect of having erections that were harder, firmer and lasted longer.''
Since its approval, Viagra has been used by 35 million men around the world and has taken the taboo out of impotence.15
1.3.4 Level 4 Accidents – Not looking for anything, found something valuable
These are the most random type of accidents. Sometimes they might even prove dangerous, but most of the times the outcomes are very successful. The best and most successful level 4 accident was the discovery of cornflakes in 1984 by John Kellogg, a medical doctor, and his brother Will, a business manager of the facility where they both worked. The hospital where they worked served food to people with strict dietary requirements. The hospital was producing its own granola by forcing dough through rollers. One day, after leaving cooked wheat untended for over 24 hours, they came back and let the stale wheat run thought the roller. They expected ruined rolls, but instead the roller started producing flakes. After baking, these flakes tasted the same as today’s cereals. They tried the same procedure with corn and this became Kellogg’s Cornflakes cereal, which can now be purchased in supermarkets around the globe.
These accidents are always associated with risk. No risk manager or CEO wants to hear about any accidents in their companies. As mentioned before, many accidents have bad associations;
therefore companies try to avoid them. Corporations are trying to get leaner and cut out the amount of steps in each process to shorten them and avoid errors and accidents. The main outcomes of Mr. Austin’s research are that:
• Innovation and new product development cannot always be planned – accidents happen.
15 http://www.foxnews.com/story/0,2933,340888,00.html 20.7.2008
• Executives and innovators should be prepared and open to recognize unforeseen opportunity.
• Understanding of the nature of breakthrough inventions depends on the industry.
• The importance of planning “controlled failures” according to the industry.1617
2 Strategic Risk
Up to this point, both the general categorization of risk and some risks that the majority of companies are exposed to have been described, this section will elaborate more on the specifics of strategic risks.
Risk perception has been evolving with industries and technologies. Still, many authors do not concentrate on strategic risks or their classification and consequences.
Slywotzky and Drzik describe strategic risk as an “array of external events and trends that can devastate a company’s growth trajectory and shareholders’ value.”18 Slywotzky also argues that strategic risk does not only destroy value but can also create growth opportunities which create even higher value and strengthen market position.
Evidence of the heightened need to focus on strategic risk is that from 1985 through 2003 the percentage of “low quality” stocks in the 3000 S&P-rated stocks jumped from 35% to 73% and
“high quality” stocks decreased from 41% to 13%.19 Slywotzky’s and Drzik’s study also indicates that from 1993 through 2003, more than one third of Fortune 1000 companies - only a fraction of which were in volatile high-technology industries, lost at least 60% in a single year. 20
16 http://listverse.com/miscellaneous/top-10-accidental-discoveries/ 18.7.2008
17 http://www.wired.com/wired/archive/14.03/start.html?pg=3 18.7.2008
18 Slywotzky A., Drzik J.: Countering the biggest Risk of All, Harvard Business Review, April 2005 pp. 80
19 High-quality stocks include those rated A+, A, and A-. Low-quality stocks include those rated B, B-, C, and D. (B+ stocks are omitted.
20 Slywotzky A., Drzik J.: Countering the biggest Risk of All, Harvard Business Review, April 2005 pp. 78-80
Table 6: Low and High quality stocks development
Further evidence of an increased focus on risk environment is a review of annual reports from large companies in Denmark. In the 1990s, most companies restricted themselves to only mention currency risk, interest rate risk, credit risk and Y2K risk21. A few of these companies mentioned exposure to physical assets and intellectual property. By 2004, the list had grown significantly and included risk areas such as business ethics, changes in legislation, competitors’
actions, compliance with local legislation, contracts, currency, customer concentration, customer dependency, customer wants/needs, divestment, recruitment and retention of employees and management, environment, financial market risk, forward looking strategies, health & safety, intellectual property, IT dependency, legal risk, liquidity risks, mergers and acquisitions, physical assets, product development, suppliers dependency and tax.22
This is a large array of different risks. Some of them might not be classified as strategic risks, but most of them have one thing in common - they are hardly quantifiable, and therefore it can be argued that the impact and consequences of strategic risk exposures are difficult to measure.
21 Abbreviation used for year 2000 computer problem
22 Andersen, T.J.: Perspectives on Strategic Risk Management; Copenhagen Business School Press 2006, page 27
To elaborate on the change of risk perception over the last decade, I would like to point out the bi-annual survey carried out by AON consulting. The survey reflects the views of risk and insurance managers and CFO’s in a number of the world’s largest companies.23 Based on this survey, the most important risks evaluated by these managers were Business interruption, Employee risk, general liability, etc.24
Table 7: The Views of Risk Managers and CFO's 1995 - 2004 Risk historic ranking 1995 1997 1999 2001 2004
Business Interruption 4 2 1 3 1
Employee risk 3 3 6 10 2
General Liability x x 5 6 3
Failure to change x x x 2 4
Fire/Physical damage 1 1 2 7 5
Loos of reputation x x 4 1 6
Professional liability 9 10 7 X 7
Product Liability 5 6 3 4 8
Directors and Officers reputation x 9 x 9 9
Recruitment x x x 8 10
Table source: Aon bi-annual surveys
In the year 2007 the most important risk was evaluated to be the loss of reputation, which is very complex to evaluate, as seen on the table below. While intangible, corporate reputation is one of the most important corporate assets and is also one of the most difficult to protect; it takes years to build, but can be destroyed overnight25. Perception of corporate reputation is influenced by
“firm specific investments”26,27 made by: shareholders and investment community – providing financial capital, consumers/customers - providing demand for firms’ products, employees – providing human capital, and legislators – providing legislative background. Loss of reputation can be considered a consequence of other risk and vice versa. Damage of reputation can lead to negative publicity, reduction in earnings, costly litigation, credit downgrades, a decline in market share and inability to recruit and retain top talents. The focus on reputation risk indicates that executives see reputation as a major source of competitive advantage. A good reputation strengthens market position, reduces the price of capital, increases corporate value, protects the
23 Global Risk Management Survey 1995, 1997, 1999, 2001, 2004, 2007, AON Corporation
24 AON Corporation. Global Risk Management Survey 2007
25 AON Corporation. Global Risk Management Survey 2007
26 Investment that creates value of the business, It cannot be redeployed without significant loss
27 Wang H., Barney J.B. Reuer J.J: Stimulating Firm-Specific Investment through Risk Management; Long Range Planning, Vol.
36, 2003, pp. 49-59
brand, enables organizations to charge higher prices, helps to attract top talents, protects organizations from unwelcomed takeover bids and raises potential returns from share offerings.28In order to keep their reputation high, a firm has to manage all the others risks without significant failure.
Table 8: Reputation risk- key stakeholders and their interests
Source: Aon Corporation, Global Risk management survey 2007
Based on this research, it can be said that it is growing in importance to focus not only on limiting the effects of more common risks and predictable financial risks, but also on risks that are hardly predictable and for which loss evaluation is very difficult.
The above mentioned authors, Slywotzky and Drzik, are the first to categorize strategic risk into seven major classes: Industry Risk, Technology Risk, Brand Risk, Competitor Risk, Customer Risk, Project Risk and Stagnation Risk. This classification is also cited by Morgan Stanley
28 Global Risk Management Survey 2007, AON Corporation
publications, and by many other sources, including research carried out by Oliver Wyman Management Consultancy.
These seven classes cover most of the strategic risks that any company might be exposed to. In addition to these seven classes, I would like to add an eighth class - Environmental Risk, which is becoming increasingly important but is rarely quantified.
2.1 Industry Risk
Risks that are considered to be industry risks are:
• Margin squeeze,
• Rising R&D/capital expenditure costs,
• Overcapacity,
• Commoditization29,
• Deregulation,
• Increased power among suppliers,
• Extreme business cycle volatility.
Industry risk occurs when an industry becomes highly competitive and mature. In such an industry there is a tendency towards margin squeeze, which is also one of the most important industry related risks. As industries, technologies, communication and competition are quickly evolving, the industries are becoming overcrowded and therefore companies cannot demand profit margins as high as before. Commoditization and overcapacity are seen as large risks as well, since these factors can create zero profit environments – non profit zones. But on the other hand, these risks can create opportunities for entrepreneurs.
Now on to competition; without competition, there is a monopoly with full market control, high margins and high profits. But when competition starts to grow, the margins are lowered, as is profit (under the condition of not having an economy of scale). In that case, the company is able to stay competitive in the industry only if it is better than the rest of competitors. The best countermeasure to the margin squeeze proposed by Slywotzky and Drzik is to shift the competition/collaboration ratio among the involved firms. There must be a shift from relying on
29 Transformation of products into commodities- products are becoming indistinguishable and customers buy on price bases
one’s own power to relying on cooperation with competitors, suppliers, customers, and consumers.
Collaboration can be looked at from many different angles, including back office sharing, supply chain coordination, production sharing, mutual logistics, joint research, and development. One good example of collaboration failure is the music industry at the beginning of the first decade of the 21st century, when the internet and downloading music became a big hit amongst the younger generation. Due to this, major recording companies collectively suffered a decline in sales at an annual rate of 6, 5% from 2000 to 2003.30 In that time, collaboration become a competitive necessity, but was not understood by many companies. Universal Music Group and Sony Music Entertainment came with an idea of joint venture for an on-demand music subscription service called Pressplay.31 On the other side of the industry AOL Time Warner Inc., Bertelsmann AG, EMI Group plc, and RealNetworks, Inc. announced a venture which would create a platform for online music subscription services, called MusicNet32. At the beginning of the year 2001, the internet world had two major music providers. The pitfall was that they refused to provide each other services (such as license songs to one another) and therefore both had difficulties staying viable by retaining paying customers. This unwillingness to collaborate was picked up on by Apple’s iTunes, which was then able to convince the recording companies that it is possible not only to rent, but also to buy individual songs. Since then, iTunes has grown increasingly, and has expanded into the area of movie sales as well. The movie industry is now going through a similar path as the music industry did in 2001.
Some other good examples of collaboration come from financial services such as VISA and MasterCard, which allow their participating financial institutions to share payment-processing and marketing services that are much more efficient than any other that a bank could develop on its own. This can be seen as well as in airline industry, where collaboration is seen in the creation of alliances between major airline companies - Star Alliance33, SkyTeam34 and OneWorld Alliance35.
30 Slywotzky A., Drzik J.: Countering the biggest Risk of All, Harvard Business Review, April 2005, pp.81
31 http://www.sony.com/SCA/press/010611.shtml 22.7.2008
32 http://findarticles.com/p/articles/mi_m0EIN/is_2001_April_2/ai_72584716 22.7.2008
33 Over 500 million passengers a year, 975 destinations, 25,1% market share and 24 airlines
34 Over 428 million passengers a year, 841 destinations, 20,8 market share and 14 airlines
35 Over 319,7 million passengers a year, 692 destinations, 14,9 market share and 10 airlines
For footnote 27,28 and 29 Sources: Wikipedia- (information verified), www.staralliance.com www.skyteam.com
www.oneworld.com 23.07.2008
2.2 Technology Risk
• Shift in technology - double bet
• Patent expiration
• Process becomes obsolete
Technology risk has become a huge risk nowadays. Technologies are boosting and companies with no R&D are quickly dissolving. The fear of patent expirations, manufacturing processes becoming outdated, and of technology advancements after heavy investments into R&D can have major consequences on corporate performance, value, and, in the worst case, existence.
Sometimes it is difficult to predict when new technology is about take over the market. Taking digital photography and how it shifted the market from the “old fashioned” film-based photography to digital, or media from VHS to DVD, and now to HD DVDs and Blue Rays. The best solution for the threat of technology change is a double bet. Although, this bet can be extremely expensive, it has worked out for many companies that were able to assess future market situation. The other were crystallised as technology losers with diminishing market share.
Basically, double betting is investing in several technologies simultaneously. Investing in more than one technology is costly, but it primarily “insures” technology risk in a way that puts companies in a position to survive and thrive no matter which version emerges as the winner.
Betting on both OS/2 (co-developed for IBM) and Windows positioned Microsoft to be a winner, regardless of which operating system prevailed. Similarly, Intel’s double betting on both RISC and CISC chip architectures ensured that it would succeed in the market for semiconductor chips.
By contrast, Barnes & Noble was not an aggressive double bettor. It did not make an early or large bet on the Internet as a channel for book sales alongside its physical stores. This slow start gave Amazon the opening it needed to dominate online media sales, despite Barnes & Noble’s initial advantage in brand awareness and bookselling experience.36
36Slywotzky A.: Rethink Risk, Mercer management journal Number 17, Mercer Management Consulting 2004
Table 9: Failure to double bet early allows start-ups to seize market position
Source: Slywotzky A.: Rethink Risk, Mercer management journal Number 17, Mercer Management Consulting 2004
2.3 Brand Risk
• Erosion
• Collapse
Powerful brands can be main reason why people buy a certain product. They can yield great benefits over products or services that are otherwise similar. But they are also subject to an array of risks, which might sharply reduce or even destroy their value. Brands that everybody knows, including Coca Cola, Procter & Gamble, McDonald’s, Harley-Davidson’s, Rolls-Royce, and American Express, provide not only goods and services, but are also connected to lifestyle - the ways in which people think and act that convey certain social standards and positions. Most of these companies offer something that customers could get somewhere else. Why do people buy more Coca-Cola than Pepsi? The answer to this question is individual. Someone might say it because they like taste; however, the real reason is well targeted and heavily invested marketing.
Brand risk might strike overnight, such as in cases of incorrectly handled scandals, problems with product tempering, and widely publicized troubles of any kind. One of the biggest corporate crack-ups in recent business history is the case of Ford and Bridgestone/Firestone tires, which were used on every Ford Explorer vehicle. Ford had declared Firestone tires to be faulty and recalled over 6, 5 billion tires that threatened the safety of their user. A bad reaction and an
attempt to place the blame on drivers and Ford cost Bridgestone/Firestone an 80% drop in net income over one year after the recall. This might have been a case of underestimation of the situation or of mishandling a crisis, but either way, the problem resulted in a damaging loss of reputation.
In other cases, a brand can also lose its attractiveness and relevance. For example, the powerful Disney brand had a difficult time in late 1970s and early 1980s when baby boomers started to regard the studio as stagnant and unoriginal. Management handled this situation by revitalizing the studio’s production with new movies and new cartoons.
Oliver Wyman management consultancy provides two countermeasures that companies can use to protect themselves from brand risk – continuous measurement and reallocation brand investment.37
Continuous measurement is the constant monitoring of market situations and customers’/consumers’ perceptions of a brand. This includes market research studies, demographics research, and researching the other brands.
Relocating brand investments is based on constant measuring to notice early signs of brand weakening. For example, AMEX- American Express credit card issuer came under a competitive attack by VISA, who heavily invested in marketing supporting the wide acceptance of their cards. The following slogans were released for VISA in 1988, before the winter Olympic Games:
“Bring your camera and your Visa card”, “because the Olympics don't take place all the time and, this time, the Olympics don't take American Express.”38 This campaign put American Express in a very difficult competitive situation, and as a result, AMEX was forced to redefine the scope of their brand. They started to make investments unrelated to conventional marketing, to strengthen and broaden the brand, and to focus mainly on customer service and prestigious perception. They invested in relationships with merchants that lowered the transaction fees and quickened the transaction processes. Later on in the 1990s, they invested into a miles and reward program and also entered into collaborations with several major hotel chains. This changed the
37 Slywotzky A.: Rethink Risk, Mercer management journal Number 17, Mercer Management Consulting 2004
38http://query.nytimes.com/gst/fullpage.html?res=940DE3D9123DF933A25751C0A96E948260&sec=&spon=&pagewanted=all 23.07.2008
brand image, and now, carrying an American Express card is a sign of prestige. It may not be taken everywhere, but where it is taken, users now hand it over with a sense of pride.
2.4 Competitor Risk
• Emerging global rivals
• Gradual market-share gainer
• One-of-a-kind competitor
Progressive competition is a healthy part of any business environment. Competition is normal and drives services and productions to be more competitive and, from the customers’
perspective, more interesting. Every company wishes to be in an industry with no threats from competition, without the need to lower their margins and battle with its peers. However, as the world becomes smaller39, competitor risk is becoming more relevant and is growing in importance. The biggest risk is the risk of one major competitor who might bite off a large piece of the market share pie, thanks to its unique business model. Companies that are an example of this include Wal-Mart, Microsoft and Apple. At the time that Wal-Mart came into existence in the United States, no one could have predicted how wide spread and strong the company would be in a couple of years. Wal-Marts’ achievements were a result of its unique business model.
Thanks to this, Wal-Mart was able to gain extremely strong bargaining power against suppliers, as well as many other competitive advantages. Nowadays Wal-Mart is in terms of revenues the largest corporation in the world, followed by Exxon Mobile and Chevron.40Selling more Toys than Toys ‘R’ us, more clothes than GAP and Limited combined. If it were its own economy, Wal-Mart Stores would rank 30th in the world, right behind Saudi Arabia.41
It is extremely important for a business to constantly scan and identify the companies that might threaten their market position and become a one of a kind competitor. On the other hand, an effective reaction to competitive risk involves not only the recognition of such a competitor, but also a fast reaction to make changes in their business design. This minimizes overlapping with the business’s main competitor, and allows them to establish a lucrative position in a profitable business environment.
39 In a business sense – viz. internationalization, globalization
40 http://money.cnn.com/magazines/fortune/fortune500/2008/full_list/ 19.5.2009
41 http://www.forbes.com/forbes/2004/0412/076.html 22.7.2008
Table 10: Wall-Mart's Expansion
Source : Slywotzky A.: Rethink Risk, Mercer management journal Number 17, Mercer Management Consulting 2004
2.5 Customer Risk
• Customer priority shift
• Increasing customer power
• Over-reliance on a few customers
Customer risk is hardly predictable and has to be carefully tracked. One of the main risks, which can have a huge impact on a company, is a customer priority shift. This shift can happen suddenly and dramatically or gradually and almost invisibly. The level of danger for this is the high if a company is not prepared for such a situation. Such shifts happen all the time, due to the development of technologies, rising levels of information, and many other factors. The magnitude of such a risk depends on the shift’s speed, wideness, and depth.
A good example of an unpredicted shift occurred in the 1980s, when baby boomers started switching from station wagons to the first minivans, catching most automakers off guard.42,43
42 Slywotzky A.: Rethink Risk, Mercer management journal Number 17, Mercer Management Consulting 2004
43 http://query.nytimes.com/gst/fullpage.html?res=940DE5DE123DF935A35751C1A96E948260&sec=&spon=&pagewanted=all 24.07.2008
The best and only ways to be prepared for such changes are either to be clairvoyant or to be able to continuously create and analyze proprietary information and perform detailed market researches/experimentation.
Companies that are excelling in this are the American high-quality leather goods maker Coach, American bank Capital One and Japanese video and music distributor Tsutaya. They all have one thing in common; they know what their customers want and are ready to adapt to their needs, before the changes are realized by market.
Coach interviews more than 10,000 consumers a year about their shopping habits, and tests new items at pilot stores. They rely on the feedback of their customers for information about the current market. These market experiments record the effects of changes in price, features, and offers by competing brands.44
Another notable example of this in the consumer world is Capital One, which runs 65,000 in- market experiments per year to create smaller, more accurate customer segments in sub-prime lending. The robust detail within each sub-segment allows Capital One to determine which combination of features, price, and marketing messages will yield the highest profit. Just as importantly, it also signals when and how these segments are changing their preferences and priorities.45
Tsutaya, Japanese retailer, conducts a continuous analysis of customer spending patterns by combining information from point-of-sale data, surveys, and databases. Tsutaya can pinpoint customer preferences down to the family or individual, allowing them to anticipate how the customers’ tastes are changing. As a result of generating the best proprietary information in the industry, the company has significantly outgrown all of its competitors. It even sells its proprietary data to other companies, looking to better track shifts in customer priorities.46
44 http://www.businessweek.com/magazine/content/04_13/b3876122.htm 23.7.2008
45 Slywotzky A., Exploring the strategic risk frontier, Strategy and Leadership vol. 31 No. 4. Emerald Group Publishing Limited, 2004
46Slywotzky A., Exploring the strategic risk frontier, Strategy and Leadership vol. 31 No. 4. Emerald Group Publishing Limited, 2004
2.6 New Project Risk
• R&D failure
• IT failure
• Business development failure
• Merger or acquisition failure
Potential risks exist with any new project. A new product or service venture faces chances that it will not be accepted by the market, will not attract a profitable segment, fail outright or that competition will be able to adapt the similar technology and patents rapidly, which will not create a profitable environment.
The best protection against this kind of risk begins with proper assessment of the project’s probabilities and chances to succeed. Projects vary from industry to industry. Slywotzky discusses three main countermeasures in his work: smart sequencing, developing excess options, and employing the stepping stone method47.
Two examples of projects with multiple options are, without a doubt, Toyota and Boeing. During the development of the Prius, Toyota had an excessive number of options for suspensions and engines for testing. They tested 20 different suspensions and 80 different hybrid engine technologies. 48 This was definitely not a waste of time and resources; after all that testing they have reached a level of success that nobody else has achieved.
Moonshine49 shop (an independent department within the Boeing Company that works on making production processes leaner) introduced an exercise called “The Seven Ways,” that prompts each individual to generate seven approaches to tasks and projects.50 This method
47 method that creates a series of projects that lead from uncertainty to success
48 Liker J. K.: The Toyota way, McGraw-Hill Professional 2003. ISBN: 0071392319, page 240
49 “Moonshine” described illegally distillated liquor smuggled under the cover of night Moonshine manger Kim Cherban embraced the name as a work model, evoking Henry Ford, how he built his first car: “He built this at night in the middle of the night, but nobody knew where he was at, what he was doing. When he perfected it, he introduced it to public after that. So we do the same concept. We keep it to ourselves”
A 2003 lean presentation expressed The Boeing Company’s own working definition: moon-shine – 1.a method of disruptive action that occurs in secrecy, under and around organizational boundaries and procedures, producing order of magnitude improvement to any process. 2. A Lean Manufacturing tool that uses fast and inexpensive prototyping to develop and prove a concept, prior to full implementation
50 Austin R.D., Nolan R.L, O’Donnell S.: The Boeing Company: Moonshine Shop case study, Harvard Business School Case study, April 2007
eliminates overall failure by always providing an alternative solution. Besides providing a solution, it also creates a culture where all the employees must have an alternative solution on their mind before getting involved in a new project.
2.7 Market Stagnation Risk
• Flat or declining volume
• Volume up, price down
Market stagnation risk occurs when a company reaches its peak sales and is unable to find new sources of growth in mature markets. Due to this inability many major companies have seen their market value stagnate or decline despite a stable demand for their product. Market stagnation limits the upside potential part of the reward/risk ratio and sets up companies for value loss or stagnation.
The best countermeasure for Market Stagnation Risk is redefining your customer offerings so as to broaden your market, expand the value you can offer your customers, and strengthen your relationship with them – demand innovation,
An example of demand innovation is the introduction of services that might help to increase the profit of your customers (introduction of industry specific consulting services – Falck Denmark is deciding whether to introduce health care consulting services to its portfolio, which will be targeted to public and private organizations wanting to improve their healthcare and safety offerings to their employees.51)
Offering services and products that do not only function properly, but that also help their user reduce costs, capital intensity and risks, is extremely important in order to mitigate market stagnation risk. A good example of a demand innovation is Air Liquide, company based in Paris, which started as a traditional supplier of industrial gases and now offers chemical management services, supply chain services, environmental consulting and licensing of software tools and systems. All of these services are offered to their clients in order to help them lower the environmental risk and improve their profitability. Air Liquide introduced these in the late
51 Copenhagen business School/CEMS business Project with Falck Denmark: Falck Health Care Consulting; 2008
1980s’ when its revenues and operating income became flat, and technical innovation was leading nowhere.
2.8 Environmental Risk
Environmental risk is becoming extremely important. Many companies are focusing on environment throughout their CSR projects, which are showing concerns about the future state of the environment. But is the CSR enough? Michal E. Porter and Forest L. Reinhard, in their paper
“A Strategic Approach to Climate,” are saying that firms should consider environmental risk as a business problem.
Companies need to take an action now. One of the main problems belonging to environmental risk is carbon emissions regulations. This might affect the entire business models of international companies. Companies producing more CO2 than permitted will be fined, and this is considered by Porter to be operationally ineffective. He compares it to an excess of employees, which the company has to pay, even though the said employees are underworked and have nothing to do. It is against operational effectiveness, and against the theory of making a profit.
Approaches to climate changes can go far beyond operational effectiveness and can actually create value adding opportunities – as they did for Toyota, creator of the hybrid car Prius (one of the most environmentally friendly cars52). The growth for the next couple of years can be seen on the chart below.
52 http://www.msnbc.msn.com/id/18138812 24.7.2008
Table 11: Growth in Hybrid Market
Source: www.hybridcars.com/files/hybrid-forecast-graph.pdf 24.7.2008
Environmental risk does not only have explicit effects through the regulation of CO2 and trends;
environmental risk is also concerned with shifting temperature and weather patterns. Either can affect the availability of business inputs-resources, size and nature of demand, and access to related or supportive industries. It can also disrupt the supply chain. The industry that is most strongly affected by environmental changes is insurance. Companies that insure or reinsure real estate in either coastal areas or areas with a rising probability of floods may have high exposures to carbon dioxide, since they are threatened by rising probability of big floods and, in the long run, by rising sea levels.53
53 Porter M.E., Reinhardt F.L.: A Strategic approach to Climate, Harvard Business Review, October 2007 pp.22-26
3 Risk Management / Strategic Risk Management
3.1 Importance of Risk Management
In recent years, a lot of work has been done in the area of risk management. There have been many attempts to identify leading management practices from which all companies could profit, and many companies seem to have invested resources in risk assessment54 in order to clarify stakeholder perspectives. However, in Ernst & Young’s Strategic Business Risk Paper-2008,
“The Top 10 Risks for Business,” it is suggested that strategic risk did not necessarily benefit from developments in management practice. Since many of the papers written on strategic risk focus on a larger macroeconomic level, the implications for the management of a specific company are more or less lost. One can furthermore argue that the different implications for companies operating in different sectors are indistinctive. One company’s challenge can frequently be another company’s market opportunity. It is therefore of the utmost importance for each company to identify, evaluate and treat/control its risks.
3.2 Definition of (Strategic) Risk Management
Risk Management is a strategic business process, where management needs to assess whether the company’s business activities are consistent with its stated strategic objectives, and how risk management is linked to investment and growth decisions.
Based on all that has been said about risk, Risk Management can be defined as understanding and working with risks through “manageable processes that eliminate, reduce and control pure risks55, enhance benefits and avoid determinants from speculative exposures”56. Managing the risk in a proper way can eliminate losses and even contribute to profit, which will be discussed further in this paper. In addition, it is important to underline that strategic risk management encompasses more than only focusing on economic risks and hazards. As Table 12 shows,
54 Risk Assessment – the overall process of risk identification, risk analysis and risk evaluation
55 A category of risk in which loss is the only possible outcome; there is no beneficial result. Pure risk is related to events that are beyond the risk-taker's control (e.g. fires, natural disasters) and, therefore, a person cannot consciously take on pure risk :
http://www.investopedia.com/terms/p/purerisk.asp 04.08.2009
56 Andersen, T.J.: Perspectives on Strategic Risk Management; Copenhagen Business School Press 2006 p.31
strategic risk management encompasses strategic risks, operation risks, economic risks and hazards.
Source: Copenhagen Business School, Strategic Risk Management: 8th class presentation by Torben Juul Andersen
Strategic Risk Management should be a structured and disciplined approach which aligns processes, people, technology and knowledge with the purpose of evaluating and managing the uncertainties that the enterprise faces as it creates value. Hence, the goal of Strategic Risk Management initiative is to create, protect and enhance shareholders’ value by managing the uncertainties that could either negatively or positively influence achievement of the organization’s objectives.57
While managing risks that create a company’s value, it is very important to focus not only on one specific risk, but to look at all the risks and evaluate their interdependencies - the ways how they influence business in various combinations. This type of risk management can be also called Enterprise-wide Risk Management, where the focus is on risk throughout the whole firm. This is a new approach to risk management, which emphasizes strategy, and whose implication is enterprise-wide. DeLoach declares in his work that risk management should be integrated in
57 DeLoach, J.W.: Enterprise-wide Risk Management: Strategies for linking risk and opportunities; Financial Times/Prentice Hall 2000. ISBN: 0273644149
Table 12: Strategic Risk Management, Enterprise Risk Management and Risk Management covering
