Matthew Humphrey, Partner, RSM
So, what do we mean by strategic risk?
Those risks that, if realised, could fundamentally affect the way in which the trust exists or provides its services in the next one to three years. These risks will have a detrimental effect on the trust’s achievement of its key objectives. The risk realisation will lead to material failure, loss or lost opportunity.
Many trusts and wider businesses that are considered to have mature risk management arrangements have not really focussed and engaged with this dimension of risk management. Trusts are usually good at responding to operational challenges in their many guises, though are not using strategic risk to set the trust future agenda and direction.
In some rare cases, organisations are not keen to even consider strategic risk because they are afraid of what they might find; either as a result of ignorance (I do not want to know!) or sometimes more dogmatic boardroom behaviours (I do not need to know!). Both characteristics you might find in less well-governed organisations (based on our wider experience). There are also trusts that think they know what their strategic risks are, but the risks, by their very nature, are not strategic (or do not meet the criteria in the definition above). Thus, the trust does not get the real benefit.
To consider whether your trust really understands its strategic risks, undertaking a strategic risk identification exercise involving the trust board can bring the following benefits:
- The trust board (collectively and collaboratively) having "head room” and time to consider, debate and articulate the future strategic risks of the trust. This discussion alone can be refreshing in itself and provide valuable insight and learning for trustees.
- Development of a common understanding of the trust’s strategic objectives, risks and organisational values.
- An opportunity for the board to assess its own vulnerability – does it know as much as it should? Or, are there any knowledge gaps?
- The chance to review and challenge plans. This will help manage the strategic risks, and ensure plans are as robust as they should be.
- An opportunity to refocus the boardroom agenda, or at least check that it reflects what it should do.
- Demonstrate to others that the trust board takes its risk management seriously.
To identify the strategic risks there has to be a starting point. In all cases this should be the trust’s strategic objectives, after all, this is what the trust is looking to achieve. Boards are encouraged to determine the correlation between the risks and each strategic priority, enabling them to understand which risk will have the most detrimental effect. This will start to form the basis of a strategic risk appetite.
A further step is to link operational risks to strategic risks. By their very nature, the strategic risks will take some time to materialise, unlike the operational risks which can present themselves more quickly and be used as early warning indicators. What the trust will have eventually is a risk management methodology that is focused totally on the achievement of its strategic objectives.
It does not matter how boards get an understanding of the strategic risks being faced, as long as they do. The future is still massively uncertain with constant changes. It is always better to be prepared and ready, so that you can protect your organisation or take advantage of the opportunities presented.
You can learn more about this topic by attending our CST Masterclass on risk assurance, which is available to book now.
More information in connection with RSM can be found at www.rsmuk.com and more information in connection with the RSM risk management software Insight4grc can be found at www.insight4grc.com
More information on RSM can be found on our website. RSM also provides risk management software, Insight4grc.
The CST Blog welcomes perspectives from a diverse range of guest contributors. The opinions expressed in blogs are the views of the author(s), and should not be read as CST guidance or CST’s position.
