Delivering stability and growth through strategic-risk management

Strategic risk is a critical consideration for financial institutions. It encompasses the potential for losses or adverse outcomes stemming from inability to effectively respond to changes in the business and regulatory environment, flawed business decisions, inadequate strategic planning and execution, and mismanagement of key initiatives.

While financial risks (notably credit, market and liquidity risks) and certain nonfinancial risks (say, cyber and resilience) grab board attention, the board is, if anything, more accountable for strategic risk. After all, they set the risk appetite that frames the strategy and they approve the strategy and associated budgets. Boards and senor should prioritize strategic-risk management as a core component of their governance and decision- making processes to safeguard their institution's future.

• Strategic risk management is vital for maintaining financial stability and growth in a rapidly changing industry.
• Effective governance and leadership are crucial to mitigating strategic risk through robust decision-making frameworks.
• Proactive adaptation to market trends and regulatory changes can prevent significant financial and reputational losses.
• Embedding strategic risk metrics into daily operations promotes continuous monitoring and management of potential threats.

See also Governing strategy.

Causes of strategic risk

There are various definitions of what constitutes strategic risk. Most feature failure to adapt to changes in the business environment, potential losses due to flawed business decisions and poor strategic planning. Some definitions emphasize weak governance, regulatory shifts and competitive pressures.

It can be more informative to categorize strategic-risk drivers into external factors, internal factors and strategic planning and execution.

External factors

External factors encompass the broader economic, competitive and regulatory environment in which financial institutions operate. These factors are largely beyond the control of the institution but significantly impact its strategic-risk profile:

• Misalignment with market trends: Financial institutions operate in a dynamic environment where market trends can shift rapidly due to unexpected market events, technological advancements, evolving customer preferences and competitive actions. When an institution fails to stay in tune with these trends, it risks losing its competitive edge and, over time, becoming irrelevant. For instance, banks that fail to adopt digital banking technologies risk losing customers to more technologically advanced competitors.

Illustrative metrics include:

o?? Market share: Percentage of total market controlled by the institution, indicating competitive positioning.

o?? Customer growth rate: Annual rate of increase or decrease in number of customers, reflecting market trends.

o?? Revenue growth rate: Year-over-year revenue growth compared to industry averages, showing competitive performance.

o?? Net promoter score: A measure of customer satisfaction and loyalty, indicating competitive positioning.

o?? Market penetration rate: Percentage of potential customers in a market who are using institution’s services, reflecting overall customer satisfaction.

• Lack of responsiveness to economic conditions: Financial institutions face significant strategic risk when they fail to adapt to rapidly changing economic conditions. Becoming too accustomed to a prolonged period of low interest rates, for example, can leave an institution ill-prepared for a sudden spike in rates. This scenario can lead to reduced profitability on loans, higher costs for borrowing and a potential liquidity crunch. Unexpected economic or industry events, such as a financial crisis or a sudden recession, can create immediate and severe impacts. Institutions that do not adjust their strategies and risk assessments in response to sharp economic shifts face increased defaults, declining asset values and eroded capital reserves.

Illustrative metrics include:

o?? Interest rate changes: Tracking interest rates, highlighting potential impact on an institution’s loan and deposit portfolios.

o?? GDP growth rate: Monitoring national or regional economic growth rates, assessing overall economic conditions.

o?? Inflation rate: Tracking inflation rates, illustrating a range of effects on operating costs and pricing strategies.

o?? Unemployment rate: Monitoring unemployment rates, gauging economic health and its potential impact on loan defaults and customer spending.

o?? Consumer confidence index: A measure of consumer optimism about the economy, indicating potential spending patterns and economic health.

• Failure to adapt to regulatory changes: The financial services sector is heavily regulated and regulatory change can have profound effects on business operations and profitability. This is especially true when regulatory change is broad in nature, like Dodd-Frank in the US. Institutions that fail to foresee these changes and adapt quickly enough face strategic risk in the form of non-compliance penalties, legal challenges and reputational harm.

Illustrative metrics include:

o?? Number and severity of compliance breaches: Incidents where the institution failed to comply with regulatory requirements, reflecting the organization’s attitude toward compliance.

o?? Regulatory fines and penalties: Total amount of fines and penalties imposed, reflecting the severity of non-compliance.

o?? Time to comply: Average time taken to comply with new regulations after they come into effective, reflecting the (in)ability of the organization to adapt in a timely manner.

o?? Training completion rates: Percentage of employees who have completed mandatory compliance trainings, highlighting the culture of compliance.

o?? Internal audit findings: Number and severity of issues identified during internal audits related to regulatory compliance, highlighting potential failings in the first and second lines of defense to comply.

Strategic risk is the risk to current or projected financial condition and resilience arising from adverse business decisions, poor implementation of business decisions, or lack of responsiveness to changes in the banking industry and operating environment. The board and senior management, collectively, are the key decision makers that drive the strategic direction of the bank and establish governance principles. The absence of appropriate governance in the bank’s decision-making process and implementation of decisions can have wide-ranging consequences. The consequences may include missed business opportunities, losses, failure to comply with laws and regulations resulting in civil money penalties (CMP), and unsafe or unsound bank operations that could lead to enforcement actions or inadequate capital. – Comptroller’s Handbook, Office of the Comptroller of the Currency, 2019

Internal factors

Internal factors refer to the organizational attributes and practices that influence an institution’s ability to manage strategic risk. These factors are within the control of the institution. Effective management of these internal enables the institution to be better equipped to execute its strategy, adapt to changes and mitigate risks:

• Misalignment in organizational structure and culture: Poorly structured organizations often suffer from ineffective coordination and communication, leading to misdirected strategic resources and increased project failures. Siloed decision-making can led to competing priorities, missed opportunities and larger than anticipated risk taking. A negative corporate culture—especially one that lacks transparency, accountability and commitment to continuous improvement—can stifle innovation, slow decision-making and lead to employee disengagement.

Illustrative metrics include:

o?? Employee satisfaction: Levels of employee satisfaction, indicating attitudes towards leadership and organizational culture.

o?? Internal survey results: Insights into employee perceptions and engagement, reflecting alignment with the organization’s strategic direction.

o?? Employee turnover rates: Rates of employee change and voluntary departures, reflecting satisfaction with leadership direction and culture.

• Ineffective leadership and governance: Weak leadership can lead to flawed strategic decisions and an inability to navigate complex business environments, increasing an institution's vulnerability. Similarly, weak governance structures result in inadequate oversight, accountability, reporting and escalations, heightening the risk of strategic missteps and failures.

Illustrative metrics include:

o?? Governance reviews: Periodic reviews of alignment with best practices and regulatory requirements, reflecting commitment to strong governance.

o?? Leadership assessments: Evaluations of leadership performance, indicating quality and depth of management and openness to feedback and coaching.

• Inefficient operations: Inefficiencies can lead to increased costs, reduced customer satisfaction and missed strategic opportunities; in turn, this can hinder an institution's ability to respond swiftly to market changes, elevating strategic risk. Poor processes can cause service delivery issues, customer dissatisfaction and an erosion in trust.

Illustrative metrics include:

o?? Operational cost ratios: Cost-effectiveness of operations, reflecting management’s level of discipline in managing corporate resources.

o?? Efficiency key performance indicators: Ongoing monitoring of organizational performance, indicating management’s commitment to efficient and effective operations.

o?? Process improvement metrics: Outcomes of process improvement initiatives, indicating management’s ability to turn plans to reality.

• Mismanagement of major initiative: Major initiatives, such as technology transformations, significant new products, entering new markets and acquisitions underpin an institution’s long-term strategy but each carries significant strategic risk. Poor management of these initiatives can lead to cost overruns, delays and failure to achieve strategic objectives. Inadequate planning, resource allocation and execution can result in strategic failures and financial losses. Management can get severely distracted by getting such initiatives back on track.

Illustrative metrics include:

o?? Budget adherence: Variances between planned and actual project budgets, indicating financial discipline.

o?? Milestone achievement: Completion of key project milestones, gauging progress and identify potential risks.

o?? Project completion rates: The percentage of projects completed on time and within budget, highlighting discipline in project management.

Strategic planning and execution

Strategic planning and execution involve the processes and practices used to develop and implement the institution’s strategic objectives:

• Ambiguous or unrealistic goals: Goals that are not specific, measurable, achievable, relevant and time-bound create confusion and lack of direction, wasted resources, missed opportunities and an inability to adapt to changing conditions. They can lead to competing management efforts or higher-than-desired risk taking.

Illustrative metrics include:

o?? Strategic goal achievement rates: The percentage of strategic goals successfully achieved, indicating the effectiveness of the planning process and quality of execution.

o?? Timeline adherence: Adherence to timelines, reflecting management’s ability to execute successfully within expected timeframes.

• Ineffective resource allocation: The misallocation of financial, human and technological resources significantly heightens strategic risk. It can lead to project delays, cost overruns and underperformance. Institutions that fail to allocate resources effectively risk wasting valuable assets, missing critical opportunities and, ultimately, failing to meet their strategic goals.

Illustrative metrics include:

o?? Return on investment (ROI) on strategic initiatives: ROI, reflecting management’s ability to achieve expected financial or other returns from strategic initiatives.

o?? Resource utilization rates: Rates such return on invested capital, employee productivity, technology usage, indicating how effectively resources are being used.

o?? Investment performance: Performance in achieving investment objectives from strategic initiatives, beyond financial returns, indicates management’s focus on delivering desired nonfinancial outcomes.

• Failure to monitor and adapt: Institutions that do not continuously monitor their strategic plans and adapt to changing circumstances risk falling behind and failing to meet their objectives. Without regular reviews, tracking of progress and necessary adjustments, strategic initiatives can veer off course.

Illustrative metrics include:

o?? Strategy review cycle: The frequency and thoroughness of strategy reviews, reflecting the institution's commitment and ability to keep plans relevant and aligned with evolving conditions.

o?? Adaptive decision rates: The rate at which strategic decisions are adapted based on new information, indicating the institution’s agility and responsiveness to changing circumstances.

o?? Risk mitigation effectiveness: The success of measures taken to mitigate identified risks, providing insights into the institution’s risk management capabilities, adaptability and overall resilience.

Importance of governance and accountability

Effective governance and accountability are fundamental to managing strategic risk within financial institutions. The board holds ultimate responsibility for the institution’s strategic direction and risk management. It sets the risk appetite, approves the strategic plan and associated budget and validates adequate risk management frameworks are in place to guide its execution:

• Engage in a robust strategic planning process: The board should engage in an iterative and well-designed strategic planning process. This includes requiring that second-line risk management challenge and inform draft plans, so strategies are thoroughly vetted and aligned with the institution’s strategic goals and risk appetite. The board should be engaged several times across the course of planning, not just once at the annual strategic offsite.
• Assess strategic alignment with risk appetite: The board sets the level of risk that the institution is willing to accept in approving the risk appetite. The board should assess strategic plans in this context, making sure they align with the desire risk appetite levels. This alignment helps prevent excessive risk-taking while enabling the institution to capitalize on strategic opportunities.
• Oversee risk management: The board is responsible for making sure robust risk management frameworks are in place. This includes comprehensive policies, procedures and tools for identifying, assessing and mitigating strategic risks. These frameworks should be designed to adapt to evolving threats and opportunities, incorporate advanced risk assessment methodologies and, where possible, use (near-)real-time monitoring systems. The board should regularly review these frameworks, confirming they reflect changes in the business environment, regulatory landscape and organizational objectives. The board should set high expectations on risk management to engage in strategic planning and monitor risks that may undermine its execution. Similarly, it should charge internal audit (the third line) to assess the strategic planning process against regulatory requirements and industry practice.
• Embed strategic-risk management into organizational processes:The board should expect management integrates strategic risk management into the institution’s daily operations by establishing clear, measurable metrics that align with strategic objectives and risk appetite. These metrics should encompass market trends, regulatory changes, operational efficiency and strategic execution. Such metrics should be weaved into executive and employee performance reviews and incentive programs, so everyone is encouraged to manage risk effectively.
• Hold management accountable: The board must hold senior management accountable for executing the institution’s strategic vision and managing day-to-day operations. It should regularly discuss strategic as part of routine in-depth discussions on strategic direction, emerging risks and the effectiveness of risk management. Strategic-risk reports should be provided to the board regularly (typically quarterly, but more frequently during periods of significant change or heightened risk). These reports should offer detailed analysis, trend information and comparisons to the institution’s strategic objectives and risk appetite to provide a clear understanding of the risks and efforts to manage them.

The board should actively engage with executive management on strategic-risk assessments. This involves reviewing risk reports, challenging assumptions and seeking clarification on risk management strategies. Boards should foster open communication channels so information flows seamlessly between the board and executive management.

Conclusion

Strategic risk is a critical concern for financial institutions, encompassing the potential threats arising from adverse business decisions, an inability to adapt to industry changes and ineffective strategic planning and execution. Proper management of strategic risk helps maintain financial stability, achieve sustainable growth and safeguard the institution's reputation.

To remain resilient and competitive in a rapidly evolving financial landscape, institutions must proactively refine their risk management frameworks, stay informed about industry developments and foster a culture of agility and innovation. By doing so, they can navigate future challenges successfully, delivering long-term stability and growth. Board and senior management should promote a proactive and adaptive approach to strategic-risk management, safeguarding their institution’s future.

For more information, contact: [email protected]

Copyright: Mark Watson