Risk Management and Scenario Planning

1. Risk Management and Scenario Planning By James Joseph Wasil Senior IT Strategist Ohio BWC January 9, 2014

2. Organizations such as ISACA and PMI are taking on governance. • Governance seeks to ensure that strategies in the organization are working toward its mission and goals. • Risk Management is becoming more and more important and strategy must be a function of risk appetite in an organization. Why is Risk Management Poised to take on Scenario Planning?

3. Faith is waning in traditional strategic planning efforts that generate forecasts that are usually wrong. • The most likely weakness in most strategies is underestimating risk. • Risk Management is evolving! Why is Risk Management Poised to take on Scenario Planning?

4. The Evolution of Risk Management From “Forging a Collaborative Alliance, RIMS & IA, 2012

5. Risk Management is in the business of developing and sustaining an organizational capacity for foresight (Maree Conway), and • The traditional business areas need to be incorporating this type of thinking into their strategic planning. • One way to incorporate foresight is through scenario planning. Conjoining Strategic Planning Function and Risk Management

6. “Traditional strategic planning models are increasingly viewed as not producing strategy that can deal with complexity, uncertainty and rapid change in the external environment.”* The Context of Business is Changing *Maree Conway - Swinburne University of Technology, and Thinking Futures

7. Ashby’s Law: If a system is to be stable the number of states of its control mechanism must be greater than or equal to the number of states in the system being controlled. Complexity

8. Ashby’s Law Restated: The only way to destroy variety is through variety. Variety (Complexity)   Variety (Flexibility)) Complexity

9. Strategic Flexibility is the optimum combination of strategic robustness and strategic responsiveness Strategic Flexibility Concept from Lindgren and Bandhold

10. Robustness is defined as “the potential for success under varying future circumstances or scenarios.” More specifically, The likelihood that the organization will not need to change in order to meet the challenge is called the “robustness of the organization.” Robustness Concept from Lindgren and Bandhold

11. Responsiveness is defined as the ability to • rapidly sense change in the environment, • conceptualize a response to that change, and • reconfigure resources to execute the response. Responsiveness Definitions are from Lindgren and Bandhold

12. Planning: Decision Orientation • Faster cycling trend • Need to fly by the wire by balancing stability and instability Action Observation OODA Loops* * From John Boyd

13. Just as in IT, strategy research has recently focused on the need for agile strategies, able to change upon the wind of a mere scent just blowing by. • Scenario planning has been identified as a method for accommodating rapid change Agility - Rate of Change

14. Strategic planning does consider the future since strategy involves the future, however it typically does not consider the future in a systematic way. Bolstering Strategic Planning From Maree Conway

15. UNCERTAINTY RISK SCENARIO PLANNING

16. Uncertainty is the lack of complete certainty - that is, the existence of more than one possibility (scenario). The “true outcome / state / result / value is not known* (perhaps until some future time) What is Uncertainty? * Douglas Hubbard. Parentheses by Wasil

17. Uncertainty is “local”, i.e., my uncertainty is different from yours. • There are more uncertain things than certain things. • All statements regarding the future are uncertain to some extent. • It is better to accept and recognize uncertainty. (this is the basis for scenario planning) Uncertainty From Lindely, Understanding Uncertainty

18. Approach to uncertainty involves setting up beliefs – a way to organize you beliefs in a reasoned way which leads to a reasoned action. • We use a normative (prescriptive) approach Uncertainty From Understanding Uncertainty, Lindley

19. We have free will, therefore we can decide more or less what we want to do! • When we get to certainty…then we are dead! Great News! Life is Uncertain

20. Unknowable uncertainty - the event cannot be imagined. Types of Uncertainty From Heijden

21. Risk uncertainty - Risk is a state of uncertainty where some of the possibilities involve a loss, injury, catastrophe, or other undesirable outcome Types of Uncertainty From Hubbard

22. Frank H. Knight (1885-1972) American economics scholar University of Chicago Classic work on Risk (1921) set its definition based in the context of uncertainty: If we cannot quantify outcome probabilities we have UNCERTAINTY. If we can quantify outcome probabilities then we have RISK. The History of Risk, ER and ERM

23. “ H.W. Heinrich was the Assistant Superintendent of Engineering and Inspection Division of the Travelers Insurance Company Heinrich’s Dominoes

24. “The probability and magnitude of a loss, disaster, or other undesirable event. That is, “Something bad could happen” Risk Management - “The identification, assessment, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events. That is, “Being smart about taking chances.” Hubbard’s Definition of Risk

25. International Standard ISO 31000 on Risk management – Principles and guidelines. • This is the latest source on risk management What is Risk? Risk Management?

26. Risk is the effect of uncertainty on objectives where • an effect is a positive and/or negative deviation • Objectives an have different aspects (financial, S&H, environmental) or a combination • Risk is often referenced to potential events and consequences or a combination • Risk is often expressed in terms of the consequences of an event and the associated likelihood of occurrence. What is Risk and Risk Management? From ISO 31000:2009

27. Balanced Scorecard is the prime Strategy Execution Framework among the Fortune 500 Risk Management is an Evolving Field

28. Robert S. Kaplan now venturing into Risk Management Three Kinds of Risks: Category I – Preventable Risks Category II - Strategy Risks Category III - External Risks Risk Management is an Evolving Field

29. RIMS: “Enterprise risk management is a strategic business discipline that supports the achievement of an organization’s objectives by addressing the full spectrum of its risks and managing the combined impact of those risks as an inter-related risk portfolio.” ERM Definitions from RIMS and IIA From “Forging a Collaborative Alliance, RIMS & IA, 2012

30. IIA: “Enterprise risk management is a structured, consistent and continuous process across the whole organization for identifying, assessing, deciding on responses to and reporting on opportunities and threats that affect the achievement of its objectives” ERM Definitions from RIMS and IIA From “Forging a Collaborative Alliance, RIMS & IA, 2012

31. Both ERM and IA Use Similar Tools

32. A forecast is like a vector in that it has direction and magnitude Strategic planning uses Forecasts

33. Scenarios cover, or envelope two or more axes of uncertainties Scenario planning uses Scenarios

34. Axis of Uncertainty “Y” Scenario A High Y Low X Scenario B High Y High X Axis of Uncertainty “X” Scenario C Low Y Low X Scenario D Low Y High X For Two Axes of Uncertainty

35. An internally consistent view of what the future might turn out to be - not a forecast, but one possible future outcome. Michael Porter Definitions of Scenarios

36. A description of a future situation and the course of events which allows one to move forward from the original situation to the future situation. Two major categories: • Exploratory - starting from past and present trends and leading to a likely futures; • Anticipatory or normative - built on the basis of different visions of the future to be desired or feared. Michel Godet Definitions of Scenarios (cont’d)

37. “narrative stories that follow particular paths into the future based on research, trends, and key concerns of the managers who will use them.” - Korte and Chermack Definitions of Scenarios (cont’d)

38. Scenarios are not about predicting the future, rather they are about perceiving futures in the present. Schwarz Important Distinction on Scenarios

39. Intuitive Logics - SRI, Pierre Wack, Ralston and Wilson • Trend-impact analysis - Futures Group • Cross-impact analysis - Battelle -Scenario Planning Methodologies

40. Identify the central question / problem (Decision Focus) Using executive peer groups, gain a consensus on what the key strategic decision is that the organization is facing. This will be your decision focus, and the scenario planning context. Note that it will be an agreement on how the scenarios will be used. (we are only interested in certain aspects of the future, not the future.) General Scenario Planning using Intuitive Logics Approach Excerpted From Ralston and Wilson, Scenario planning Handbook

41. Identify the central question / problem (Decision Focus) As an example, say you are in the energy business. Energy looks like a mixed bag. Coal and Nuclear becoming harder while fracking, solar, and wind are starting to produce. Your focus might be How are we going to be able to deliver energy inexpensively and reliably over the next 30 years? Form the focus as a explanatory paragraph. General Scenario Planning using Intuitive Logics Approach Excerpted From Ralston and Wilson, Scenario planning Handbook

42. Identify key decision factors (KDFs) Determine what the key external factors / issues are regarding the future that we want to know more about to improve our understanding. These KDFs are external, largely uncontrollable conditions. General Scenario Approach (Schwartz) Excerpted From Ralston and Wilson, Scenario planning Handbook

43. Identify key decision factors (KDFs) Example: How will fracking impact domestic energy production? How will wind power be incorporated into the grid? What new security threats /requirements will the grid face? Will nuclear energy again become promising? Etc. General Scenario Approach (Schwartz) Excerpted From Ralston and Wilson, Scenario planning Handbook

44. Cluster the key decision factor (KDFs) Categorize KDFs that fall into groups. Example: Energy Costs General Scenario Approach (Schwartz) Excerpted From Ralston and Wilson, Scenario planning Handbook

45. Research driving forces and drivers Since there is no source that predicts the future, the team must analyze the forces that determine the KDF outcomes. These are things like trends, forces, factors, events, areas of uncertainty This is analogous to the PESTEL analysis strategists perform, but is very rigorous. General Scenario Approach (Schwartz) Excerpted From Ralston and Wilson, Scenario planning Handbook

46. Research and rank key factors and driving forces Use an impact / uncertainty matrix to accomplish General Scenario Approach (Schwartz) Excerpted From Ralston and Wilson, Scenario planning Handbook

47. Develop scenario logics Identify the key axes of uncertainty Example: Say that we identified key axes: Technology, Resources, Environmental Issues, Cost, Security As potential axes. We pick the two most important axes of uncertainty. General Scenario Approach (Schwartz) Excerpted From Ralston and Wilson, Scenario planning Handbook

48. Determine Alternate Logics for Each Axis (technology and energy costs) Scenario A High technology Low costs Scenario B High technology High costs Scenario C Low technology Low costs Scenario D Low technology High costs General Scenario Approach (Schwartz) Excerpted From Ralston and Wilson, Scenario planning Handbook

49. Prepare narratives for each scenario, with a descriptive name. These are brief descriptions one or two paragraphs; A narrative of how each scenario might evolve Example: High Technology High Cost otherwise known as “Responsible Technology Scenario” General Scenario Approach (Schwartz) Excerpted From Ralston and Wilson, Scenario planning Handbook

50. As the end of the twenties arrives, the landscape is complete with wind farms occupying positions among citizens, who themselves are putting energy back into the grid with their solar energy panels, and even their electric cars. But the cost has been high. The grid is now robust, but costs to secure it have been very high in terms of purchasing multiple access right of ways, thousands of miles of underground high voltage equipment, and smart grid appliances that regulate millions of homes. Even though fusion has not become economical yet, efforts have… Example: High Technology High Cost otherwise known as “Responsible Technology Scenario” General Scenario Approach (Schwartz) Excerpted From Ralston and Wilson, Scenario planning Handbook