Strategic Decisions Have a High Failure Rate

Strategic decision-making is fraught with danger. Research studies indicate that the failure rate for strategic initiatives is up to 70%.¹ In addition, there is an abundance of case studies and examples that illustrate strategic decision-making gone awry. Just Google “examples of bad strategic decisions” and you'll get over 2 million results. One of my favorites is 24/7 Wall Street's “The Worst Business Decisions of All Time.” In mini–case study form, it highlights eight of the worst decisions by what were at the time Fortune 500 firms.²

In response to a 2009 McKinsey survey that asked senior executives about their most recent strategic decisions, respondents indicated three predominant problem areas:

1. Executives tended to dramatically overestimate their organization's ability to execute the strategy chosen.
2. Corporate leaders didn't adequately foresee competitive responses nor did they ensure complete alignment between the chosen strategic direction and their team members' incentives.
3. Due to common decision-making biases, executives limited their field of vision for the strategic options by not considering viable alternatives.³

Why do some companies get strategic decision-making right while others do not? Is it as simple as one executive's “gut” being better than another's? Or is one organization just naturally better positioned to come out on the right side of a strategic decision? I argue it goes much deeper than either of these reasons. And strategic risk management is center stage.

Risk Embedded in Strategic Decision-Making

Strategic risk can take various forms. One is simply pursuing the wrong strategy, such as overinvestment in a new product or a pursuit of the wrong acquisition candidate. Even with the right strategy, failing to execute effectively remains another risk. For example, a company might make the right acquisition but fail to integrate it effectively.

There is also the risk of inaction or not responding to key market trends. Outside factors, such as customer trends and emerging technologies, may render the existing strategy ineffective or outdated. This has become increasingly common in an age when mobile devices are replacing desktop computers, which themselves had replaced mainframes. In these cases, being on the wrong side of technological evolution can destroy considerable value. But if you're the disruptor, you can actually use these same opportunities to create enormous value. Finally, strategy execution will likely impact the overall risk profile of the company, including second-order strategic risks, operational risks, and financial risks. A well-implemented ERM program will consider all of these risks.

Companies ignore strategic risks at their peril. Independent studies of the largest public companies have shown time and again that strategic risks account for approximately 60% of major declines in market capitalization, followed by operational risks (about 30%) and financial risks (about 10%).⁴ Yet, in practice, many ERM programs downplay strategic risks or ignore them entirely. There are some historical reasons for that. When companies began to develop formal ERM programs in the early 1990s, they focused almost exclusively on financial risk, due to some high-profile losses stemming from derivatives and the fact that financial risk (i.e., interest rate risk, market risk, credit and counterparty risk, and liquidity risk) is more readily quantifiable.

In the mid-1990s, several disasters related to unauthorized trading at financial firms shifted attention toward operational risks, which are harder to measure. The difficulty in measuring these risks lies in the nature of operational glitches, the vast majority of which are commonplace, but financially insignificant. On the rare occasions when operational controls do break down, the consequences can be devastating—and not only for banks. One example is the 2010 Deepwater Horizon catastrophe. In addition to the damage and impact of the oil spill itself, the event also inflicted enormous financial and reputational damage on BP, Transocean, and Halliburton.

But if the goal of ERM is to enable management to identify, prioritize, and manage key risks, programs ought to give the highest priority to strategic risks, followed by operational. The financial risks that dominate ERM today should actually come a distant third.

What Is Strategic Risk?

Strategic risk can be defined as any risk that affects or is inherent in a company's business strategy, strategic objectives, and strategy execution. The list includes:

• Consumer demand
• Legal and regulatory change
• Competitive pressure
• Merger integration
• Technology change
• Senior management turnover
• Stakeholder pressure

Other risks may qualify for particular companies depending on the nature of their business. Siemens, the European conglomerate, captures this sentiment in its broad definition of strategic risk: “everything, every obstacle, every issue that has the potential to materially affect the achievement of our strategic objectives.”⁵

It is important to distinguish between operational and strategic risk. A company that has unmatched manufacturing processes will still fail if consumers no longer want its products. Whether they knew it or not, even the most efficient buggy-whip makers faced an existential threat in 1908 when Henry Ford introduced the Model T. In more recent times, Apple transformed the competitive landscape for cellular handset makers the day it launched the first iPhone. Good operations mean doing things right while good strategy means doing the right things. Long-term success requires doing both well under uncertainty.

The ability to recognize and manage strategic risks is critical to the sustainable success of any company. The rest of this chapter explains how to consider strategic risks in the planning process, how to measure these risks, and how to apply the results in practice.

Economic Capital

Risk identification and assessment is the first step, but a company must measure risks before it can manage them. Economic capital is a common currency whereby any risk can be quantified, thus making it one of the best available metrics.

Firms in any industry hold capital for two primary reasons: (1) to fund ongoing operations and investments and (2) to protect against unexpected losses. Unlike book capital, which is an accounting measure that represents the sum of invested capital and retained earnings, economic capital represents the amount of capital required to absorb unexpected loss. A simple example can illustrate the difference between book capital and economic capital: A company that increases its risk exposures, say, by increasing foreign exchange exposures or operational risks, will not instantaneously increase its book capital. Its book capital will reflect this shift over time only as the company experiences actual losses or retained profits. But its required economic capital will immediately increase as soon as its risk exposures increase.

A comparison between book capital and economic capital, while they are different, is very useful for determining capital adequacy. A company is overcapitalized if its book capital is above economic capital, and it is undercapitalized if the reverse is true. It is also important to note that book capital is a financial indicator of past performance, whereas economic capital is a forward-looking indicator of future performance. Strategic risk is about the future performance of the overall organization.

For strategic risks, the calculation of economic capital is forward-looking: the capital required to support new product launches or potential acquisitions, for example, or to withstand anticipated competitive pressure. The basic process is:

1. Generate standalone distributions of changes in the enterprise's value due to each source of risk.
2. Combine the standalone distributions, incorporating diversification effects.
3. Calculate the total economic capital for the aggregate distribution at the desired target solvency standard.
4. Attribute economic capital to each risk based on the amount of risk generated.

Risk-Adjusted Return on Capital (RAROC)

Dividing the anticipated after-tax return on each strategic initiative by the economic capital generates risk-adjusted return on capital (RAROC). If RAROC exceeds the company's cost of capital (Ke, or cost of equity capital), the initiative is viable and will add value; if RAROC is less than Ke, it will destroy value. But the decision whether to back an initiative should not depend on a single case reflecting the expected value. The company should run the numbers for multiple scenarios to see the distribution of results in both more and less favorable circumstances or in combinations of better and worse conditions over time. The final decision will depend on the specific company's risk appetite.

RAROC can be calculated for an institution as a whole or separately for each of its individual activities. Because the amount of economic capital that is required to support each of the enterprise's activities is proportional to the risk generated by that activity, economic capital can be used as a standard measurement of risk. Combining the economic capital required to support the risks of an activity with the activity's expected economic returns yields a ratio that represents the amount of return the institution expects per unit of risk involved.

The primary use of RAROC is to compare the risk–return trade-offs of different, and potentially quite diverse, strategic decisions. Economic capital/RAROC analysis works for organic growth initiatives as well as potential acquisitions. For example, a company with excess capital can determine if it is in the best interest of shareholders to buy back stock, grow the core business, or make a strategic acquisition.

In addition to economic capital and RAROC, companies deploy other methodologies to measure and manage strategic risk, such as net present value (NPV) calculations based on risk-adjusted discount rates or EVA®⁶ (Economic Value Added) models. The advantage of economic capital and RAROC models is that the analytical results are linked to risk exposures, earnings, capital management, and shareholder value.

Strategic Planning and Review

The start of the strategic risk management process is strategic planning. Several management frameworks help companies plan out their strategy. They may begin by analyzing their strengths, weaknesses, opportunities, and threats (SWOT) to determine where best to focus new initiatives. From there, many turn to one of the strategic frameworks I reviewed in Chapter 7. These include Kaplan and Norton's balanced scorecard to evaluate each initiative from different perspectives, including customers, internal processes, organizational capacity (knowledge and innovation), and financial performance. Some companies utilize Michael Porter's Five Forces model, which analyzes the effect on new initiatives of supplier power, buyer power, and competitive rivalry, threat of substitution, and threat of new entry. And then there's Geoffrey Moore's model for technology companies, The Four Zones to Win, in which strategic initiatives fall into one of four zones: incubation, transformation, productivity, and performance.⁸

These popular strategic planning tools provide structure to the process, but risk professionals have long recognized a major flaw: They do not fully take risk into account.⁹ In the aftermath of the 2008 financial crisis, Kaplan himself acknowledged the shortcoming: “…the measurement, mitigation, and management of risk have not been strongly featured in David Norton's and my work.”¹⁰

Risk Appetite

The strategic initiatives that are approved—as well as the triggers for acceleration or corrective action—all depend on a company's risk appetite, which I discussed in greater detail in Chapter 12. ERM implementation requires a company to create a risk appetite statement that defines how much risk it will take in pursuit of its business strategy. For strategic risks, the risk appetite metrics typically reflect the potential impact on earnings or enterprise value arising from adverse business decisions or lack of responsiveness to industry changes.

Rigorous use of standard planning tools generates an expected value for each strategic initiative without regard to the distribution of outcomes around that value should the projected results fail to materialize. Yet every initiative involves risk, and risk is a bell curve centered on the expected value, either today or at some future date, with tails trailing off toward worse or better performance. Companies that ignore risk in the planning process forgo the opportunity to manage the shape of that curve.

For example, two initiatives with identical expected values may have quite different risk profiles. One may have a narrow bell curve, which implies a higher probability the expected outcome will occur, a low risk of failure, and little opportunity for an unexpected windfall. The other may have a fat bell, suggesting that an outcome other than the expected value is more likely. Planning tools give no guidance on how to choose between the two, and the “right” choice will not be the same in every case, because companies have different appetites for risk.

Determining the Optimum Risk Profile

Although risk always takes the form of a bell curve, not all bell curves are alike. Figure 15.2 shows how the bell curve can be used to capture strategic and other risks with respect to the expected value and value drivers.¹¹

Interest rate risk or market risk can be plotted on an essentially symmetrical curve, as interest rates or market prices have an equal chance of moving with you or against you. On the other side of the spectrum, operational and compliance risk have a limited upside but large potential downside. After all, not having any IT, compliance, or legal issues simply means business as usual. But a major negative event, such as a security breach, IT downtime, or regulatory issue, can have tremendous downside consequences.

If managed well, strategic risk is unique in that its downside can be limited while its upside can be unlimited. A recent example is Uber, a disruptive technology company that is changing the ground transportation industry. Its valuation has gone from $60 million in 2011 to more than $50 billion in 2016. An asymmetrical bell curve with significant upside risk can describe any new product or business opportunity, whether that opportunity is part of a corporation's growth strategy or a venture capital firm's new investment.

Consider a decision tree that maps the probabilities and consequences of different decision paths.¹² This map not only provides a better picture of the risks and rewards involved, but also helps identify trigger points for action if the initiative lags behind expectations. Taken this way, the optimum strategic risk profile resembles a call option: limited downside exposure with unlimited upside potential. The sooner a company recognizes an initiative is in trouble, the sooner it can take corrective action—such as getting the initiative back on track, deploying risk mitigation strategies, or shutting it down altogether.

The objective to minimize downside and increase upside is the basis of real option theory. A real option is the right, but not the obligation, to undertake a business investment or to change any aspect of that investment at various points in time, given updated information. The beneficial asymmetry between the right and the obligation to invest under these conditions is what generates the option's value.

Venture capital firms take advantage of this asymmetry as part of their business model all the time. According to research by Shikhar Ghosh, a senior lecturer at Harvard Business School, about 75% of venture-backed firms in the United States fail to return investors' capital, and 95% fail to see the projected return on investment. That leaves a success rate of only 5%.¹³ To maintain an ideal risk profile, the VC carefully stages the funding rounds in order to minimize its investments in the 95% of bad investments, and reap outsized returns on the 5% of good investments. This low “hit rate” is why one of the key criteria for VCs is a large potential market size. When they win, they need to win big.

Pharmaceutical companies take a similar portfolio approach. They invest in drug development internally, buy patents that look promising, or acquire entire drug companies. They can then continue to make limited, iterative investments in successful ventures and bow out of those that fail to achieve expected performance levels.

M&A Decisions

M&A transactions can have a profound impact on the strategic risk profile of companies. A good deal can help a company leapfrog its competitors while a bad one can set it back many years. The ERM function can support critical decisions in M&A by assessing the risk profile of the target company and the risk–return economies of the combined organization.

Traditional merger analysis is based on financial projections of the companies operating as independent entities as well as a combined company. Based on these financial projections, companies can estimate potential earnings dilution or accretion for a number of scenarios by manipulating variables such as acquisition price, expected revenue growth, and cost synergies. But traditional earnings dilution/accretion analysis does not adjust for risk. As such, it can lead to a decision with adverse strategic and financial consequences.

Let's examine how ERM can help a company make better M&A decisions. Figure 15.3 provides an example of an M&A analysis.

In this example, Company A is considering acquiring either Company B or Company C. To simplify this example, assume that both companies can be acquired for the same price. Based on traditional financial analysis, Company C appears to be more attractive because it has a higher RAROC and a higher market-to-book (M/B) ratio than Company B. In M&A parlance, acquiring Company C would be antidilutive (no earnings dilution) while acquiring Company B would be dilutive.

But this evaluation does not consider the effects of diversification benefits (i.e., risk correlations), which is one of the key reasons why companies turn to acquisitions. ERM incorporates risk correlation into its evaluation of the two potential acquisitions. The impact of the diversification benefits is evident in the economic capital line of the combined entities. Acquiring Company B would result in a 30% diversification benefit: The economic capital of A + B is 210 compared to 300 before the merger (200 for Company A and 100 for Company B). On the other hand, acquiring Company C would result in a 10% diversification benefit: The economic capital of A + C is 270 compared to 300 before that merger (200 for Company A and 100 for Company C). As such, the acquisition of Company B would actually result in a higher RAROC and a higher M/B ratio for the combined company.

As this example shows, ERM can inform M&A decisions. The key is leveraging analytical tools such as economic capital and RAROC to evaluate alternative uses of capital—different acquisition candidates, organic growth (see risk-based pricing in the next section), and stock buybacks—and quantify their impact on shareholder value.

Risk-Based Pricing Decisions

A company can also grow organically by attracting new customers, introducing new products, and winning more business with current customers. To ensure a positive contribution to its strategic risk profile, the company must price its products appropriately. The most effective way for companies to ensure an appropriate return on the risks that they are willing to accept is to incorporate the cost of risk into their pricing methodologies. If the cost of risk is not fully reflected in the initial pricing (for example, if the product or transaction is underpriced relative to the risk), then there is nothing the company can do to recover its costs. Risks that are underpriced may increase revenue and growth in the short term, but over time they will destroy shareholder value. When quantifying the total cost of risk, companies should include:

• Expected loss (EL), or average loss per year over a business cycle
• Unexpected loss (UL), which can be defined as economic capital × Ke (cost of equity capital)
• Risk transfer costs (of hedging or insurance)
• Risk management costs (that pertain to maintaining staff, systems, etc.)

Figure 15.4 shows a numerical example of risk-based pricing, which is based on the same methodology used to calculate RAROC.

In the first column, “Calculate RAROC,” the math works from top to bottom. We have a $100 million transaction and a 2.5 % margin, resulting in $2.5 million in revenue. We derive pre-tax net income of $1 million after subtracting risk losses (expected loss) of $500,000 and expenses of $1 million. Assuming a 40% tax rate, we calculate a net income of $600,000. In this example, we allocated $2 million in economic capital based on the transaction's underlying risks. Finally, we can calculate a 30% RAROC by dividing net income by economic capital.

This 30% RAROC metric can aid decision-making in two ways. First, it can support product and customer management strategy. If RAROC is greater than Ke, then the transaction or customer is creating shareholder value and the company should increase this business. Conversely, if RAROC is less than Ke, then the transaction is destroying shareholder value and the company should discontinue this business, increase price, or cross-sell more profitable products to the same customer to increase the overall RAROC of the relationship above Ke.

Second, RAROC can support business management and resource allocation. Companies can compare the RAROCs of different business units against each other because they provide a universal risk-adjusted measurement of profitability. Other profitability measures, such as profit margin, return on assets (ROA), and return on equity (ROE), are not risk-adjusted, so comparisons could lead to false conclusions. For example, a business unit with marginally lower ROA and ROE might be more attractive than another business unit if the former has a substantially lower risk profile. RAROC analyses support management decisions regarding which businesses to grow, maintain, fix, shrink, or exit.

In our example, how should the company respond if a close competitor decides to introduce a discount pricing strategy by charging a 2.3% margin (instead of 2.5%)? Risk-based pricing can support that business decision. The Calculate Pricing column of Figure 15.4 demonstrates this. The math in this instance works backward, or from bottom to top. Say the company decides that it must achieve at least a 20% RAROC for this business. By applying the same methodology as above, but in reverse, it determines that a 2.2% margin would meet this minimum. As a result, management can safely lower the price to remain competitive.

For more than 20 years, banks have applied economic capital, risk-based pricing, and RAROC analysis in managing their businesses. Banks use these tools to measure risk-adjusted profitability and pricing for a wide range of products and services, including commercial loans, consumer loans, derivative products, and investment banking and brokerage services. But risk-based pricing is also a critical practice for nonfinancial companies. The Airbus case study below shows the potential pitfalls when strategic programs do not fully account for the cost of risk.

Case Study: Airbus

After five rocky years of delays and cost overruns for two high-profile product launches, European aviation giant Airbus acknowledged in 2010 that a large part of its problems related to the fact that it failed to account for risk in its pricing strategy.

At the time, two of Airbus's biggest programs—the A380 superjumbo jetliner and the A400M military transport plane—were years behind schedule and billions of dollars over budget. Several smaller programs also faced issues meeting deadlines and fulfilling customer requirements. Louis Gallois, CEO of Airbus parent the European Aeronautic Defence and Space Company (EADS), admitted that the company generated “insufficient” profit due to problems with the flagship programs. EADS CFO Hans Peter Ring added that the core issue was the difficulty in matching the heavy demands of customers against the ambitious financial returns expected by investors. “We are in a high-tech, complex business, and there is a lot of risk in our business. That won't change,” Ring said in an interview with the Wall Street Journal. “The question is how to price risk. Obviously, in some cases we didn't price it right.”

One key benefit of strategic risk management is early warning of potential problems. Alarms will sound if an initiative falls behind expectations, giving management the opportunity to redirect the effort, lay off risk, or, if results come in so far below target that nothing can salvage the project, to implement an exit strategy early on. The ability to “fail faster” will do more than almost anything else to improve a company's financial performance.

Lack of reliable metrics is no longer an obstacle to strategic risk management. Economic capital is a common currency in which any risk can be quantified, and the RAROC calculated in various scenarios allows management to determine which business activities will maximize shareholder value.

Although strategic risks pose the greatest threat to most companies, few have yet to incorporate strategic risk management into their ERM program. Strategic initiatives always involve risk, and some will not pan out as expected no matter how carefully planned. Companies that manage strategic risk skew the overall risk–return profile in their favor. They can ramp up initiatives that exceed expectations and spot potential losers in time to take corrective action before significant losses accumulate. Risk management should improve the percentage of successful initiatives as well as create a strategic risk profile similar to a call option, with its limited downside risk and unlimited upside potential.

GE Capital

During the 1990s, GE Capital employed a version of real options in its Policy 6.0 program. Under this program, if an investment did not live up to expectations, management had the option to mitigate or exit, thus limiting exposure. For new products, new businesses, or mission-critical projects, Policy 6.0 represented a practical best-practice model for strategic risk management. It required a detailed analysis of strategic risks associated with any new initiative as well as quarterly reviews between business leaders and GE corporate executives to monitor and manage business performance relative to clear expectations. The major components of Policy 6.0 include:

• Key Assumptions: The new business must identify the key assumptions that support its feasibility, often including the most critical strategic risks such as business trends, customer needs, and disruptive technologies.
• Monitoring Systems: For each assumption, the business must identify monitoring systems for key performance indicators, key risk indicators, and early warning indicators. They must also specify the individuals responsible for oversight.
• Trigger Points: For critical metrics, the business must establish predefined positive, expected, and negative trigger points to initiate management actions or reviews in between the quarterly reviews. Breaches of significant thresholds may trigger immediate escalation and special reviews.
• Management Decisions and Actions: Positive trigger points signify results that are better than expected, which may prompt management to accelerate the business plan or take more risk. Negative trigger points give management the opportunity to initiate risk mitigation strategies or an exit strategy if key metrics and trends are well below expectations.

Similar to a VC firm, Policy 6.0 allowed GE Capital to continue or accelerate its investments that meet or exceed expectations while making timely corrective actions on investments that don't.

Duke Energy

In the late 1990s, the market for electric power went through wrenching changes when states began to deregulate utilities.¹⁴ At a strategy session in July 2000, Duke Energy identified three possible scenarios for its future business environment:

• Economic Treadmill, in which U.S. economic growth would stagnate at 1% per year
• Market.com, in which the Internet would revolutionize the relationships between buyers and sellers
• Flawed Competition, in which uneven deregulation would continue in the energy industry, causing significant price volatility in different regions.

The timing proved prescient. Duke had appointed its first chief risk officer earlier that year, and the U.S. economy had begun the slide that would burst the Internet bubble.

Duke set early warning signals for each scenario: macroeconomic indicators, regulatory trends, technology changes, environment issues, competitive moves, and patterns of consolidation in the energy industry. It soon became apparent that “Flawed Competition” was the most likely outcome, enabling Duke to take evasive action against potential adverse consequences. Unlike many competitors, Duke scaled back its capacity expansion and concentrated on maximizing returns from its existing portfolio even if that meant shedding assets. Anticipating an oversupply of power generation in Texas in the coming years, Duke sold some new plant projects in the state before construction was complete.

Duke reaped the rewards of its foresight in subsequent years and continues to perform well relative to its competitors.