Strategy and Risk Management
Setting direction and managing uncertainty
Strategy defines where the organisation is going and how it will win; risk management identifies what could derail that journey. The board approves strategy and risk appetite, monitors execution, and ensures a risk framework is embedded. Strategy and risk are two sides of the same coin: every strategic choice carries risk, and risk appetite should be expressed in terms the business can act on.
Concepts to master
- Vision, mission, strategy, business model and value proposition.
- Strategic planning cycles, scenario analysis, and competitive advantage.
- Risk frameworks: identify, assess, treat, monitor; likelihood and consequence; risk registers.
- Risk appetite and tolerance statements, and the difference between them.
- Emerging and strategic risks, including cyber, climate, regulatory and reputational risk.
- The three lines model: management owns risk, risk functions oversee, internal audit provides assurance.
Common traps
Questions often blur risk appetite (the amount of risk the board is willing to accept in pursuit of objectives) with risk tolerance (acceptable variation around that appetite). Another trap is treating risk as a compliance exercise rather than a strategic one. Watch for scenarios where the board approves strategy but never revisits it, or where a risk register exists but no one acts on it. Also distinguish inherent risk from residual risk after controls.
Rule of thumb
If a strategic initiative cannot be linked to a risk assessment and a measure of success, it is not ready for board approval. Strategy without risk is incomplete; risk without strategy is aimless.
Worked example
A board considers expansion into a new market. It should test the plan against scenario analysis, define the risk appetite for the venture, identify mitigations, and set milestones for review, rather than approving on optimism alone.