Five emerging strategies for coping with unknown risks

There is hope for company executives who are willing to confront growing threats to their businesses.

A recent survey performed on behalf of the American Institute of CPAs showed that 62% of respondents believe the volume and complexity of risks has increased “mostly” or “extensively” in the past five years.

Many of the risks seem beyond the control of executives who are trying to protect their companies in an uncertain economy:

• Increasingly sophisticated hackers pose cyber-attack threats to governments as well as businesses.

• The debt crisis in Europe affects businesses worldwide and the entire global economy.

• Natural disasters pose danger to supply chains that often are spread across the globe.

But tactics do exist to help businesses survive and thrive despite these threats. Brian Brown, PwC’s US risk innovation assurance leader, advocates looking inward first.

“Focus somewhat internally on: ‘Where am I most vulnerable?’ ” Brown said. “ ‘What are the assumptions I’m making in my business? Will I have access to capital? What if I don’t?’ ...That’s the philosophy of how we’re thinking about these unknowns.”

Brown is a co-author of a PwC report called Coping With the Unknown: Risk Strategies for an Uncertain World. The paper lists five emerging strategies for coping with unknown risks:

• Use “reverse stress testing” to identify vulnerabilities. For example, a bank starts from a failure scenario and works backward to see how serious a recession would have to be to sink the business.

• Manage crises as if they occur every day. This may include building buffers to absorb shock, and may be a reason that so many companies now are sitting on significant quantities of cash.

• Enable a company-wide response to emerging threats. Firm-wide integration of IT and financial systems can help companies respond to risk events. 

• Integrate risk management and strategic planning. Situating enterprise risk management responsibility within the strategy group may be an emerging best practice.

• Do not focus exclusively on the downside of risk. Unexpected events are not always unpleasant, and experts say risk is linked with reward – as well as failure.

Brown said scenario planning can help businesses deal with a range of unknowns. Using the European debt crisis as an example, he said businesses can craft plans for what they would do if:

• Europe’s struggles do not get any worse.

• Some of the most debt-stricken nations lose their place in the EU.

• The EU breaks up completely.

“You clearly figure out where your cash is and what’s going to happen to that … and your liabilities today, and what’s going to happen to your cash flow,” Brown said. “It’s a perfect opportunity to use scenario planning. It may be that the action you take is appropriate for all three scenarios, which is great.”

Brown said businesses that are most successful in dealing with threats build risk management into existing management processes. He said research shows that a lot of companies perform risk assessments but do not sustain their risk-management efforts.

“The basics of internal control need to be set up and monitored properly for a subset of the types of risks that relate to human behaviour,” Brown said. “The more you integrate (risk management) into management processes, I think, the more successful you’re going to be.”

—Ken Tysiac (ktysiac@aicpa.org) is a CGMA Magazine senior editor.