We have found it useful to discuss risk treatment with clients along the lines outlined in this article. Understanding the categories of risk treatment will help in ensuring that the most important options are considered.
Evidence from enterprise practises is also presented, capturing how risk treatment strategies in a complex portfolio. This indicates the real-world challenges in implementing a full menu of risk mitigation options.
Finally, we discuss how the capability of the organization may impact the ability to handle different mitigation strategies. This builds upon excellent conceptualization developed elsewhere and cited below.
1. There are four different risk mitigation strategies to apply
When considering how to deal with an emerging risk, it is helpful to consider a list of four mutually exclusive risk categories. These are discussed below. The ISO 31000 identifies more categories, but most of those appear as subcategories. We find that these four concepts appear as logically complete and non-overlapping.
Exhibit 1: Overview of treatment options
(i) Change actions to reduce risk
Risk exposure stem from exposure from an activity. Change the activity and the risk changes. Practically, this is often about reducing, or increasing, the investment. I.e. if risks arise, many investors will consider whether to reduce their exposure. Evidence from investments in frontier and emerging markets indicate however that investors have a high barrier for reducing exposure when commitments are first made. We believe this also holds true for aid development investments by the major organizations.
Changing actions, such as those inherent in the adaptive iterative processes to project management popularized at Harvard University, can also be effective options to change the risk exposure. Such options may require more capability in the organization however, and whether or not this capacity is available, will be important to consider before applying adaptive measures. This is discussed in the last below section.
Leveraging skills and capabilities requires resources. Increasing the investment may also be an option in many situations.
(ii) Introducing additional measures to mitigate risk
It´s about introducing additional measures to mitigate, altering the likelihood or consequences of the original action. For example, organizations may decide to implement additional financial management requirements when investing in volatile environments. They may require enhanced due diligence, or additional capacity, i.e international project staff, to be embedded in project implementation.
This is the traditional thinking. Most classical risk management methodologies prescribe variations of this.
(iii) Risk transfer
With such methods, the risks are transferred to third parties. The activity remains the same. Risk transfer does come at a premium however. The classical implementation of this is insurance. Outside of the risks that are insurable, however, risk transfers become more elusive.
I.e investors in frontier economics frequently bundle investments in funds or other vehicles designed to pool funds. While these funds also pool risk, there is fundamentally no transfer. Any upside is equally distributed among the participants and the net risk/reward remains the same.
Organizations in the development aid sector frequently transfer risks by providing funding through international organizations. I.e the World Bank and the U.N receives funding to implement programs that engages in high risk areas. There is usually an overhead/premium associated with such approaches, and it may have an effect on transferring the risks.
Aid organizations also frequently outsource program implementation, or contract fiduciary agents to provide assurance that there is no corruption or fraud in the program. Be aware that it is questionable whether this constitutes effective risk transfer. It is questionable whether a government can ultimately transfer risk to a contractor. There may be there positive impacts, i.e such actions may enhance the capability of the aid organization temporarily to manage the high risk program, or it may help alter the likelihood and impact of risks.
Generally however, for most engagements in frontier economies there are few, if any, possibilities to effectively transfer risk.
(iv) Higher tolerance
When applied deliberately, this is an informed decision to continue without any change, effectively accepting a higher risk tolerance level. The difficutlies arise hwoever when te decisions are not deliberate. For example we find clients who find themselves absorbed in higher risks, having accumulated higher tolerance levels over time. Oftentimes overlooked the developments, or silently accepted them as they perceived that there where few other options. While accepting a higher tolerance level may be more common than anyone like to admit, there are other options as discussed here.
2. Evidence from practical application of risk treatment strategies
This is evidence from the risk treatment options identified in a portfolio of a global enterprise. These are articulated at the project identification stage.
In this example, the organization focused primarily on reducing impact/probability of their projects. Most of the mitigation measures focused on enhanced due diligence (i.e fiduciary controls), strengthening project implementation capacity, strengthening relationships and improving information through studies and research.
Absorbing higher risk was also identified up-front as a likely option. In practice, this also turned out to be the most frequently applied technique. Effectively increasing the risk exposure.
Changing actions is rarely identified up-front. This is possibly the area that requires most resources, and creativity to develop. During implementation however, there is more evidence of redesign and changing options that are effectively about changing actions. This is from a resourceful organization with high capacity to manage risks.
The corporation in this example had no effective risk transfer options and would need to internalize all risk taken on.
Exhibit 2: Illustration of risk treatment options across a real-world portfolio
3. Framework for choosing the risk treatment option
What variables should help determine what risk mitigation strategy to choose?
When considering the options, it may be necessary to consider the capacity to manage risk. This has a static element; the inherent capacity to manage risk; and a dynamic element, i.e how easy is it to increase the capacity?
These two dimensions can be mapped against the four risk treatment strategies discussed above. The framework below is adapted from a brilliant idea presented by David Apgar et.al in HBR a while ago.
Consider the four risk treatment options as discussed above, but mapped in a four field table. Then consider the two elements of capacity as identified by Apgar et.al.
- The vertical axis indicates the level of initial capacity to manage risk. If that level is low, there is no advantage in implementing the activity. Or the risk exposure is not wanted by the funders. If there is a high level of capacity, the organization can more easily decide to absorb the increased risk level and continue.
- The horizontal axis indicates the achievability of increasing capacity. If this is difficult to achieve, ie little knowledge is available, or the cost and effort is prohibitive, options are fewer.
This allows for interesting discussion of options in a given situation. I.e is my organization sufficiently equipped to manage the risks? How easy is it to increase y capacity and thereby increase the options?
Exhibit 3: Framework for choosing risk treatment options
By Ivar Strand. Managing Partner @abyrint.
