Businesses can’t operate without risk. Economic, technological, environmental, and competitive factors introduce obstacles that companies must not only manage but overcome.
According to PwC’s Global Risk Survey, organizations that embrace strategic risk management are five times more likely to deliver stakeholder confidence and better business outcomes and two times more likely to expect faster revenue growth.
If you want to enhance your job performance and identify and mitigate risk more effectively, here’s a breakdown of what risk management is and why it’s important.
Free E-Book: How to Formulate a Successful Business Strategy
Access your free e-book today.
Risk management is the systematic process of identifying, assessing, and mitigating threats or uncertainties that can affect your organization. It involves analyzing risks’ likelihood and impact, developing strategies to minimize harm, and monitoring measures’ effectiveness.
“Competing successfully in any industry involves some level of risk,” says Harvard Business School Professor Robert Simons, who teaches the online course Strategy Execution. “But high-performing businesses with high-pressure cultures are especially vulnerable. As a manager, you need to know how and why these risks arise and how to avoid them.”
According to Strategy Execution, strategic risk has three main causes:
These pressures can lead to several types of risk that you must manage or mitigate to avoid reputational, financial, or strategic failures. However, risks aren’t always obvious.
“I think one of the challenges firms face is the ability to properly identify their risks,” says HBS Professor Eugene Soltes in Strategy Execution.
Therefore, it’s crucial to pinpoint unexpected events or conditions that could significantly impede your organization’s business strategy.
According to Strategy Execution, strategic risk comprises:
Understanding these risks is essential to ensuring your organization’s long-term success. Here’s a deeper dive into why risk management is important.
In many cases, effective risk management proactively protects your organization from incidents that can affect its reputation.
“Franchise risk is a concern for all businesses,“ Simons says in Strategy Execution. “However, it's especially pressing for businesses whose reputations depend on the trust of key constituents.”
For example, airlines are particularly susceptible to franchise risk because of unforeseen events, such as flight delays and cancellations caused by weather or mechanical failure. While such incidents are considered operational risks, they can be incredibly damaging.
In 2016, Delta Airlines experienced a national computer outage, resulting in over 2,000 flight cancellations. Delta not only lost an estimated $150 million but took a hit to its reputation as a reliable airline that prided itself on “canceling cancellations.”
While Delta bounced back, the incident illustrates how mitigating operational errors can make or break your organization.
Most businesses create risk management teams to avoid major financial losses. Yet, various risks can still impact their bottom lines.
A Vault Platform study found that dealing with workplace misconduct cost U.S. businesses over $20 billion in 2021. In addition, Soltes says in Strategy Execution that corporate fines for misconduct have risen 40-fold in the U.S. over the last 20 years.
One way to mitigate financial losses related to employee misconduct is by implementing internal controls. According to Strategy Execution, internal controls are the policies and procedures designed to ensure reliable accounting information and safeguard company assets.
“Managers use internal controls to limit the opportunities employees have to expose the business to risk,” Simons says in the course.
One company that could have benefited from implementing internal controls is Volkswagen (VW). In 2015, VW whistle-blowers revealed that the company’s engineers deliberately manipulated diesel vehicles’ emissions data to make them appear more environmentally friendly.
This led to severe consequences, including regulatory penalties, expensive vehicle recalls, and legal settlements—all of which resulted in significant financial losses. By 2018, U.S. authorities had extracted $25 billion in fines, penalties, civil damages, and restitution from the company.
Had VW maintained more rigorous internal controls to ensure transparency, compliance, and proper oversight of its engineering practices, perhaps it could have detected—or even averted—the situation.
Risk management isn’t just about avoiding negative outcomes. It can also be the catalyst that drives your organization’s innovation and growth.
“Risks may not be pleasant to think about, but they’re inevitable if you want to push your business to innovate and remain competitive,” Simons says in Strategy Execution.
According to PwC, 83 percent of companies’ business strategies focus on growth, despite risks and mixed economic signals. In Strategy Execution, Simons notes that competitive risk is a challenge you must constantly monitor and address.
“Any firm operating in a competitive market must focus its attention on changes in the external environment that could impair its ability to create value for its customers,” Simons says.
This requires incorporating boundary systems—explicit statements that define and communicate risks to avoid—to ensure internal controls don’t extinguish innovation.
“Boundary systems are essential levers in businesses to give people freedom,” Simons says. “In such circumstances, you don’t want to stifle innovation or entrepreneurial behavior by telling people how to do their jobs. And if you want to remain competitive, you’ll need to innovate and adapt.”
Netflix is an example of how risk management can inspire innovation. In the early 2000s, the company was primarily known for its DVD-by-mail rental service. With growing competition from video rental stores, Netflix went against the grain and introduced its streaming service. This changed the market, resulting in a booming industry nearly a decade later.
Netflix’s innovation didn’t stop there. Once the steaming services market became highly competitive, the company shifted once again to gain a competitive edge. It ventured into producing original content, which ultimately helped differentiate its platform and attract additional subscribers.
By offering more freedom within internal controls, you can encourage innovation and constant growth.
Risk management also provides a structured framework for decision-making. This can be beneficial if your business is inclined toward risks that are difficult to manage.
By pulling data from existing control systems to develop hypothetical scenarios, you can discuss and debate strategies’ efficacy before executing them.
“Interactive control systems are the formal information systems managers use to personally involve themselves in the decision activities of subordinates,” Simons says in Strategy Execution. “Decision activities that relate to and impact strategic uncertainties.”
JPMorgan Chase, one of the most prominent financial institutions in the world, is particularly susceptible to cyber risks because it compiles vast amounts of sensitive customer data. According to PwC, cybersecurity is the number one business risk on managers’ minds, with 78 percent worried about more frequent or broader cyber attacks.
Using data science techniques like machine learning algorithms enables JPMorgan Chase’s leadership not only to detect and prevent cyber attacks but address and mitigate risk.
Risk management is essential to business. While some risk is inevitable, your ability to identify and mitigate it can benefit your organization.
But you can’t plan for everything. According to the Harvard Business Review, some risks are so remote that no one could have imagined them. Some result from a perfect storm of incidents, while others materialize rapidly and on enormous scales.
By taking an online strategy course, you can build the knowledge and skills to identify strategic risks and ensure they don’t undermine your business. For example, through an interactive learning experience, Strategy Execution enables you to draw insights from real-world business examples and better understand how to approach risk management.
Do you want to mitigate your organization’s risks? Explore Strategy Execution—one of our online strategy courses—and download our free strategy e-book to gain the insights to build a successful strategy.
We offer self-paced programs (with weekly deadlines) on the HBS Online course platform.
Our platform features short, highly produced videos of HBS faculty and guest business experts, interactive graphs and exercises, cold calls to keep you engaged, and opportunities to contribute to a vibrant online community.
We expect to offer our courses in additional languages in the future but, at this time, HBS Online can only be provided in English.
All course content is delivered in written English. Closed captioning in English is available for all videos. There are no live interactions during the course that requires the learner to speak English. Coursework must be completed in English.
No, all of our programs are 100 percent online, and available to participants regardless of their location.
Certificate Programs
HBS Online welcomes committed learners wherever they are—in the world and their careers—irrespective of their professional experience or academic background. To extend the reach of HBS Online, we no longer require an application for our certificate programs. (Applications are still required for our credential programs: CORe and CLIMB.) You can now immediately enroll and start taking the next step in your career.
All programs require the completion of a brief online enrollment form before payment. If you are new to HBS Online, you will be required to set up an account before enrolling in the program of your choice.
Our easy online enrollment form is free, and no special documentation is required. All participants must be at least 18 years of age, proficient in English, and committed to learning and engaging with fellow participants throughout the program.
Updates to your enrollment status will be shown on your account page. HBS Online does not use race, gender, ethnicity, or any protected class as criteria for enrollment for any HBS Online program.
Credential Programs
HBS Online's CORe and CLIMB programs require the completion of a brief application. The applications vary slightly, but all ask for some personal background information. You can apply for and enroll in programs here. If you are new to HBS Online, you will be required to set up an account before starting an application for the program of your choice.
Our easy online application is free, and no special documentation is required. All participants must be at least 18 years of age, proficient in English, and committed to learning and engaging with fellow participants throughout the program.
Updates to your application and enrollment status will be shown on your account page. We confirm enrollment eligibility within one week of your application for CORe and three weeks for CLIMB. HBS Online does not use race, gender, ethnicity, or any protected class as criteria for admissions for any HBS Online program.
