Building your risk management strategy framework

Stress-testing your risk management strategy can address business vulnerabilities that could lead to unacceptable levels of risk.

Board members, C-suite executives, and other organizational leaders have a responsibility to develop a vivid picture of the future and define a strategy to get there. Stress-testing that high-level strategy should be part of your risk management process. Everything a business or other organization does comes with some amount of risk, and understanding that risk on multiple levels is part of the responsibility.

Although companies haven’t traditionally stress-tested risk management strategy, that is changing — especially after the experiences of a global pandemic, multiple disastrous weather events, and continuing shortages in vital supply chains during the past two years.

As your organization begins to evaluate its strategy and risk management framework, ask these four questions to discover and address vulnerabilities that could escalate into unacceptable levels of risk.

Strategic planning often begins with collecting large volumes of data to use in modeling potential future scenarios and then analyzing a second wave of data for determining which scenario is best.

As enterprise risk management frameworks catch up to the new reality of proactively planning for so many disruptive outside forces, one emerging practice is stress-testing strategic plans. By incorporating black swan events into the planning process, leadership is able to estimate the possible impact on operations and also identify mitigating strategies to limit overall risk exposure to the business.

Business conditions can shift quickly and impact key areas such as the availability of raw materials or an unexpected upward swing of demand—sometimes within months. Having the flexibility to pivot overall strategy if needed is a big competitive differentiator now, and it will be even more important in the future.

Regularly reviewing and updating your risk management framework is essential to identifying and monitoring new or critical risks. When considering changes to your framework, evaluate these potential risk areas.

• Remote workforce technology risks. The work environment is being stretched through access points that are now potentially vulnerable. Is your organization doing everything for home computers that it was doing for workplace computers? Do employees need to use different applications to ensure security and reliability?
• Data risks. The amount of data used in organization systems is continuously growing. While there’s a potential for creating high value from data, it comes with risk. As the amount and potential of data rise—including upstream and downstream data from vendors and third parties—are your organization’s skillsets and governance policies keeping up?
• Talent risks. An organization is only as strong as its people. Does your organization need to evolve its recruiting strategy or its compensation model to maintain a leadership pipeline? What key roles could be co-sourced or outsourced?
• Cloud risks. Organizations are using more and more cloud technology and services for digital transformation. Have all of the potential risks of moving to the cloud been identified and addressed?

Organizations should revisit their risk framework routinely to ensure that top risks are aligned with current market conditions. You can leverage governance, risk management and compliance (GRC) software, automation, and analytics to help your organization monitor its risk framework in real-time and assess whether modifications are needed in your strategic plan or related activities.

For example, how could shortages of a particular skill set, growing cybercrime threats, or climate changes affect the overall risk framework and company strategy? Failure to monitor current business conditions and their impact on your risk framework, operations, and strategy could have significant consequences on the growth and viability of your operations.

One lens to use when updating your risk management framework is lessons learned from recent events. For example, many companies are reviewing and changing their supplier relationships and supply chain management because of the COVID-19 pandemic. When lean inventory practices and exclusively sourcing by low-cost led to a lack of materials and parts—and lost business when manufacturers couldn’t fulfill product demand—companies realized supply chain resiliency was a top risk that needed to be addressed.

Another common area to review is cybersecurity. According to the 2024 RSM US Middle Market Business Index Cybersecurity Special Report, 28% of middle market executives claimed their company experienced a data breach within the last year, rising from 20% in the 2023 survey.

Update your risk management strategy

By asking these four questions, you can begin to identify and assess the vulnerabilities that could develop into major risks to your business. While results from these assessments can be overwhelming, your organization does not have to address vulnerabilities alone. You can leverage the experience of a trusted advisor to ensure your organization remains healthy and aware of evolving, emerging risks to your business.