Skip to main content.

Developing treatments for strategic risks in an agribusiness


A substantial agribusiness asked Broadleaf to assist in reviewing and improving its enterprise risk management (ERM) process, developing a corporate risk register and facilitating the establishment of treatment options and action plans for the main strategic risks. This case outlines the process, with a particular focus on the treatment activity.

The company had an ERM framework in place and risk assessments were conducted regularly in business units, but the process was not well regarded by people in the field. The executive wanted an independent view of ERM, and in particular they wanted to extend the process to generate improvement actions. There were two reasons for this: to improve the business, and hence to demonstrate the value of ERM to other managers across the business.


We developed an initial summary of the context for the company. It covered:

  • The objectives of the business
  • The company’s major stakeholders and their objectives
  • The external environment in which the business operated
  • The internal context of the business, including its strengths and weaknesses
  • A set of key elements for structuring the corporate risk register.

Figure 1 shows the five categories into which the 31 individual elements were grouped.

Figure 1: Key elements

The main risks

We reviewed corporate and business unit risk registers from across the company and grouped the risks according to their causes or sources. The eight key risks shown in Table 1 provided the basis for a risk treatment workshop.

Table 1: Major risks



Local product supply

There is insufficient local product for our business needs

International product supply

We are unable to source sufficient product internationally for our business needs

Business assets

Loss or restricted use of physical assets and facilities

Business assets

Loss or unavailability of IT systems and business information


We become less competitive in our core markets


We are unable to source sufficient funding to maintain business growth


We are unable to retain key people and capabilities

Quality & regulatory

There is a major failure of our quality or regulatory compliance processes

Risk treatment

We facilitated a risk treatment workshop with the senior management team to examine the main risks in Table 1. The objectives of the workshop were to:

  • Document the key controls for each risk, to provide input to internal audit and control self-assessment activities
  • Identify gaps where there were important causes or impacts of the key risks that were not addressed already by existing business controls
  • Develop options for treating the risks and generating business improvements, note their business benefits and costs, and develop priorities for dealing with them
  • For high-priority options, develop outline treatment action plans, including a description of the task, the task owner responsible for detailed planning and implementation, and indicative timing.

We used a bow-tie structure to guide the workshop analysis, summarised in Figure 2. The steps were to:

  • Document the causes and impacts of each risk
  • Document the controls in place for the causes (preventive controls) and the impacts (reactive controls)
  • Identify potential options for addressing gaps in the controls and improving business outcomes.

Figure 2: General bow tie structure

Bow tie analysis for identifying control gaps

We did a lot of preparation before the workshop to allow it to proceed efficiently.

  • Review of existing material: We developed initial bow-tie information from the current corporate and business unit risk registers. It was very likely that some circumstances had changed, actions had been completed and new controls created since those registers were revised last, so we needed to check and ensure that we were working from the most current base.
  • Analysis for the headline risks: The risks in Table 1 were aggregates or summaries of more detailed risks from the corporate and business unit registers. We formed a high-level view for each risk, using the company’s ERM rating tables. (Note that these had been enhanced during the review of risk management processes in the organisation. There were two new features – control effectiveness and potential exposure – that were explained and discussed at the workshop.)

We summarised the preparatory material in a set of tables, one for each risk in Table 1. These tables, an example of which is shown in Table 2, provided the structure for discussion during the workshop, and they were augmented as the workshop progressed.

Table 2: Risk treatment analysis table

In the workshop we facilitated a brainstorming of additional treatment options for each risk. The challenge here was to think expansively about options for business improvement. The control gaps, where there were few effective direct controls for identified causes or impacts of each risk, provided one starting point for identifying options (Figure 2).

We also prompted the managers using the set of generic treatment strategies:

  • Do something different
  • Change the likelihood
  • Change the consequences
  • Share the risk
  • Retain or tolerate the risk.

We then prompted the managers to rate the options on the basis of an initial assessment of the benefits and costs of implementation, using the guidance in Table 3. We then allocated responsibilities (task owners) for developing action plans for options rated High, monitoring plans for options rated Medium and Low, and for undertaking any further analyses required for options rated Maybe.

Table 3: Treatment option priority




The benefits clearly outweigh the disadvantages and the option seems easy to implement quickly. Immediate improvements are expected. Action planning and implementation should start soon.


The benefits clearly outweigh the disadvantages, although improvements may not be immediate. Action planning should start as resources allow.


The benefits outweigh the disadvantages but either the overall improvement may be small or implementation may be difficult to achieve. Action planning may be deferred.


There seem to be high potential benefits but there are major disadvantages too. However, the balance of benefits and disadvantages is not immediately clear. Further study is recommended.


The disadvantages clearly outweigh the benefits and this option does not seem worthwhile pursuing.

Figure 3 and Figure 4 show two bow ties augmented with material generated in the workshop. Each item has a number or numbers following it in parentheses: these are links to descriptions of specific causes, impacts and controls in the associated treatment analysis tables like Table 2.

The two examples here have been selected because they are relatively generic, with wide application to many sectors. Others were highly specific to this agribusiness and the products with which it dealt.

Figure 3: Bow tie for physical assets

Figure 4: Bow tie for competitiveness

Post-workshop activities

After the workshop, task owners developed:

  • Detailed treatment action plans for all options rated High
  • Monitoring plans for all options rated Medium or Low
  • Plans for additional analyses for options rated Maybe.


As with any workshop, preparation is a key factor in achieving an effective and efficient outcome.

The treatment tables like Table 2 were circulated well in advance of the workshop, with detailed briefing instructions. This allowed all managers plenty of time to examine them, collect additional information where appropriate and develop options for additional or enhanced controls. For example, if a risk or a control related directly to their business unit or their business function they could prepare input to the workshop in advance. Managers were encouraged to use the briefing material as a basis for discussions within their units, and some even took the opportunity to conduct their own workshops, to gather ideas for the main corporate workshop.

As well as providing information for the workshop, these preliminary activities were useful in conveying, throughout the organisation, the importance that the CEO and senior managers placed in ERM. Information from the workshop was circulated afterwards to reinforce this message. The CEO’s active support for and participation in the workshop was well known, so a significant example and precedent was set for future behaviour.

Australian-based international agribusiness
Food and beverages
Agriculture, biosecurity and the environment
Services included:
Risk treatment
Risk assessment and risk treatment