Skip to main content.

Strategic business risk management

A version of this article by Dr Stephen Grey, Associate Director, was published originally in The Mining Chronicle, Vol. 3, No. 2, March 1998.


Earlier articles on risk in mining businesses have drawn attention to an ever greater pressure on safety and financial performance, arising at the same time as the resources available for exploitation become more and more marginal. These trends are increasing the general level of business risk faced by the industry. While human safety and environmental risks are subject to tighter and tighter control every year, businesses face a rising tide of risk. They find their margins overlapping the uncertainty in their forecasts, raising the real prospect of major investments failing to yield promised returns.

Individual mining projects are often so large that they are treated as businesses in their own right. The objectives of a project are clear cut, generally concerned with cash flow, and it is usually obvious which parts of a business are involved with the work. To help owners understand the risks they face, major mining and mineral processing projects are being subjected to quantitative cash flow risk modelling, using the techniques outlined in an article about quantifying risk in businesses and projects, published here last year.

There is a growing awareness that exactly the same principles that are used to understand risk in projects can be applied to whole businesses. However, while the principles are the same, with the Australian Standard on Risk Management AS 4360 being applicable to both situations, business risk management presents some special challenges.

The first task in strategic business risk management, is to establish whether the business has a vision of the direction it wants to take, the strategy it proposes to adopt to achieve this and the organisation and structure it needs to support it. In the short term, it might be that the biggest risk to a business is the absence of this clarity of purpose.

Risk management techniques have a lot to offer businesses that have an established strategy, and they can also support those that are searching for one. The approach to be adopted differs from one to the other though.

Understanding the risk to an established strategy

A business that is clear what it aims to achieve and how it proposes to do it, might still face many risks, but they can generally be identified and understood without undue difficulty. It fits neatly into the structure of a risk assessment process that focuses on the objectives of an enterprise and what could jeopardise those objectives.

Just as cash flow is the focal point of project risk assessment, whether it is quantified or not, shareholder value is the focus of business risk assessment. A qualitative assessment exercise can help you identify the main sources of risk and place them in priority order. Quantitative modelling can provide a framework within which to clarify the nature and severity of the uncertainties affecting a business. This has a lot in common with project risk assessment.

The output from a business risk assessment of a particular strategy is valuable information in its own right. However, there are many side effects of going through the assessment process which can be of at least as much value.

The starting point for the assessment process is always to determine the objectives of the business plan, and how success will be measured. It is quite common to find that even a well integrated team of cooperative managers will each have slightly different views on these important issues. Management teams which have not been together long, or in which there are underlying tensions, are even more likely to incorporate divergent views.

The early stages of a risk assessment force a team to resolve differences of opinion about their objectives and how they will be measured. The process helps them to do this by providing a structure for the discussion and a reason for reaching a consensus, that is to move the risk assessment forward. During the identification of risks a team can develop their common understanding of the job they face even further. The increased understanding and agreement which results from such an exercise is often noted as a major beneficial effect of a risk assessment.

After risks have been identified and set in priority order, they are usually assigned to named individuals who are responsible for monitoring them and progressing plans for treating them. The sense of ownership which comes from publicly taking responsibility for risks, combined with an improved joint understanding of the task at hand, leaves a team better placed to manage the risks to their business.

Evaluating alternative strategies

At times of significant change in the business environment, many organisations are struggling to determine the best direction in which to develop. Conventional forecasting provides a view of the likely financial outcome of alternative strategies, but the return on a business has to be weighed against the risk it presents. The risk associated with alternative strategies is often assessed by no more than gut feel.

Experience and judgement are extremely valuable, but the difficulty of comparing the balance between risks and returns on several strategies is more than most people can manage unaided. Even if one individual can pull all the details together in their mind and reach their own conclusion, they are likely to have trouble communicating that to other people and getting a team to fall in behind the decision, unless they can set the assessment out in clear terms.

An assessment of the risks affecting alternative strategies, and the balance between risks and returns for each one, is a powerful tool for decision making and persuasion. It can be particularly valuable in joint ventures and teaming arrangements, where two or more management teams have to reach a consensus.

A qualitative description of the risks set out in priority order for each alternative strategy, fleshes out the conventional forecast of a business’s financial performance, to give a rounded view of its risks and returns. Where the stakes are high or the business performance is potentially marginal, it is worth considering a quantitative assessment of risk. This determines the uncertainty associated with each of the financial forecasts and indicates which issues are causing the bulk of that uncertainty. It yields essentially the same information, but makes it easier to understand the relative magnitude of individual risks and their aggregate effect.

Who is doing it?

The approaches described here are not theoretical exercises. Major mining and mineral processing projects in Western Australia have used them over the last twelve months to:

  • Select from a range of alternative technologies for replacing major capital equipment
  • Evaluate the feasibility of exploiting new resources
  • Establish realistic targets for the cost and completion date of major works which had run over budget and slipped significantly from the original targets.

Many smaller exercises have been undertaken as well, and some organisations have begun to integrate formal risk management processes with their core business processes. This trend shows all the signs of still gathering steam, and it can be expected to grow for some time yet. It is part of a similar trend in the wider economy, where all the pressures tending to raise the level of risk that mining businesses have to face are at work across the board. There are no easy options, where returns are sure to overwhelm the risks, and explicit attention to risk is the only way to judge the best way forward.