The way that balanced scorecards manage risks is completely misunderstood. It is nonsense to suggest that they do not mention, address or manage risks. Balanced scorecards do manage risk, when used as part of a strategic balanced scorecard approach.  Then, Strategic Balanced Scorecards manage a particular class of risk.  To suggest otherwise misunderstands what strategic balanced scorecards are trying to do.

Oh and let us get this in the open early:  Adding a risk perspective is not the solution.

To suggest that there is no explicit mention of risk within the balanced scorecard or even strategy maps, and therefore that they do not manage risk at all is a misconception.

This will be one of a series of posts about integrating risk management with strategic and operational balanced scorecards, based upon our experience of designing and implementing such approaches in such diverse organisations and environments from Oil & Gas, and Fire & Rescue Services, to Manufacturing and Financial Services.

A proper balanced scorecard manages risks: a certain class of risk

In this article I explain that a properly implemented balanced scorecard approach (as opposed to a simplistic set of measures on an operational scorecard) does explicitly manage a particular class of risk.  A class of risk that often gets ignored in this balanced scorecard and risk management discussion.

In later articles I’ll explain why adding a risk perspective is a rabbit hole that should not be used, and how simply adding key risk indicators is also inappropriate and insufficient for any sensible implementation.  I’ll explain how you should integrate risk management into the strategy & performance process. I’ll be using examples from real clients.

What risks does the strategic balanced scorecard approach explicitly manage?

Before we get into how the balanced scorecard should capture various classes of risk,  let us take some of the risks that a properly designed and implemented balanced scorecard system should explicitly address:

1. The risk of the drivers of strategy not being identified and given due attention,
2. The risk of failure of the strategy to be communicated and executed,  and
3. The risk of the performance management process failing.
4. The risk that the external world changes and that the assumptions in the strategy, and ultimately the strategy, are no longer appropriate.

You see one problem with the debate about balanced scorecards and risk is that the discussions do not separate out the classes or types of risk involved, nor do they look at the risk identification and management process: they just talk about risks in the abstract.  This understanding of classes of risk if fundamental to having a proper discussion.

For the moment let us look at the class of risk that every, well implemented, balanced scorecard approach should identify, mitigate and manage.  Note I said approach and not simply scorecard: we are talking about the systematic strategic management system that Norton & Kaplan describe, not simply operational scorecards that are collecting measures in perspectives.

Balanced scorecards do manage risk: The Risks of Strategy Implementation

The strategy map and balanced scorecard have actually captured a certain class of risk. The difficulty is that they have captured the risks implicitly during the process of interviews and strategy map/scorecard development.

They have already captured many of the management’s decisions about the mitigation of risks in the implementation of the strategy. This identification and mitigation is already included thanks to the questions that were asked during the design of the strategy map and balanced scorecard. This may come as a surprise, but think how the design came about.  During the discussion and design of the scorecard, the management team were describing what their strategy was; it is therefore a strategy they have already thought through.  This thinking will already have included their thoughts about how they wish to mitigate and manage the risks of the strategy not being implemented successfully.

They have been articulating a strategy that already has risks considered and mitigated in their intention to implement changes, and develop capabilities and their choices of objectives, measures, targets, actions and initiatives. For instance, the risk of a process not delivering to the standard expected might be mitigated by a project and changes to the underlying skills in the departments involved. The risks to the implementation of the strategy are already embedded and expressed in the strategy map and balanced scorecard. The problem is that these thoughts and risks are implicit in the strategy map and balanced scorecard, and the mechanisms of change that they provide.

Ensuring Strategy Implementation Risks are Explicit and Managed

Leaving these strategy implementation risks implicit does create a problem. Should they start to manifest themselves they might get missed, not be addressed or not be mitigated. We need to make these risks, and the actions to mitigate these risks, explicit. To make the risks explicit during the articulation and design stages you can ask, for each objective
[1] ‘what risks are in here and how have you mitigated them?’ Noting the risks associated with each objective allows you to create a risk register alongside the strategy’s implementation plan. You can extend this to the projects in the same way if that level of detail is required.

The management of the risks associated with the implementation of the strategy is now concerned with what gets monitored, discussed and addressed during implementation. The ongoing and emerging risks have been identified, monitored and are being mitigated as the strategy is being implemented. This places the following question firmly on the agenda of the strategic review meetings: ‘are we considering the risks and are we managing them appropriately?’ Keeping risk on the agenda and continuously asking about new and known risks as the strategy is being implemented is the best way to ensure that strategy implementation risks are identified, mitigated and managed.

This is where the earlier approach of using KRIs made sense, but only at the objective level. It does not make sense at the perspective level that was being suggested. It does make sense to ask, for this objective, in this perspective, what risks do we need to monitor, mitigate and manage?

Balanced scorecards can manage the External Strategy Implementation Risks

The same approach can be used for the class of risks that are external, but yet might affect the strategy. You will have identified and documented these assumptions, uncertainties and risks during the development of the tangible future and the value chain. By now you will have incorporated them into your external perspective. [2]

It is a simple step to create a risk register alongside the external perspective to note where risks arise and how you are monitoring them. The process of monitoring the external environment and ensuring these aspects are reviewed monthly is a significant part of the external risk management process.  You can read more about the External Perspective and how it is used to monitor the  external environment, strategic assumptions and changes, and how risk is managed, in my book, “Strategy Mapping for Learning organizations”.