/* Code added to allow category posts to be displayed as masony format and get pagination correct. See https://www.elegantthemes.com/blog/divi-resources/how-to-give-your-divi-archive-pages-a-masonry-layout */
UK +44 1780 784887 info18@excitant.co.uk
Select Page

The way that balanced scorecards manage risks is completely misunderstood. It is nonsense to suggest that they do not mention, address or manage risks. Balanced scorecards do manage risk, when used as part of a strategic balanced scorecard approach.  Then, Strategic Balanced Scorecards manage a particular class of risk.  To suggest otherwise misunderstands what strategic balanced scorecards are trying to do.

Oh and let us get this in the open early:  Adding a risk perspective is not the solution.

To suggest that there is no explicit mention of risk within the balanced scorecard or even strategy maps, and therefore that they do not manage risk at all is a misconception.

This will be one of a series of posts about integrating risk management with strategic and operational balanced scorecards, based upon our experience of designing and implementing such approaches in such diverse organisations and environments from Oil & Gas, and Fire & Rescue Services, to Manufacturing and Financial Services.

A proper balanced scorecard manages risks: a certain class of risk

In this article I explain that a properly implemented balanced scorecard approach (as opposed to a simplistic set of measures on an operational scorecard) does explicitly manage a particular class of risk.  A class of risk that often gets ignored in this balanced scorecard and risk management discussion.

In later articles I’ll explain why adding a risk perspective is a rabbit hole that should not be used, and how simply adding key risk indicators is also inappropriate and insufficient for any sensible implementation.  I’ll explain how you should integrate risk management into the strategy & performance process. I’ll be using examples from real clients.

What risks does the strategic balanced scorecard approach explicitly manage?

Before we get into how the balanced scorecard should capture various classes of risk,  let us take some of the risks that a properly designed and implemented balanced scorecard system should explicitly address:

  1. The risk of the drivers of strategy not being identified and given due attention,
  2. The risk of failure of the strategy to be communicated and executed,  and
  3. The risk of the performance management process failing.
  4. The risk that the external world changes and that the assumptions in the strategy, and ultimately the strategy, are no longer appropriate.
The Institute of Risk Management (IRM) classify these risks as “Internally and Externally driven Strategic Risks”.  [see IRM, 2002, A risk Management Standard].  (Note I cite the 2002 paper, because their 2012 paper obscures this classification of risk amongst other classifications).
Now as the Institute of Risk Management’s classification shows, these are not all classes of risk, but they demonstrate the importance of considering different classes of risk and also the overall risk identification and mitigation process.   In other posts I will elaborate on how these other classes of risk can be captured and managed.   When you are creating a strategy map for the implementation of a strategy, it is appropriate to consider those risks, internal and external, that might derail the implementation of that strategy. You still use existing and complementary business controls and risk analysis on the non-strategic pieces that managers need to manage.   Managing the risks to the strategy (its design and implementation) is an important class of risk to explicitly identify, address and manage.

You see one problem with the debate about balanced scorecards and risk is that the discussions do not separate out the classes or types of risk involved, nor do they look at the risk identification and management process: they just talk about risks in the abstract.  This understanding of classes of risk if fundamental to having a proper discussion.

For the moment let us look at the class of risk that every, well implemented, balanced scorecard approach should identify, mitigate and manage.  Note I said approach and not simply scorecard: we are talking about the systematic strategic management system that Norton & Kaplan describe, not simply operational scorecards that are collecting measures in perspectives.

Balanced scorecards do manage risk: The Risks of Strategy Implementation

The strategy map and balanced scorecard have actually captured a certain class of risk. The difficulty is that they have captured the risks implicitly during the process of interviews and strategy map/scorecard development.

They have already captured many of the management’s decisions about the mitigation of risks in the implementation of the strategy. This identification and mitigation is already included thanks to the questions that were asked during the design of the strategy map and balanced scorecard. This may come as a surprise, but think how the design came about.  During the discussion and design of the scorecard, the management team were describing what their strategy was; it is therefore a strategy they have already thought through.  This thinking will already have included their thoughts about how they wish to mitigate and manage the risks of the strategy not being implemented successfully.

They have been articulating a strategy that already has risks considered and mitigated in their intention to implement changes, and develop capabilities and their choices of objectives, measures, targets, actions and initiatives. For instance, the risk of a process not delivering to the standard expected might be mitigated by a project and changes to the underlying skills in the departments involved. The risks to the implementation of the strategy are already embedded and expressed in the strategy map and balanced scorecard. The problem is that these thoughts and risks are implicit in the strategy map and balanced scorecard, and the mechanisms of change that they provide.

Ensuring Strategy Implementation Risks are Explicit and Managed

Leaving these strategy implementation risks implicit does create a problem. Should they start to manifest themselves they might get missed, not be addressed or not be mitigated. We need to make these risks, and the actions to mitigate these risks, explicit. To make the risks explicit during the articulation and design stages you can ask, for each objective
[1] ‘what risks are in here and how have you mitigated them?’ Noting the risks associated with each objective allows you to create a risk register alongside the strategy’s implementation plan. You can extend this to the projects in the same way if that level of detail is required.

The management of the risks associated with the implementation of the strategy is now concerned with what gets monitored, discussed and addressed during implementation. The ongoing and emerging risks have been identified, monitored and are being mitigated as the strategy is being implemented. This places the following question firmly on the agenda of the strategic review meetings: ‘are we considering the risks and are we managing them appropriately?’ Keeping risk on the agenda and continuously asking about new and known risks as the strategy is being implemented is the best way to ensure that strategy implementation risks are identified, mitigated and managed.

This is where the earlier approach of using KRIs made sense, but only at the objective level. It does not make sense at the perspective level that was being suggested. It does make sense to ask, for this objective, in this perspective, what risks do we need to monitor, mitigate and manage?

Balanced scorecards can manage the External Strategy Implementation Risks

The same approach can be used for the class of risks that are external, but yet might affect the strategy. You will have identified and documented these assumptions, uncertainties and risks during the development of the tangible future and the value chain. By now you will have incorporated them into your external perspective. [2]

It is a simple step to create a risk register alongside the external perspective to note where risks arise and how you are monitoring them. The process of monitoring the external environment and ensuring these aspects are reviewed monthly is a significant part of the external risk management process.  You can read more about the External Perspective and how it is used to monitor the  external environment, strategic assumptions and changes, and how risk is managed, in my book, “Strategy Mapping for Learning organizations”.

Render unto Caesar, that which is Caesar’s

We will be working towards an approach that identifies different classes of risk and manages them appropriately. What we have an approach that can helpfully be called a “Render unto Caesar that which is Caesar’s” .   One that puts parts of the risk management approach and some classes of risk within the balanced scorecard approaches’ remit, leaving other parts and classes to a more appropriate risk management approaches.

So, balanced scorecards do manage risk.  When they are properly designed to address the strategy they are a part of teh overall approach to mitigating and managing the risks of the strategy.They manage a particular class of risk.  They do not attempt to manage classes of risk that they are not designed to address.  Why would they?There are perfectly good mechanisms for these other risks.

More soon

In the next couple of articles I will explain why adding key risk indicators in to perspectives or adding a risk perspective also fail.


[1] Notice there are some important assumptions here about proper strategic balanced scorecard design.  First, that you develop an objective BEFORE you start developing measures of that objective.  Second, that you define the characteristics of that objective well enough to ALSO identify any risks associated with the objective. If is at this stage that you identify the risks, risk mitigation actions and how to measure those risks.  Without these important steps it is impossible to sensibly define the classes or risk and the specific risks and consequences.  For more details how to define objectives before measures see “Strategy Mapping for Learning Organizations” Jones, 2011, chapters 9 and 19. 

[2] This assumes that you are using Excitant’s fourth generation balanced scorecard approach in which the risks and assumptions to the strategy are identified and then monitored in the (additional) external perspective.  This ensures that, should the assumptions change, or the risks manifest themselves, that the management team will realise this and can act to change or refine the strategy appropriately. This approach is documented in my book “Strategy Mapping for Learning organisations”.