• The Strategy Network is an open network for professionals with interest and
knowledge in strategy
• We meet around three times a year in order to share best practice and exchange
knowledge around strategy
• More than 40 top companies in South Africa have joined
• No commitment, no fees. Confirmation of attendance is sufficient (Subject to
availability)
Both free and priceless at the same time
Strategic Risk:Strategic Risk:
Linking Risk Management &Linking Risk Management &
Strategy Management processesStrategy Management processes
Strat.exe has the pleasure to invite you to an executive breakfast with
Wasfie Ismail, Group Manager - Strategic Planning at ACSA
Sections
1 Introduction
2 Challenge: Linking Strategy & Risk Processes
3 Global risk approach
4 Strategic risk management
5 Linking strategy to risk example
6 Q & A
Primary activities and Revenue streamsPrimary activities and Revenue streams
Aeronautical Non-Aeronautical Concession agreements
 Retail
 Car rental
 Advertising
 Car parking
 Property
 International
 Equity
 Management
contracts
 Technical
consultancy
 Passenger service
charges
 Aircraft landing
fees
 Aircraft parking
fees.
Geographic presenceGeographic presence
Key Indicators (12/13 Financial Year)Key Indicators (12/13 Financial Year)
Sections
1 Introduction
2 Challenge: Linking Strategy & Risk Processes
3 Global risk approach
4 Strategic risk management
5 Linking strategy to risk example
6 Q & A
CE v5.5
Strategic Planning – ProcessStrategic Planning – Process
Balanced ScorecardBalanced Scorecard
Step 1
Executive Committee Strategy
& Board Strategy scheduled
by Company Secretariat
during period of August –
October
Step 2
The Managing Director,
engages the Chair of the
Board on salient strategic
issues
(July – August)
Step 3
The Managing Director, in
conjunction with, Financial
Director finalises the EXCO
Strategy agenda
(July – August)
Step 4
The EXCO Strategy Session
invite extended to members of
the EXCO, and at times,
additional senior management
(July – August)
Step 5
The Strategy Session,
invariably but not limited to,
covers strategic related
matters. The discussions,
outcomes and principles are
established and consolidated
for the Strategic / Business /
Corporate Plan
(August - September)
Step 8
Business and Support Units
prepare and submit strategic
summaries for their respective
units to the Strategic Planning
Dept
(September – October)
Step 7
The Board Strategy Session
invite and agenda extended to
Board, EXCO, and on
request, additional senior
management & other guests
(September - October)
Step 9
At the Board Strategy, the MD
will present the summary
strategic outlook. In turn, the
Board will engage the MD, FD
and Exco on inputs to the
Plan
(September - October)
Step 10
Draft Plan submitted to Exco in
October, afterwards to Treasury & Econ
Reg Board and to Main Board in
November for review. The final plan to
be approved January – February. By
end of February (PFMA) the plan is
submitted to Dept. of Transport and
Treasury
Integrated Strategic Risk
Management
Integrated Risk Management ProcessIntegrated Risk Management Process
ISO 13000ISO 13000
Sections
1 Introduction
2 Challenge: Linking Strategy & Risk Processes
3 Global risk approach
4 Strategic risk management
5 Linking strategy to risk example
6 Q & A
CE v5.5
Source: James Creelman
Risks – the obvious & the hiddenRisks – the obvious & the hidden
Known UnknownsKnown Unknowns
Operational
Eg Fraud & Theft
Known UnknownsKnown Unknowns
Operational
Eg Fraud & Theft
Unknowns UnknownsUnknowns Unknowns
Externally Generated
Eg 9/11, financial
meltdown
Unknowns UnknownsUnknowns Unknowns
Externally Generated
Eg 9/11, financial
meltdown
Known KnownsKnown Knowns
Governance and
Compliance Eg Controls
Known KnownsKnown Knowns
Governance and
Compliance Eg Controls
WHYWHY
WHATWHAT
HOWHOW
StrategyStrategy
MapMap
OperationalOperational
PlanPlan
Risk universeRisk universe
Risk universeRisk universe
Input
Strategic
Objective
WHY
WHAT HOWInitiative/action
If we do not achieve this
objective => what could
happen?
What can go wrong in this
Initiative/action? What can
be the consequence?
A
B
Output
Strategic Objectives
Sections
1 Introduction
2 Challenge: Linking Strategy & Risk Processes
3 Global risk approach
4 Strategic risk management
5 Linking strategy to risk example
6 Q & A
CE v5.5
Strategic risk management processStrategic risk management process
Risk Identification “A – What ” Risks or “B – How” Risks
Risk Description
Existing Controls
Current Risk Rating
Rating
Risk Treatment
Target Date
Risk Treatment Owner
Something occurs…, leading to ….
Mitigating factors and action plans
Assess Consequence & Likelihood
Risk Rating Computed
Identify additional actions
Sell by date, Exco & Board
Accountability Assigned
CE v5.5
Strategic risk management processStrategic risk management process
Risk Identification “A – What ” Risks or “B – How” Risks
CE v5.5
Financial
A1 Deliver Long Term Profitability A2 Control funding & cost of borrowing
Stakeholders
Internal
Processes
E1 Ensure succession planning
Shareholders
S1 – Entrench and deepen stakeholder relationships
P8 – Continually re-
engineer and align
business operations
processes
(Core & Support
BU’s)
P10 – Leverage IT for competitive advantage
P9 – Inclusive
infrastructure capacity
management planning
and phased
development
Identifying and securing new business Strengthen business excellence
Learning&
Growth
Build win-win partnerships with all stakeholders
Managing and developing a high performing & engaging team
E2 Manage talent E3 Strengthen culture
Deliver shareholder value
Acceleration of sustainability and transformation programs
P1 Finalise economic regulation legislation
Finalisation of economic regulatory legislation & funding framework
P2 Agree on funding framework
Management
P3 Good
governance
Enterprise Development
P4 Social responsibility P5 Environmental accountability P6 Economic efficiency
Skills Development
Employment Equity
Preferential Procurement
P7 – Enhance return
(Identify, evaluate and
secure new business)
Employees
Investors / LendersDpt of Transport (Policy)
SA Gvt Economic Regulator Airlines
Passenger
Communities Regulatory & Licensing bodies
Tenants & Concessionaires
Consumers
S2 – Deliver airport service quality for the passengers
Socio Economic development
CE v5.5
Strategic risk management processStrategic risk management process
Risk Identification “A – What ” Risks or “B – How” Risks
Risk Description Something occurs…, leading to ….
CE v5.5
Strategic risk management processStrategic risk management process
- Risk description- Risk description
Strategic
Objectives
Generally when we
will describe a risk
we will say:
“SOMETHING
MIGHT HAPPEN…
LEADING TO…
CAUSED BY….”
CE v5.5
Strategic risk management processStrategic risk management process
Risk Identification “A – What ” Risks or “B – How” Risks
Risk Description
Existing Controls
Something occurs…, leading to ….
Mitigating factors and action plans
Strategic risk management processStrategic risk management process
–– control effectivenesscontrol effectiveness
Score Rating Description
1
Critical
improvement
opportunity
Controls and/or management activities are
non-existent or have major deficiencies and
don’t operate as intended
2
Significant
improvement
opportunity
Limited controls and/or management activities
in place, high level of risk remains
3
Moderate
improvement
opportunity
Key controls and/or management activities in
place, with moderate opportunities for
improvement identified
4
Limited
improvement
opportunity
Controls and/or management activities
properly designed and operating, with
opportunities for improvement identified
5 Effective
Controls and/or management activities
properly designed and operating as intended
CE v5.5
Strategic risk management processStrategic risk management process
Risk Identification “A – What ” Risks or “B – How” Risks
Risk Description
Existing Controls
Current Risk Rating
Something occurs…, leading to ….
Mitigating factors and action plans
Assess Consequence & Likelihood
Risk management processRisk management process
–– Likelihood criteriaLikelihood criteria
Score Rating Percentage
5 Expected > 85%
4 Highly likely 55 - 85%
3 Likely 25 - 54%
2 Slight 5 - 24%
1 Not likely <5%
Strategic risk management processStrategic risk management process
–– consequenceconsequence
Level Relative Impact
1 Insignificant
2 Minor
3 Moderate
4 Major
5 Catastrophic
CE v5.5
Strategic risk management processStrategic risk management process
Risk Identification “A – What ” Risks or “B – How” Risks
Risk Description
Existing Controls
Current Risk Rating
Rating
Something occurs…, leading to ….
Mitigating factors and action plans
Assess Consequence & Likelihood
Risk Rating Computed
Strategic risk management processStrategic risk management process
–– ratingrating
Catastrophic
5 II I I I I
Critical
4 II II I I I
Significant
3 III II II I I
Moderate
2 III III II II I
Minor
1 III III III II II
1 2 3 4 5
Slight Not Likely Likely Highly Likely Expected
Consequences
Likelihood
CE v5.5
Strategic risk management processStrategic risk management process
Risk Identification “A – What ” Risks or “B – How” Risks
Risk Description
Existing Controls
Current Risk Rating
Rating
Risk Treatment
Target Date
Risk Treatment Owner
Something occurs…, leading to ….
Mitigating factors and action plans
Assess Consequence & Likelihood
Risk Rating Computed
Identify additional actions
Sell by date, Exco & Board
Accountability Assigned
CE v5.5
Sections
1 Introduction
2 Challenge: Linking Strategy & Risk Processes
3 Global risk approach
4 Strategic risk management
5 Linking strategy to risk example
6 Q & A
CE v5.5
FinancialStakeholders
Internal
Processes
Identifying and securing new business Strengthen business excellence
Learning&
Growth
Build win-win partnerships with all stakeholders
Managing and developing a high performing & engaging team
Deliver shareholder value
Acceleration of sustainability and transformation programs
Finalisation of economic regulatory legislation & funding framework
P7 – Enhance return
(Identify, evaluate and
secure new business)
A1 Deliver Long Term Profitability
CE v5.5
ExampleExample
CURRENT STATE FUTURE STATE
A1 Deliver Long Term Profitability
DO NOTHINGDO NOTHING
WHWH
YY
P7 – Enhance return
(Identify, evaluate and
secure new business)
P7 – Enhance return
(Identify, evaluate and
secure new business)
HOWHOW
Identify New
Opportunities
Too Many; Too Little;Too Many; Too Little;
Unknown ROIUnknown ROI
Desktop
Viability
Analysis
All things equal
will it deliver
WACC + 3%
Insufficient funding,Insufficient funding,
Inadequate resourcesInadequate resources
Due Diligence
• Approval
• Affordability
• ROI to ROCE
• Sovereign risks
• Cultural
• Resources
• Ability to deliver
IncompleteIncomplete
Business CaseBusiness Case
Secure new
business
• MOU
• Shareholding
• Management /
Operations
agreement
• Voting rights
• Schedule of
deliverables
Unclear/AmbiguousUnclear/Ambiguous
AgreementsAgreements
Board Approval &
Operationalisation
““A – WhatA – What”” RisksRisks
Fail to secure additional valueFail to secure additional value
Erode shareholder valueErode shareholder value
““B –B –
HowHow
““
RisksRisks
Sections
1 Introduction
2 Challenge: Linking Strategy & Risk Processes
3 Global risk approach
4 Strategic risk management
5 Linking strategy to risk example
6 Q & A
© copyright 2012
Training – Assessments – Projects
The specialist consulting firm for strategy execution in Southern Africa

Strategic Risk: Linking Risk Management & Strategy Management processes

  • 1.
    • The StrategyNetwork is an open network for professionals with interest and knowledge in strategy • We meet around three times a year in order to share best practice and exchange knowledge around strategy • More than 40 top companies in South Africa have joined • No commitment, no fees. Confirmation of attendance is sufficient (Subject to availability) Both free and priceless at the same time
  • 2.
    Strategic Risk:Strategic Risk: LinkingRisk Management &Linking Risk Management & Strategy Management processesStrategy Management processes Strat.exe has the pleasure to invite you to an executive breakfast with Wasfie Ismail, Group Manager - Strategic Planning at ACSA
  • 3.
    Sections 1 Introduction 2 Challenge:Linking Strategy & Risk Processes 3 Global risk approach 4 Strategic risk management 5 Linking strategy to risk example 6 Q & A
  • 4.
    Primary activities andRevenue streamsPrimary activities and Revenue streams Aeronautical Non-Aeronautical Concession agreements  Retail  Car rental  Advertising  Car parking  Property  International  Equity  Management contracts  Technical consultancy  Passenger service charges  Aircraft landing fees  Aircraft parking fees.
  • 5.
  • 6.
    Key Indicators (12/13Financial Year)Key Indicators (12/13 Financial Year)
  • 7.
    Sections 1 Introduction 2 Challenge:Linking Strategy & Risk Processes 3 Global risk approach 4 Strategic risk management 5 Linking strategy to risk example 6 Q & A
  • 8.
    CE v5.5 Strategic Planning– ProcessStrategic Planning – Process Balanced ScorecardBalanced Scorecard Step 1 Executive Committee Strategy & Board Strategy scheduled by Company Secretariat during period of August – October Step 2 The Managing Director, engages the Chair of the Board on salient strategic issues (July – August) Step 3 The Managing Director, in conjunction with, Financial Director finalises the EXCO Strategy agenda (July – August) Step 4 The EXCO Strategy Session invite extended to members of the EXCO, and at times, additional senior management (July – August) Step 5 The Strategy Session, invariably but not limited to, covers strategic related matters. The discussions, outcomes and principles are established and consolidated for the Strategic / Business / Corporate Plan (August - September) Step 8 Business and Support Units prepare and submit strategic summaries for their respective units to the Strategic Planning Dept (September – October) Step 7 The Board Strategy Session invite and agenda extended to Board, EXCO, and on request, additional senior management & other guests (September - October) Step 9 At the Board Strategy, the MD will present the summary strategic outlook. In turn, the Board will engage the MD, FD and Exco on inputs to the Plan (September - October) Step 10 Draft Plan submitted to Exco in October, afterwards to Treasury & Econ Reg Board and to Main Board in November for review. The final plan to be approved January – February. By end of February (PFMA) the plan is submitted to Dept. of Transport and Treasury Integrated Strategic Risk Management
  • 9.
    Integrated Risk ManagementProcessIntegrated Risk Management Process ISO 13000ISO 13000
  • 10.
    Sections 1 Introduction 2 Challenge:Linking Strategy & Risk Processes 3 Global risk approach 4 Strategic risk management 5 Linking strategy to risk example 6 Q & A
  • 11.
  • 12.
    Source: James Creelman Risks– the obvious & the hiddenRisks – the obvious & the hidden Known UnknownsKnown Unknowns Operational Eg Fraud & Theft Known UnknownsKnown Unknowns Operational Eg Fraud & Theft Unknowns UnknownsUnknowns Unknowns Externally Generated Eg 9/11, financial meltdown Unknowns UnknownsUnknowns Unknowns Externally Generated Eg 9/11, financial meltdown Known KnownsKnown Knowns Governance and Compliance Eg Controls Known KnownsKnown Knowns Governance and Compliance Eg Controls
  • 13.
  • 14.
    Risk universeRisk universe Input Strategic Objective WHY WHATHOWInitiative/action If we do not achieve this objective => what could happen? What can go wrong in this Initiative/action? What can be the consequence? A B Output Strategic Objectives
  • 15.
    Sections 1 Introduction 2 Challenge:Linking Strategy & Risk Processes 3 Global risk approach 4 Strategic risk management 5 Linking strategy to risk example 6 Q & A
  • 16.
    CE v5.5 Strategic riskmanagement processStrategic risk management process Risk Identification “A – What ” Risks or “B – How” Risks Risk Description Existing Controls Current Risk Rating Rating Risk Treatment Target Date Risk Treatment Owner Something occurs…, leading to …. Mitigating factors and action plans Assess Consequence & Likelihood Risk Rating Computed Identify additional actions Sell by date, Exco & Board Accountability Assigned
  • 17.
    CE v5.5 Strategic riskmanagement processStrategic risk management process Risk Identification “A – What ” Risks or “B – How” Risks
  • 18.
    CE v5.5 Financial A1 DeliverLong Term Profitability A2 Control funding & cost of borrowing Stakeholders Internal Processes E1 Ensure succession planning Shareholders S1 – Entrench and deepen stakeholder relationships P8 – Continually re- engineer and align business operations processes (Core & Support BU’s) P10 – Leverage IT for competitive advantage P9 – Inclusive infrastructure capacity management planning and phased development Identifying and securing new business Strengthen business excellence Learning& Growth Build win-win partnerships with all stakeholders Managing and developing a high performing & engaging team E2 Manage talent E3 Strengthen culture Deliver shareholder value Acceleration of sustainability and transformation programs P1 Finalise economic regulation legislation Finalisation of economic regulatory legislation & funding framework P2 Agree on funding framework Management P3 Good governance Enterprise Development P4 Social responsibility P5 Environmental accountability P6 Economic efficiency Skills Development Employment Equity Preferential Procurement P7 – Enhance return (Identify, evaluate and secure new business) Employees Investors / LendersDpt of Transport (Policy) SA Gvt Economic Regulator Airlines Passenger Communities Regulatory & Licensing bodies Tenants & Concessionaires Consumers S2 – Deliver airport service quality for the passengers Socio Economic development
  • 19.
    CE v5.5 Strategic riskmanagement processStrategic risk management process Risk Identification “A – What ” Risks or “B – How” Risks Risk Description Something occurs…, leading to ….
  • 20.
    CE v5.5 Strategic riskmanagement processStrategic risk management process - Risk description- Risk description Strategic Objectives Generally when we will describe a risk we will say: “SOMETHING MIGHT HAPPEN… LEADING TO… CAUSED BY….”
  • 21.
    CE v5.5 Strategic riskmanagement processStrategic risk management process Risk Identification “A – What ” Risks or “B – How” Risks Risk Description Existing Controls Something occurs…, leading to …. Mitigating factors and action plans
  • 22.
    Strategic risk managementprocessStrategic risk management process –– control effectivenesscontrol effectiveness Score Rating Description 1 Critical improvement opportunity Controls and/or management activities are non-existent or have major deficiencies and don’t operate as intended 2 Significant improvement opportunity Limited controls and/or management activities in place, high level of risk remains 3 Moderate improvement opportunity Key controls and/or management activities in place, with moderate opportunities for improvement identified 4 Limited improvement opportunity Controls and/or management activities properly designed and operating, with opportunities for improvement identified 5 Effective Controls and/or management activities properly designed and operating as intended
  • 23.
    CE v5.5 Strategic riskmanagement processStrategic risk management process Risk Identification “A – What ” Risks or “B – How” Risks Risk Description Existing Controls Current Risk Rating Something occurs…, leading to …. Mitigating factors and action plans Assess Consequence & Likelihood
  • 24.
    Risk management processRiskmanagement process –– Likelihood criteriaLikelihood criteria Score Rating Percentage 5 Expected > 85% 4 Highly likely 55 - 85% 3 Likely 25 - 54% 2 Slight 5 - 24% 1 Not likely <5%
  • 25.
    Strategic risk managementprocessStrategic risk management process –– consequenceconsequence Level Relative Impact 1 Insignificant 2 Minor 3 Moderate 4 Major 5 Catastrophic
  • 26.
    CE v5.5 Strategic riskmanagement processStrategic risk management process Risk Identification “A – What ” Risks or “B – How” Risks Risk Description Existing Controls Current Risk Rating Rating Something occurs…, leading to …. Mitigating factors and action plans Assess Consequence & Likelihood Risk Rating Computed
  • 27.
    Strategic risk managementprocessStrategic risk management process –– ratingrating Catastrophic 5 II I I I I Critical 4 II II I I I Significant 3 III II II I I Moderate 2 III III II II I Minor 1 III III III II II 1 2 3 4 5 Slight Not Likely Likely Highly Likely Expected Consequences Likelihood
  • 28.
    CE v5.5 Strategic riskmanagement processStrategic risk management process Risk Identification “A – What ” Risks or “B – How” Risks Risk Description Existing Controls Current Risk Rating Rating Risk Treatment Target Date Risk Treatment Owner Something occurs…, leading to …. Mitigating factors and action plans Assess Consequence & Likelihood Risk Rating Computed Identify additional actions Sell by date, Exco & Board Accountability Assigned
  • 29.
    CE v5.5 Sections 1 Introduction 2Challenge: Linking Strategy & Risk Processes 3 Global risk approach 4 Strategic risk management 5 Linking strategy to risk example 6 Q & A
  • 30.
    CE v5.5 FinancialStakeholders Internal Processes Identifying andsecuring new business Strengthen business excellence Learning& Growth Build win-win partnerships with all stakeholders Managing and developing a high performing & engaging team Deliver shareholder value Acceleration of sustainability and transformation programs Finalisation of economic regulatory legislation & funding framework P7 – Enhance return (Identify, evaluate and secure new business) A1 Deliver Long Term Profitability
  • 31.
    CE v5.5 ExampleExample CURRENT STATEFUTURE STATE A1 Deliver Long Term Profitability DO NOTHINGDO NOTHING WHWH YY P7 – Enhance return (Identify, evaluate and secure new business) P7 – Enhance return (Identify, evaluate and secure new business) HOWHOW Identify New Opportunities Too Many; Too Little;Too Many; Too Little; Unknown ROIUnknown ROI Desktop Viability Analysis All things equal will it deliver WACC + 3% Insufficient funding,Insufficient funding, Inadequate resourcesInadequate resources Due Diligence • Approval • Affordability • ROI to ROCE • Sovereign risks • Cultural • Resources • Ability to deliver IncompleteIncomplete Business CaseBusiness Case Secure new business • MOU • Shareholding • Management / Operations agreement • Voting rights • Schedule of deliverables Unclear/AmbiguousUnclear/Ambiguous AgreementsAgreements Board Approval & Operationalisation ““A – WhatA – What”” RisksRisks Fail to secure additional valueFail to secure additional value Erode shareholder valueErode shareholder value ““B –B – HowHow ““ RisksRisks
  • 32.
    Sections 1 Introduction 2 Challenge:Linking Strategy & Risk Processes 3 Global risk approach 4 Strategic risk management 5 Linking strategy to risk example 6 Q & A
  • 33.
    © copyright 2012 Training– Assessments – Projects The specialist consulting firm for strategy execution in Southern Africa