Managing multiple uncertainties: Building the capability to anticipate risks and prepare for them

It’s time for a new kind of risk management that adapts dynamically as the environment changes. Companies that invest in building up a holistic capability, including disciplined processes, sophisticated monitoring, expert talent, and cross-functional collaboration, will do more than reduce the dangers of major shocks. They can turn this capability into a competitive advantage over their peers.

Show transcript

Managing multiple uncertainties Building the capability to anticipate risks and prepare for them


Amsterdam Marco Kesteloo Partner +31-20-504-1942 marco.kesteloo Beirut Gabriel Chahine Partner +961-1-985-655 gabriel.chahine

Düsseldorf Peter Heckmann Partner +49-211-3890-122 peter.heckmann Detlef Schwarting Partner +49-211-3890-124 detlef.schwarting Robert Weissbarth Principal +49-211-3890-134 robert.weissbarth

London John Potter Partner +44-20-7393-3736 john.potter Dave Phillips Principal +44-20-7393-3715 dave.phillips Mexico City Carlos Navarro Partner +52-55-9178-4209 c.navarro New York Martha Turner Partner +1-212-551-6731 martha.turner

São Paulo Fernando Fernandes Partner +55-11-5501-6222 fernando.fernandes Shanghai Anna Mansson Principal +49-89-54525-579 anna.mansson Vienna Harald Dutzler Partner +43-1-518-22-904 harald.dutzler



About the authors

Detlef Schwarting is a partner with Strategy& based in Düsseldorf. He specializes in sourcing and strategic supply, with particular focus on risk management, procurement operating model, and capability building. His industry experience includes engineered products industries, healthcare, the energy and chemicals sector, and high technology. Harald Dutzler is a partner with Strategy& based in Vienna. He specializes in cost transformation and efficiency improvements, especially in sourcing and supply chain management. He has worked with numerous industries, most notably consumer goods and retail. Clemens Bauer was formerly a senior associate with Strategy&. Ramon Tenge is a senior associate with Strategy& based in Düsseldorf. He advises clients in consumer goods and retail industries, especially in sourcing and risk management as well as cost optimization.

This report was originally published by Booz & Company in 2012.

Also contributing to this report were Martin Kaltenbach, Anna Mansson, Michael Oldermann, and Dave Phillips.



Executive summary

Risk management has become more demanding in recent years. Companies depend increasingly on complex and fragile value chains around the world. Ad hoc and one-dimensional approaches to risk management are no longer adequate. It’s time for a new kind of risk management that adapts dynamically as the environment changes. Companies that invest in building up a holistic capability, including disciplined processes, sophisticated monitoring, expert talent, and cross-functional collaboration, will do more than reduce the dangers of major shocks. By embedding risk management in the organization while achieving sustainable results, companies can even use those capabilities to turn risks into a competitive advantage over their peers.



The new normal

By now, corporate leaders around the world clearly recognize the need to manage “black swans” — high-impact, hard-to-predict, and rare events that lead to unforeseen and uncontrollable damages. The earthquake that hit Fukushima, Japan, in March 2011 demonstrated how vulnerable a supply chain can be to natural disasters. Other such recent events include the political turmoil in Syria and some extreme weather patterns, including recent and ongoing droughts in the United States, which are raising the prices of many commodities such as corn and oranges. But most of the external risks that businesses face these days are not, strictly speaking, from black swans at all. They stem from relatively predictable or foreseeable events that are driven by large-scale trends. Nonetheless, they can also lead to volatile situations with highly disruptive impact. For example, hundreds of millions of people around the world are entering the global middle class, especially in countries like Brazil, China, India, Indonesia, and Mexico. They have discretionary spending power, and they are beginning to use it. As a result of this trend, exacerbated by the droughts linked to global warming, demand is abruptly outstripping supply in a variety of commodity markets from oil to oats, leading to greater price volatility. For some commodities like sugar and oils, the amount of variation in 2011 was as much as seven times as great as it was five years before (see Exhibit 1, next page). Another such trend is the expansion of global financial speculation, which has greatly increased the volatility of capital flows. Still another driver, with immense impact on businesses, is the growing interdependence and fragility of value chains. Global trade has become so efficient that companies can rely on thinner and more dispersed supply lines than they have in the past. With margins smaller at every stage, the potential damage from volatility has been magnified. In short, although it may seem that external shocks are becoming more frequent or severe, the worst damages stem not only from sudden shocks, but also from a variety of external changes. Companies therefore need a methodology for working out which risks pose the greatest threat, and for making sure they are in a position to react well
Strategy& 5

Exhibit 1 Increased market volatility in food commodities, 1990–2011
Standard deviation 70 60 50 40 30 20 10 0 1990 2011 Sugar price index Oils price index Dairy price index Cereals price index Meat price index Food price index

Source: U.N. Global Information and Early Warning System on food and agriculture; Strategy& analysis



when disaster strikes. A systematic and holistic approach to risk management can give business leaders much more confidence in risky situations — and even provide a competitive advantage. The key to this approach is twofold: First, you develop the managerial proficiency to identify and rank all significant risks, now and in the future. Second, you implement a sophisticated monitoring and adjustment program that allows you to take the necessary steps to minimize the impact of those risks. This two-phase approach — understanding the risk and developing the mitigation — can give your company a firm base for achieving the benefits of global integration while reducing the increased danger (see Exhibit 2, next page). Why is such a deliberate, thorough approach needed? Because the drastic changes in scale and damage from external shocks have made them too expensive to ignore. This is forcing many companies to reassess their current reactive tendency. It has also shown the weaknesses in many current approaches to uncertainty. For example, many companies, especially in extractive industries, have sought to improve their preparedness through sophisticated scenario-planning practices, in which they articulate several distinct stories of the future and build strategies that will be robust in all of them. Royal Dutch Shell pioneered this effort in the early 1970s, and ever since then, the company has handled volatility in worldwide oil markets better than its rivals. Nonetheless, scenario planning is rarely disciplined and broad enough to drive adequate risk mitigation. Even Shell has struggled with unexpected external shocks, including the emergence of environmental and social concerns around some of its own operations. The approach outlined in this report goes beyond simply articulating risks the way scenario planning does. It links an assessment of the impact and probability of those risks with the preparations needed to mitigate them in real time.



Exhibit 2 Comprehensive approach to risk identification and management

Phase two: Developing mitigation
– How is your risk position relative to competition? – How can you turn risks into competitive advantages? – How do you select matching mitigation strategies? – How do you execute the strategies?
Build functional processes

Execute strategies

Map marketcentric risks

Phase one: Understanding risk
– What are the sources of risk for your enterprise?


Tools Calculate risk impact

– Where in your product value chain does the risk occur? – How high is your risk exposure? (Quantified) – Which functions are exposed?


Develop mitigation strategies

Prioritize risk management agenda

Source: Strategy&



Identifying and assessing risk

In order to develop suitable risk management plans, business leaders need to understand the short- and long-term drivers of volatility. Some of these drivers stem from macroeconomic forces and thus affect all companies. But others have varying impact, depending on each company’s individual market positioning and the nature of its industry. For example, if you are a mid-tier seller in a typical consumer category such as food or apparel, you will tend to have smaller profit margins than a luxury or value provider. These margins will usually be too thin to cover large price fluctuations in the supply chain, even in the short run, so supply chain volatility will be a more significant driver for you than for some other companies. Effective risk management requires identifying and understanding which risks pose a significant threat. The external factors that business managers need to address may involve the political environment, the legal situation, environmental developments, and the activities of competitors. Executives can start to make sense of all this, for their teams and the rest of the organization, by grouping the risks they face into three categories: operational, financial, and strategic: • Operational risk: This risk includes the potential for damages from disruptions in production, logistics, and your supply chain. Factors such as natural disasters, labor availability, supplier problems, environmental damages, IT systems failures, intellectual property thefts, or mishaps in processes and procedures can affect your ability to produce. One company that has explicitly paid attention to operational risk is Siemens, whose diverse electronics products share many elements of their supply chains, including the rare earth minerals vital to digital technology. In 2011, Siemens’ production executives observed that worldwide demand was skyrocketing while all of the active mines were in a single country — China. Since it would take years to start a new mine, Siemens invested in a joint venture to develop a mine in Australia to reduce its vulnerability to this operational risk.

Business leaders need to understand the short- and longterm drivers of volatility.



• Financial risk: This category involves the vulnerability to external economic changes that may affect the price of conducting business or the cost of production. These factors can include interest rates, foreign exchange rates, credit risks, and commodity price volatility. Ford Motor Company demonstrated its skill at managing financial risk in 2006. Like other Detroit automakers, the company was low on cash and suffering from shrunken market share. Concerned about the company’s ability to access the credit markets as the expansionary economy started to slow down, Ford’s leaders secured an enormous US$23 billion line of credit in December — 12 months before the start of the recession. This move enabled it to avoid the bankruptcy and government rescue that its rivals required during the financial crisis. • Strategic risk: This risk includes threats to your company’s competitive positioning, often involving disruptive forces with the potential to transform your industry or at least meet your customers’ needs in new ways. These risks may include M&A transactions that alter the balance of power in your industry, game-changing technological developments, shifts in the regulatory framework (such as privatization or new constraints on business activity), or new tax structures. Cisco Systems, which was one of the first telephone networking companies to see voice over Internet protocol (VoIP) as a game changer for its market, has always been sensitive to strategic risk. It decided in 1998 to embrace the possibility of rapid technological change by acquiring Selsius Systems, an early provider of VoIP switches. Cisco then hastened the transformation with further investments in routing and switching technology, instead of relying on Selsius Systems’ innovations alone. Cisco has maintained its status as the market leader in telephone switches, with VoIP now encompassing 17 percent of total subscribers in 2011. Each industry faces different risks based on its vulnerabilities in each category. Companies need to select only the risks with likely significant impact and identify the plausibility, probability, and potential effect of each one. This begins with value chain mapping, combined with detailed scenario descriptions that chart how each threat could play out. The in-depth scenarios must be sophisticated enough to combine dynamically generated internal information (for example, about supply chain operations) with ongoing external information about macroeconomic developments and other factors. Exhibit 3, next page, shows the kind of customized algorithmic engine that can analyze the data in real time and translate it into quantifiable effects. This type of tool can generate ways for your company to mitigate its greatest risks. In this case, the tool analyzes the risk from currency fluctuations. The impact on earnings can be greater than the
10 Strategy&

Exhibit 3 Example of an algorithmic engine for analysis of risk

Tier three suppliers/raw Materials $/€ exchange rate: –5%

Tier two suppliers

Tier one suppliers


Distribution & retail


$/€ exchange rate: –5%

Cost in €: +5%

Cost in €: +5%

Production cost in €: +2%

Selling expense in €: +3%

Realized revenue in €: +3%

Likely to be temporally disconnected from revenue realization

EBIT: –8%

Example: Currency exchange rate volatility mapping across value chain Source: Strategy&; simplified example of a real company’s analysis

original change might suggest; for example, a 5 percent drop in the dollar-to-pound exchange rate would, according to this model, cause EBIT to go down 8 percent. This reflects, in part, not just the direct impact of currency exchange costs on the manufacturer, but also the impact on its suppliers’ costs, as well as the time lag between sourcing, producing, and selling. The goal in these analyses is to promote ongoing transparency around the most important risks and to identify their likely effect on revenues, costs, and overall financial strength. To make these risks comparable, it helps to translate them into financial metrics: for example, the range of potential reduction in earnings. For the more likely threats, companies can then implement metrics that provide constant monitoring. These metrics serve as a trigger for preventive measures as each event’s probability rises. For example, after the Japanese tsunami in 2011, BMW and other automotive manufacturers introduced an early warning system for monitoring operational risk. This system integrates all the major suppliers, including sub-suppliers and logistics partners, via electronic data



interchange. Another example is Walmart’s general global system for supply chain risk management. This links data from suppliers with information from an outside forecasting service to detect threats early and make adjustments. A major success factor for the acceptance of risk management practices and respective tools is simplicity. Only pragmatic tools have the power to bring risk management to the table of the day-to-day business. Exhibit 4 outlines a simple sales management analytics forecast tool, used in this case by a chemical producer, which transfers raw material cost into a product-specific EBIT margin forecast. The company uses this tool to manage the risk of raw material price volatility and its customer-specific pricing on a day-to-day business. With the knowledge of the types of risks and the estimates of the likelihood of the threat and its impact, companies can begin ranking the urgency of mitigation with a risk segmentation matrix. As seen in Exhibit 5, next page, this matrix approach divides all possible risks into four groups:

Exhibit 4 Chemical company’s forecast of material costs and EBIT margin
% of product cost 60 50 40 30 20 10 0 -10 -2% Q1 Q2 Year 1 Q3 Q4 Q1 -2% Q2 Year 2 Raw material cost EBIT margin -4% Q3 -4% Q4 10% 43% 43% 45% 48% 54% 54% 56% 56%




Product-specific EBIT margin cockpit

Source: Strategy&



Exhibit 5 High-level risk segmentation







Black swans



EBIT impact

Source: Strategy&

High-level risk segmentation

• Fog: These are easily controllable risks with low likelihood and relatively low financial impact. They require no immediate action, but need to be monitored from time to time — perhaps in an annual risk assessment cycle — in case any of them seem likely to become a bigger threat. A large baked goods company, for example, may become vulnerable to the price of oats. However, as oats are still a secondary part of most of the company’s products, the potential business impact is rather low. In addition, the chances of high volatility here seem low, suggesting no immediate action. • Rapids: These events occur often but with relatively low financial impact. If the global demand for oats suddenly surged, then the same baked goods company would see much more volatility in oat prices. Business managers would need to monitor this market continually to prepare for disruptions in prices. Instituting a standard procedure for major price changes — akin to the “eight disciplines” approach used by many companies for quality assurance — could be enough. Besides the commodity market, you would also want to watch consumer demand closely to detect changes that might justify greater reliance on the ingredient in the future. Although monitoring



of these rapids will help companies deal better with these events, the bigger goal is to watch for risks that shift into the “cliffs” category. • Cliffs: The most dangerous of all, these are risks with both a high likelihood and a high financial impact. You need a broad approach that combines careful monitoring with preparation for preemptive mitigation. Focus is essential here: As you invest in plans to protect yourself, you need to restrain yourself from seeking secondary opportunities. Jet fuel, for example, is a major part of airline costs, and its prices have been both rising and becoming more volatile in recent years. Lufthansa has been among the more aggressive airlines in hedging against these risks. Its hedges in the first three to nine months of 2011 allowed the company to avoid an additional cost of €616 million ($800 million) — a figure that would have exceeded the airline’s overall operating profit of €578. Some of its rivals used their hedging operations not just as insurance against price volatility but to make money. Delta Airlines lost $1.7 billion on ill-timed hedges in 2007–08, while JAL lost $441 in 2010. • Black swans: These low-probability, high-impact events are the most difficult to manage. Executives usually treat them as “force majeure” and work on damage control after the fact. But for many of these risks, you can develop contingency plans to keep the business operating as normally as possible — including a communications plan to minimize reputational damage. A strong balance sheet will also bolster a company. BP’s disastrous 2010 oil spill in the Gulf of Mexico shows the importance of a plan for managing multiple dimensions of a black swan event. The company was able to shed assets quickly and dip into its cash reserves, reassuring investors in the early weeks that the disaster would not drive the entire company into bankruptcy. Its decentralized operating structure also managed to keep its far-flung other businesses operating fairly normally. Yet BP proved to be inadequate in the public relations side of the disaster, and its reputation with regulators and consumers took a beating after some environmentalists claimed BP did not respond quickly enough. When a company seems unable to cope with a crisis, it can severely dent trust in an entire industry. The more diversified a company is, the better it is able to withstand regionally limited black swans generally. Volkswagen and other German automakers decided a decade ago to invest heavily in developing the Asian market, while rivals in other European countries were less ambitious. The German companies did so mainly for growth, not for risk management, yet the move has proved highly beneficial in cushioning them from the eurozone financial crisis.



Mitigating risk

Once you understand your vulnerabilities, you can then develop initiatives to reduce the impact of these shocks. If handled well, these initiatives could transform a risk into a competitive advantage. The list of potential initiatives is long, and will be familiar to any senior executive. It can cover every area of activity, from materials reduction and relying more on contractors, to forward buying and beefing up cash reserves. Success will come not from generating the list for any particular threat, but from a focused investment in a combination of initiatives customized for that risk. Selecting the relevant tools before they are needed can be an important catalyst in building up your risk awareness and mitigation capability (see Exhibit 6, next page). The mix will depend not just on the effectiveness of a particular initiative but also on its cost. Some otherwise reasonable remedies will not pass a cost-benefit analysis, at least initially. The preparation for others might be stepped up only as risk levels rise. A chocolatier, for example, might face heightened price volatility from its cocoa processors based in Ivory Coast. A variety of initiatives might help mitigate the risk, from developing suppliers elsewhere in the world, to helping farmers be more productive, or substituting other ingredients for some of the cocoa used. After making the business case for these and other efforts, the chocolatier might instead combine outright acquisition of a cocoa processor with sales and purchase synchronization, or simply reduce the proportion of chocolate in its candies. Beware of putting in place an initiative that adds risks by leading your company away from your existing skills and capabilities. The giant chocolate supplier Barry Callebaut decided to acquire branded chocolate maker Stollwerck in 2002. The goal was to mitigate risk through forward integration so that its confectionery customers would integrate backward and lower their sales. But Callebaut turned out to lack the



Exhibit 6 Risk mitigation toolbox for executives
– – – – – – Contracting Lean development Fair return pricing Vertical integration Geographic distribution Long-term vs. spotbuying optimization – Technology change – Portfolio optimization – Material reduction – Material substitution – Sales contract optimization – Geographical diversity – Sales and purchasing synchronization – Forward buying – Operational hedging and stock management



Vertical Sales & integration purchasing synchronization Material reduction Farmer development Globalization High


Cocoa price volatility 2011 Cocoa price volatility 2015




Low Material substitution Low


Customer/ consumer

Low EBIT impact


Financial markets

Cost and other impacts

Step 1: List your potential initiatives

Step 2: Model the business case

Step 3: Select the strategy

Source: Strategy&

skills necessary to manage a consumer brand; it had to sell off the operation a decade later. Different companies will respond to the same threat with dissimilar approaches depending on the size of the company, reputation at stake, and cost-effectiveness of the solution. In the current Greek economic crisis, one large global pharmaceutical company has gone to the trouble of making a daily “cash sweep” of all funds from its Greek subsidiary back to the corporate office. A midsized European pharma company without a global reputation to defend, by contrast, decided simply to withdraw from that entire market. Risk mitigation can be a defensive move, building up internal resilience to handle damage, or it can be a form of offense, intervening to guide the threat away from the company. Either approach can improve the company’s standing relative to its competitors, but offensive strategies have the greater potential to do so.

Risk mitigation can be a form of offense, intervening to guide the threat away from the company.



We have seen several prominent examples of companies gaining competitive advantage from managing risk aggressively. The furniture retailer Ikea was concerned about the volatility of cotton prices on the open market as well as the growing “green conscience” among consumers. By working with the World Wildlife Fund, it firmed up relationships with its farmers by helping them grow cotton in a more sustainable way. At the same time, the company worked to reduce its dependence on cotton as a whole. It developed an alternative fiber, Lyocell, a form of natural rayon. Ikea was also smart enough to limit its efforts to activities within its competence. The resulting flexibility in production means that Ikea can handle volatility in prices — while its competitors see their margins or sales suffer. With a two-base material approach and by partnering with the WWF, Ikea addressed financial as well as ecological concerns effectively. For Barilla, the key to mitigation was its business managers’ decision to invest in substantial resources in a central risk control department. The department was able to consolidate exposures at the group level, and it stood ready to provide financial support as needed. When fluctuations in wheat prices reached worrying levels, the department stepped up efforts to improve relations with selected contract farmers. Collaboration between purchasing and R&D led to new breeds of wheat that boosted yields as well as nutrition and taste. Supplier account teams got the seeds out to these farmers quickly — and the company benefited from the subsequent production boost ahead of its rivals. Barilla’s success demonstrates the importance of collaboration in addressing threats. Purchasing and R&D coordinated their efforts in order to guide the researchers on improvements that would benefit the main suppliers. When the lab came up with the better seed, the account teams had to be prepared to move quickly and possess the knowledge to persuade farmers to switch over. Investing in a strong company culture that minimizes silos and encourages collective effort may be the best risk management initiative of all.




The expansion and integration of business worldwide has been a boon for investors and consumers, as well as the companies themselves. Yet this integration has magnified the effects of external shocks on operations, finances, and strategies. Companies must thus step up their risk management by detecting, assessing, and prioritizing their significant risks and then reducing the ones with high likelihood and impact (see “Where Do You Stand?,” next page). A range of information systems and tools can help, but you must also commit to ongoing monitoring. Risk is dynamic, so the response to it must be equally agile. That agility can come only from developing capabilities that protect your company’s distinctive vulnerabilities. When executives view risk management as a cost center, they will tend to underinvest in it relative to the profit centers. Yet risk management can play a major role in driving profitability over time. Rather than place the work within overhead functions, it’s better to anchor it crossfunctionally within the profit centers. Not only will that ensure better funding, but risk management is more likely to emerge as a competitive advantage. As your organization builds up these capabilities, you will be able to do more than protect yourself against shocks. You will be ready to offensively turn threats into opportunities while shaping the future environment and gaining a competitive advantage.



Where do you stand?
To determine your company’s current capabilities in risk management, use this questionnaire. It was developed to help companies get started in building the necessary capabilities (see Exhibit A).

Exhibit A Assess the strength of your risk and volatility management
Part A
1. Risk and volatility management is part of your strategic agenda and is being constantly reviewed 2. You have dedicated risk and volatility management tools in place to quantify possible risk impacts 3. You have proven processes for risk management and monitor compliance 4. You constantly map risks along your direct value chain 5. You monitor compliance on the risk and volatility management agenda 6. You implement coherent initiatives for mitigating your exposure 7. You measure your suppliers’ risk and volatility management If <5 statements from part A have been answered with yes If >5 statements from part A have been answered with yes

Part B
1. You assess your complete value chain market back to raw materials, constantly adapting your map of focus risks 2. You continuously drive cross-functional initiatives to transform risk exposures in your industry into a competitive advantage 3. You engage and cooperate with your suppliers to manage their risks 4. You constantly engage and cooperate with your clients/distributors to actively manage strategic, operational, and financial risk (e.g., their profit translation risk, their distribution network strength, their brand positioning) 5. Risk and volatility management measures of your partners along the value chain are linked into your scenario analysis processes and tools 6. You have a full supply market database, including a scenario builder 7. You have a flexible supply chain setup, which can deal with multiple risks (upside and downside) to a high degree 8. You actively monitor risk and volatility measures of your competitors and constantly benchmark your own efforts If <5 statements from part B have been answered with yes If >5 statements from part B have been answered with yes



Best in class

Source: Strategy&



Strategy& is a global team of practical strategists committed to helping you seize essential advantage. We do that by working alongside you to solve your toughest problems and helping you capture your greatest opportunities.

These are complex and high-stakes undertakings — often game-changing transformations. We bring 100 years of strategy consulting experience and the unrivaled industry and functional capabilities of the PwC network to the task. Whether you’re

charting your corporate strategy, transforming a function or business unit, or building critical capabilities, we’ll help you create the value you’re looking for with speed, confidence, and impact.

We are a member of the PwC network of firms in 157 countries with more than 184,000 people committed to delivering quality in assurance, tax, and advisory services. Tell us what matters to you and find out more by visiting us at

This report was originally published by Booz & Company in 2012.
© 2012 PwC. All rights reserved. PwC refers to the PwC network and/or one or more of its member firms, each of which is a separate legal entity. Please see for further details. Disclaimer: This content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.