Strategizing In Crisis – Crafting The Strategic Risk Mitigation Plan

Crafting The Strategic Risk Mitigation Plan

Whoever we are and whatever our businesses, we are forced to pause and consider for a moment, the new force that disrupt us. And before we even begin to make sense of the magnitude of the pax intermittitur known as Covid-19 to everyone these days, a barrage of unsolicited information and grim stories from countries near and far hit us full force in the face.

As the situation shifted from the probability to the reality of movement control order (MCO) and lockdown in harder hit places, we scrambled to postpone scheduled engagements, installed all sorts of online apps to pick up where we left, and suddenly the already precariously imbalanced work life are beginning to tip over. Work from home (WFH) seems to be the best alternative, and then becoming the only alternative in matter of days.

Soon, we begin to read messages from friends lamenting the distractions from children as childcare centres are closed, some work longer hours than usual and a hosts of other conundrums, while at the same time keeping up with streams of statements and directives from selfappointed pundits, organisations, authorities and government.

Are we ready for crisis and the risks that come with it? For instance the UK initial mitigation strategy involving herd immunity raised eyebrows as it was deemed at odd with others, which was changed drastically after the Imperial College Covid-19 Response Team presented the non-pharmaceutical interventions (NPIs) mitigation strategy scenarios. The US President had to bark order to force companies like GM and Ford to produce more ventilators, and the image of a tearful Italian President addressing the press as Italy led the world in the highest
Covid-19 death toll.

As Covid-19 grounds countries to a halt, so too are the organizations. So how should organizations respond to strategic risk of this unprecedented magnitude? This set of looming threats called the strategic risks send many managers Zoom-ed, Webexed, Skype-d and Google Hang-ed Out to the virtual meeting rooms. Some probably found themselves in a situation not quite unlike the Titanic’s lookouts in the crow’s nest watching the ship sailed towards the looming iceberg on the fateful night of April 14, 1912.

Strategic risk

Adrian Slywotzky and John Drzik write about Countering the Biggest Risk of All in the Harvard Business Review to help us understand that the key to surviving strategic risks is knowing how to assess and respond to them. “A strategic risk is an array of external events and trends that can devastate a company’s growth trajectory and shareholders’ value”, Slywotzky and Drzik

They proposed a Manager’s Guide to Strategic Risk which include identifying and  assessing risks, mapping risks, quantifying risks, identifying the potential upside for each risk, developing risk mitigation action plans, and adjusting capital decisions accordingly. Executing the strategic risk mitigation plan (SRMP) when crisis is unfolding requires a highly strategy-supportive ecosystem with the top management at the frontline because it is easily the most demanding part of the strategic management process – that is, if there is an SRMP ready to be executed. The problem is, according to Slywotzky and Drzik, organizations tend to treat risk management as an extension of audit or regulatory compliance processes, managers would find themselves ill prepared and under-sieged in the face of unprecedented risk such as Covid-19 pandemic with mere rudimentary mitigation plan.

Unfortunately, managers often view strategic risk as ‘managing risk strategically’, says Craig Rowe, CEO of ClearRisk. Strategic risk is often overlooked in the enterprise risk management (ERM) because of ERM’s deep root in finance. James Lam, an industry expert who has studied ERM found that strategic risks cause 60% of market cap decline while other risks combined account for 40% (where financial risks account only for 10%), indicating that strategic risks are far more consequential yet neglected. The managers must understand the speed, breadth and depth of strategic risks in preparing SRMP.

Developing and Executing SRMP

When crafting SRMP, each manager has to think through the answer to: “What has to be done in my area to execute my piece of the strategic plan, and what actions should I take to get the process under way – even in the face of unprecedented challenges and risk?”

  1. Identify Risk
    Identify risk posed to the strategic objective or key performance indicator (KPI) and set target. If nothing is being done, the organization’s vision and mission could be compromised.
  2. Determine Strategic Risk Triggers
    Begin the “If” of “If … Then” Scenario Planning. Slywotzky and Drzik have outlined seven categories of strategic risk triggers, and they are industry, technology, brand, competitor, customer, project and stagnation. Amy Webb, on the other hand, writes about The 11 Sources of Disruption Every Company Must Monitor in the MIT SMR’s 2020 which is part of the Deloitte Spring 2020 Special Collection entitled Disruption 2020. She lists eleven sources of ‘macro change that are typically outside a leader’s control’ representing potential strategic risks such as wealth distribution, education, infrastructure, government, geopolitics, economy, public health, demographics, environment, media and telecommunications, technology.
  3. Describe the Strategic Risk
    Explain the challenges and threats posed by the strategic risk and the potential adverse results that will follow. Determine the key risk indicator (KRI) which is a measure used to identify potential losses.
  4. Develop Strategic Risk Mitigation Plan
    Continue the “Then” of “If … Then” Scenario Planning. Assign multifunctional team responsible for each strategic risk identified and identify as many alternative plans (Plan A,B,C and so on) to avoid or minimize the impact of Strategic Risk trigger.
  5. Discuss Strategic Concerns
    Identify the potential threats which may frustrate the proposed SRMPs.
  6. Risk Analysis Components
    The impact (the effect or influence of the strategic risk) and likelihood (the chance or probability of the strategic risk will occur) are analyzed to determine the risk score and risk matrix grade in order to assist decision making on the implementation of the SRMP, the responsible person and contingency budget.
Table 1: A strategic risk map

Strategic risk map such as depicted in Table 1 shall be of great help so that the SRMP can be seen at a glance. A comprehensive SRMP may allow managers to turn defensive move into an offensive opportunity. It is crucial for managers to always find ways to improve the odds
of success apart from mitigating risks.

As Slywotzky and Drzik put it, “The greatest opportunities are often concealed within the defensive countermeasures.”





Dr. Helen Tan @DrHT is a Senior Lecturer and Strategist,

teaches Strategic Management, Negotiation and Strategic Decision Making at

Universiti Teknologi Malaysia.

She is @DrHT00971192 on Twitter and can be reached via email,

26 thoughts on “Strategizing In Crisis – Crafting The Strategic Risk Mitigation Plan”

  1. Avatar

    Hi Dr, I wanna ask from the strategic management perspective. If the company’s vision and mission don’t relate to a health and care business, a car manufacturer for example, and suddenly during this pandemic, they want to take the opportunity to do products related to health and care. Is it a good thing? I know it is good to grab all opportunity in front of the eyes, but when we talking about strategic management which we have to look at our vision and mission all the time, is it good to run a business that contradicts to the vision and mission of our company.


    1. Avatar
      Dr. Helen Tan Sui Hong

      We call that unrelated diversification strategy – and yes why not if your firm has the capacity and capability to grow. There is nothing that should stop a company from diversifying – related or unrelated to current core business. In fact there are enterprises where “core” business bring in between 50-80% of total revenue and the rest from collection of other businesses.
      Do make sure you evaluate the industry attractiveness. Plus, a keen foresight to spot opportunities is a competitive advantage.

  2. Avatar

    Addition, I mean they do that to lower their risk because their actual product are not selling during this pandemic time.

    1. Avatar
      Dr. Helen Tan Sui Hong

      By all means but you gotta have risk mitigation plan too on that one – be careful of sunk cost & not spreading yourself thin. Good question.

      1. Avatar

        Thanks dr. But a question. In the V and M , we must say for example “to serve the lowest cost car ……. “ and then when we do the strategy of selling new product for example face mask, do we need to change our vission and mission?

  3. Avatar

    It’s valuable article especially during this covid-19 condition, how to identify and manage the strategic risk in the organization in order to reduce the risks and may create more competitive advantages.

  4. Avatar

    Managing risk can creates an early awareness whether a potential project presents obstacles and opportunities. In severe cases some risk may expose projects that are just unable to meet their goals, are not financially viable or could prove to be a potential threat. In circumstances like these businesses can make the decision not to bid or to abandon the project before they become heavily involved. – Yugadharsini

    1. Avatar
      Dr. Helen Tan Sui Hong

      Well said … a strategist mantra – one of it being ‘risk follows strategy’ .. thus it is perilous not strategizing for risk.

  5. Avatar

    Man-made systems are flawed be they economic systems, public health systems, educational systems, etc. Inherently and unfortunately we tend to be very short-sighted and falsely lulled to safety by the Status Quo. This creates gaping vulnerabilities and shortcomings as has become painfully obvious amid this harrowing pandemic when all of these systems are crashing.

    Now more than ever, it is clear that identifying Strategic Risks in a bid to preempt them is not only critical but downright life-saving. My question is how do leaders go about monitoring all the above-mentioned mentioned 11 sources of disruption? Moreover, when the risk is so large and far-reaching how do you even go about managing it?

    1. Avatar
      Dr. Helen Tan Sui Hong

      Hi there Malak. Wonderful!
      Lets see .. strategists would ask themselves this strategic questions: What are the external factors (or forces) affecting the firm’s strategic position?
      By this, it means you must be very clear with your “strategic position” (vision, mission, goal, objectives). Indeed one may not be able to manage all the 11 sources of disruption but one can sort of narrow the scope to a manageable list guided by the above question.

      Additionally, this is where big data analytics come in very handy to aid prioritisation of these disruptive sources and thus aid in decision-making. The problem is, in most cases, managers have data piled up – often presented in simple descriptive analysis – but too rudimentary to assist strategic decision making. They look beautiful on charts and powerpoints but not quite there yet in weaving a data-centric mindset into the organisation’s structure and culture.

      Strategic factor analysis and SWOT analysis also have been proven timeless classic in decision-making – but then again, many leaders or managers forget the word “analysis” next to SWOT, rendering their SWOT a mere laundry list instead of strategic factors for strategizing.

      I hope these help. Cheers drHT

  6. Avatar

    Hi Dr Helen, this is the best article I ever read about strategic risk management. Based on your writing, I am sure that strategic risk management is important especially now because our country had to face COVID-19. So our Prime Minister try to develop the best solution for our economy. In addition, all organizations have to plan new ways of dealing with the risk of losing their business profit. Good operations mean doing the right things, while good strategy means doing the right things. Correct me if I am wrong.

    1. Avatar

      *** Good operations mean doing the things right, while good strategy means doing the right things. Correct me if I am wrong.

      1. Avatar
        Dr. Helen Tan Sui Hong

        Hi Roslina .. you are spot on! Thank you very much indeed. Keep raising awareness that strategic risk is very important. An excellent SWOT analysis can be of great help in preparing a thorough SRMP.

  7. Avatar

    Hi Dr. Helen,

    It is indeed a very well written article. Describing on how the risk and mitigation plan has been carefully plan and formulate. As for me, a new learner to Strategic Mitigation planning, I think the Strategic risk map is really a good way to represent our risk environment and how severe an individual risk as compare to the others.

    I have one question in mind, that given in this period of time, where COVID-19 pandemic and world economy are collapsing, companies especially SME or new startups, faces big challenges to survive and they need to look outside of their traditional corporate structures in order to cope with the changes. Is there a way for us to measure or to know that how well are companies and it’s employee are responding to this new focus on the mitigation plans?


    1. Avatar

      Sat 4/4/2020 The Edge splashed “SMEs Up Against The Wall” on its front page. It is a very telling sign that the storm is brewing – echoing your concern! “Save us FIRST in order to save jobs”, it says. Refer:

      Strategic risk mitigation plan is not new – it seems ‘new’ because it has largely been overshadowed by other ‘risks’ – or it has been neglected altogether – as per discussed in the article.

      On how well companies respond to strategic risks (and mitigating them) – watch out for the sign – you would hear and see few things. Sometimes the big guys would refer to it as “luck”. But one thing is clear, you would see the agile companies get back on track real quick – speed, fast rebound with a little scratch or bruise – not bleeding bad. Would that be pure luck? I would say readiness or preparedness .. and alright, sprinkled with luck (note: there is quite a body of literature on “luck” in business)

      That said, SMEs indeed need support from the relevant agencies and business communities to weather this storm. One would expect them to be very cash strapped.

      1. Avatar

        Hi Dr. Helen,

        Well said. I couldn’t agree more that the preparation and readiness of one company towards the unforeseen storms or challenges are one very important action in determining the company survival.

        As you’ve mentioned, formulating the mitigation plan allows us to plan ahead to embrace the unknown circumstances which lies in-front of us. Of course, this would need great effort and cooperation from the internal (i.e: Management & Employees) as well as the external (i.e.: Government, Non-Profit organization, etc).

        Thank you for your kind sharing and the time to share these very useful resources!

        I’m looking forward for your next article.

  8. Avatar

    Hi Dr. Helen,

    This article is indeed very well written!

    This pandemic had made everyone realise that we are not ready for such disasters. Hence, people should now be aware of the importance of risk management and should practise them at every level. The confusion between strategic risk management and managing risk strategically is 2 very different philosophy and this confusion shall be clarified the sooner the better before the next disaster hit us. This MCO period is the best time for manager to reflect what should be done if anything like this happens again in the future and how should it be done. Therefore the development and execution of SRMP above should be introduced to everyone, especially the top management from any organisation to help them understand the importance of SRMP in situation like this. I would like to also add that risk management is a repetitive process where it should be implemented continuously because risk will occur without any signals.

    It is true that numbers are important for any organisations but for an organisation to be sustainable, a comprehensive strategy must be developed. And as above mentioned, risk occurs in every aspects, thus managers have to take into consideration other sources of risk instead of only focusing on financial risk.


    1. Avatar

      So very true – so long as there are strategies (or Strategic Plan, for the matter) – there will always be Strategic Risk.

      I would like to reiterate, there are three things executives must get it right, get it clear:
      1. Risk follow strategy (always hot on strategy’s heel)
      2. Finance follow strategy
      3. Structure follow strategy

      Cheers .. you raise valid points

  9. Avatar

    Very well written, Dr!

    In my opinion, need to strengthen this SRMP according to the current pandemic situation, and at the same time need to review and renew it for every consecutive years, for each important aspects related and not only focus on certain issues only. Lessons learned.

  10. Avatar

    Thank you Dr for the article. I feel like it’s not just private organization but it can also be applied to government as well. DSMY also states that previously the digitalization initiative for government is only about 30-40% if I’m not mistaken and now he wants to speed up that initiative. It is indeed action well taken.

    1. Avatar

      Good day Aliyah,
      Salam Ramadan Kareem
      Oh yes indeed .. it is all the more important – why:
      1) private organisations are primarily accountable to their shareholders i.e. a select of people who have vested interest (by owning shares) .. at least, that is the old capitalism model – which by the way, has been under fire recently (read shareholder capitalism versus stakeholder capitalism)
      2) govt, by this we mean public institutions/sectors/organisations – are accountable to the entire nation, period – the rich, the poor, the confident and the confused
      There is no other way about it.

      Thank you for the lovely discourse.
      Cheers – drHT

Leave a Comment

Your email address will not be published. Required fields are marked *