Posted on January 4, 2009 by

Why are Strategy Maps Important to your Operational Risk Project?

Why is the Strategy map such a key part of the Risk-based performance methodology? Why is the Strategy map so important for the success of operational risk projects? These are two questions that we are often asked and the answer to both questions is fundamentally the same.

The Strategy map is one of the most important tools developed by Kaplan and Norton as part of their Balanced Scorecard approach. It is designed to provide a relatively simple way of distilling strategy into a collection of objectives and showing the causal relationships between objectives.

The Strategy map provides a tool for explaining and demonstrating how intangible assets, such as people, information systems, culture, processes etc, create customer outcomes and ultimately deliver tangible financial benefits for shareholders. A well constructed Strategy map should be the summary of the organisation’s ‘strategic story’ – a narrative which clearly explains what the organisation is seeking to achieve and how they will go about achieving their strategy.

When using the Risk-based performance methodology and indeed in any operational risk management process, we encourage organisations to expand on this narrative and the ‘standard’ approach to strategy mapping to include the risk dimension. This leads to a deeper understanding of the strategy and significantly improves the quality of both objectives and risks. Additionally, developing a rich narrative which incorporates both the performance and risk dimensions leads to a richer strategy map – using Risk-based performance generates Strategy maps that are driven by KPI, KRI and KCI data – and actually reduces the amount of indicator data organisations need to capture. It is a paradox, but incorporating risk (and controls) into the strategy map, and therefore incorporating KPI, KRI and KCI data, leads to a significant rationalisation of existing indicators across the organisation. This is because in many organisations the process for defining objectives and risks is poor, leading to a set of poorly defined objectives and risks which inevitably leads to a poorly defined set of indicators.

Too often, organisations do not have clarity around their objectives and/or risks and consequently take a ‘measure everything’ or a ‘measure what we can’ approach. In a recent and not unusual example, an investment bank we worked with had developed  a set of performance indicators over a number of years. Each department had on average approximately 180 KPIs which was a mix of measures and indicators and had been developed using a combination of ‘measure everything’ or a ‘measure what we can’ approach. Added to this measurement burden, the investment bank launched a enterprise-wide risk programme and used brainstorming meetings to complete individual standard risk and control matrices by department which threatened to generate a large number of additional indicators and significantly add to the measurement burden.

Introducing the Risk-based performance methodology provided the framework to clarify their ‘strategic story’, to develop a narrative which explained what the organisation was seeking to achieve, the threats to these goals and how the organisation would go about achieving the goals and minimising the threats. The resulting rich ‘strategic story’ is well understood and clearly visualised via a Risk-based performance strategy map. This level of clarity then enabled the organisation to rationalise its indicators, of all types (KPIs, KRIs and KCIs). It also enabled indicators to be categorised as leading or lagging. As a result the number of indicators was reduced to approximately 60 in each department supporting a handful of performance objectives and key risks. This provided a concise set of management information which supported robust management discussions and challenge resulting in better decision making.

Without going through the process of developing a strategy map which incorporates both performance objectives and the key risks to achieving these objectives, organisations almost inevitably end up with poorly defined objectives and risks and too many indicators. This results in poor management information leading to decision making, missed opportunities and out of control risk related losses and incidents. All of these significantly hinder the execution of the organisational strategy.

It is this need to create a high level of clarity around objectives and key risks that leads us to emphasise the importance of the strategy map both within the Risk-based performance methodology and within any operational risk project.