Strategic Risk Management Reimagined: How To Improve Performance And Strategy Execution 4d6l17

Strategic Risk Management Reimagined

How to Improve Performance and Strategy Execution

Patrick Ow

Founder of PracticalRiskTraining.com

Copyright © 2021 by Patrick Ow

All rights reserved. This book or any portion thereof may not be reproduced or used in any manner whatsoever without the express written permission of the writer except for the use of brief quotations in a book review.

ISBN: 9781005408336

Practicalrisktraining.com

Dedication

For Mei, Olivia, Sarah, Nicole, Esther and Benjamin

Table of Contents

Why read this book?

Chapter 1 — Introduction

Chapter 2 — All in the strategy execution, risks, and controls

Chapter 3 — Agile mindset and iterations required in uncertainty

Chapter 4 — Foundations for strategy execution

Chapter 5 — Framework for strategy execution

Chapter 6 — An integrated management system for strategy execution

Chapter 7 — Process for strategy execution

Why read this book?

Strategies most often fail because they aren’t executed well. Things that are supposed to happen don’t happen. The media has been full of stories of organizations negatively affected by catastrophic failures — not because they took on too much risk, but because the risks simply weren’t put into perspective and properly managed.

CEOs want to be in control of their strategies but know that organizations are complex entities with lots of moving parts.

Strategic and business risks pose greater threats to shareholder value than operational, compliance, or financial risks. This is where strategic and business issues are the most common means by which value is destroyed.

People and organizations manage risk each day as part of how they make decisions. Risk management is already integrated naturally. Some are better at this than others, but all can improve the quality of risk management and decision-making, resulting in improvement in achieving objectives and improved performance and confidence.

As an example, a pilot knows the plane’s destination and planned flight path. When the plane is in flight, the pilot must constantly monitor the plane’s performance and adjust the heading (or the direction that the plane’s nose is pointing) to compensate for the wind (and other external factors) to follow the actual path over ground. If the wind is different from the planned flight path, the pilot must immediately adjust the plane’s heading accordingly to bring it safely to its planned destination.

Pilots are clear about their destination and key objective (e.g., to reach their destination safely). In sharp contrast, organizations have so many ‘goals’ that it is difficult to clearly articulate what the actual destination is, let alone how and when to get there.

This is one key strategic risk faced by many organizations – that is, there is not broad alignment between the organization’s targeted deliverables and its capacity to deliver.

Pilots also know that their plane will be off-course 95% of the time and are prepared to respond constantly by making the appropriate adjustments or agile course corrections to get their plane back on the actual path over ground. They fully understand that risk management is intrinsically intertwined and constantly takes place.

Pilots make just-in-time decisions at points in time during flight time by:

1. Systematically identifying hazards (e.g., changing winds or adverse weather) that may impact the achievement of their objective (e.g., to reach their destination safely).

2. Constantly assessing the degree and probability of known unknowns or risk (e.g., degrees off-course, air traffic conditions, weather conditions, etc.).

3. Appropriately determining and executing the best course of action in real-time

given the acceptable level of risk and best available information (e.g., repointing the plane, landing on a wet runway).

Pilots naturally integrate risk management into what they do. It is an integral part of their real-time decision-making process that will enable them to reach their intended destination safely.

CEOs and executives, on the other hand, get confused or hyped up by changes because plans, systems, and processes have been designed and implemented as if they are permanent and everything should go smoothly as planned or assumed. Rather than absorbing the situation calmly, responding to changes systematically, and making appropriate course corrections to the way things are done, organizational leaders over-react and introduce nervousness and controls that are counter-productive and over-engineered.

Plans, systems, and processes are a means to an end. Organizational agility requires plans, systems, and processes to be constantly adapted to changing circumstances and contexts for organizations to achieve their objectives.

We know that businesses must be efficient, flexible, and driven by customer and economic realities. There are three basic components of strategic agility: process efficiency within and across businesses, improved insight and decision-making for better collaboration, and flexibility to respond quickly to changing inputs and create new business processes that align with operations and strategy.

The easier part for organizations is to decide where they want to go during the strategy formulation or planning processes by documenting their corporate strategy. The harder part is to get the whole organization and everyone in the organization to be committed and implement the documented corporate strategy (i.e., strategy execution) where organizations continuously act on new priorities

quicker than their competitors without taking on too much risk.

Approved strategies are poorly communicated. This, in turn, makes the translation of strategy into specific actions and resource plans all but impossible. Lower levels don’t know what they need to do when they need to do it, or what resources will be required to deliver the performance senior management expects. The expected results never materialize. And because no one is held responsible for the shortfall, the cycle of underperformance gets repeated, often for many years.

Organizations are usually not successful in translating and implementing what looks good on paper (i.e., documented corporate strategy) into specific and measurable actions that yield positive outcomes and superior performance.

Strategic risk management is the process of identifying, quantifying, and mitigating any risk that affects or is inherent in an organization’s corporate strategy, strategic objectives, and strategy execution.

Strategic risk can disrupt a business’s ability to accomplish its goals and achieve value for itself and its stakeholders. Effective, efficient management puts the power in leaders’ hands to avoid potential obstacles to success and maximize their performance.

One of the first things you need to do, to better manage risks, is to identify them.

Winston Churchill (1874 to 1965) once declared, “However beautiful the strategy, you should occasionally look at the results.” The written corporate

strategy has the intrinsic value of the paper it was written on unless there is execution or implementation. This has resulted in a widening strategy execution gap between documented corporate strategy and its execution.

As with pilots, formalized risk management within the context of strategy execution is an important management practice and discipline that will enable organizations to perform regular agile course corrections by identifying potential barriers or uncertainties - internal and external - that could affect them and the achievement of their objectives. Agile course corrections should never be an area where organizations have the greatest difficulty.

Unfortunately, many organizations have considered risk management as something that slows them down rather than making them grow or move faster and adding value to their business. This should not be so if you take this example: A car can accelerate if it is safe to do so and slows down when there are potential dangers that may stop the car from arriving at its destination (e.g., being involved in an accident, skidding off the slippery road, etc.).

Ask the question: How fast are you willing to drive a car to your intended destination if you knew that the brakes in the car are not working? ‘Very slowly indeed’ would be the right answer.

The reason, of course, is that brakes slow down (or stop) a car when it is required so that the driver (and the engers) can arrive safely at their destination, within the planned time and duration, and without contravening any road rules and losing demerit points.

Like risk management, brakes are an integral and inseparable part of a car.

When organizations unite strategy execution and risk management as an integrated management discipline, there is creation (or preservation) of stakeholder value, execution of documented corporate strategy, and achievement of organizational objectives and growth.

This discipline can assist organizations in managing the following risks:

1. Poor understanding of strategic objectives (poor or non-existent objectives).

2. Adhering to the corporate strategy for the long-term without unnecessary changes mid-way (knowing-doing gap)

3. Poor strategy-to-execution (strategy execution gap)

4. Not achieving their strategic objectives, vision, and mission (poor performance).

The practical approach contained in this book is no panacea. If your industry is stable and relatively predictable, you may be better off sticking to the traditional sources of advantage and continue doing what you are currently doing.

However, if your competitive reality is uncertain and rapidly changing, as is true for an increasing number of industries and organizations, you need an agile,

dynamic, and sustainable integrated management discipline and approach to stay ahead and perform well.

Therefore, by reading this book, you will learn how to:

1. Translate and execute your corporate strategy effectively for improved organizational performance.

2. Develop and implement the right foundations for a sustainable strategy execution.

3. Develop and implement an integrated management system that s the achievement of your organization’s corporate strategy and strategic objectives.

About the author

Patrick Ow, CA Risk Specialist is a corporate and personal trainer and coach at Practicalrisktraining.com.

As a Chartered ant with over 25 years of international risk management experience, he helps individuals and organizations succeed by making betterinformed decisions under uncertainty and taking the right opportunities and risks.

Chapter 1 — Introduction

When organizations fail to deliver on their promises or profit forecast, the most frequent reaction is that the chosen corporate strategy was wrong. It is easier to blame the strategy than the execution of that chosen strategy.

Businesses face the never-ending, rapid-fire change, including constantly shifting priorities, sweeping advances in technology and communication, fluctuating markets, and heightened global competition. It’s tough to stick with anything in this kind of environment. Yet this is precisely the reason why adhering to your strategy is so vitally important to long-term success.

The strategy execution problem

Having a solid corporate strategy gets the organization into the game. Long-term adherence to the corporate strategy and the disciplined execution of the strategy is what propels the organization into the winner’s circle.

Unnecessary changing, chopping, or tweaking a corporate strategy mid-way without giving a chance for a proper execution can be disastrous. There is a common reaction for shifting strategic direction mid-way, regardless of whether the previous corporate strategy was working.

Executives can be too quick to assume that the strategy is faulty rather than the execution. Win the game, not by constantly creating new strategies, but by

having the discipline to adhere or remain with the current strategy and executing it ruthlessly and well.

There is a gap between the best-laid documented corporate strategy and their actual realization and implementation — call this the strategy execution gap. Organizations must effectively execute what looks good on paper.

The reality is that organizations that stick with or adhere to their corporate strategy in the long term and effectively execute this strategy have a sustainable competitive advantage that is difficult to imitate. This is important for today’s business environment. Solid and sound strategies fail due to poor execution.

Strategy execution is about getting the right things done through people or how well strategic choices made are prioritized and effectively carried out and implemented by employees within an organization.

Strategy execution represents a disciplined process or a logical set of interconnected activities that enable an organization to take a formulated corporate strategy, stick to it, and systematically create value for its stakeholders within a given or acceptable level of risk and risk appetite, which is performance. It is a systematic and disciplined process of rigorously discussing hows and whats, tenaciously following through, and ensuring ability.

Unfortunately, most management literature talks about the what and why (i.e., strategy formulation on paper) and not the how and when (i.e., strategy execution in context).

There are always risks inherent in strategy execution or any business. The organization must be willing to accept calculated risk in pursuit of value creation (or preservation) and performance, as well as the organization’s capacity to bear that risk given its risk appetite and acceptable level of risk.

A successful business model exploits a significant area in which the organization excels relative to its competitors, including understanding and actively managing risks inherent in executing the strategy and running the business.

Strategy and strategic risk management

Strategy is about deciding what to do. The strategic choices organizations make create risks that need to be identified and managed. Because there is almost always some uncertainty associated with decisions and decisionmaking, there is almost always a risk.

Those responsible for achieving objectives need to appreciate that risk is an unavoidable part of the organization’s activities that are typically created or altered when decisions are made. Risks associated with a decision should be understood at the time the decision is made, and risk-taking is therefore intentional.

Strategic risk management is the process of identifying, quantifying, and mitigating any risk that affects or is inherent in an organization’s strategy, strategic objectives, and strategy execution.

Strategic risk can disrupt a business’s ability to accomplish its goals and achieve value for itself and its stakeholders. Effective, efficient management puts the power in leaders’ hands to avoid potential obstacles to success and maximize their performance.

A fictitious case study of Budget Air (denoted by a plane icon) is used to illustrate some of the key approaches contained in this book.

Taking a different practical approach

Organizations today face a stark choice – change or fail.

Continuous transformation and transition have become the only constant in today’s business landscape. When executing their corporate strategy, those organizations that cannot adapt to their changing circumstances and competitive environment are doomed to fail.

Organizations must have the ability to:

1. Execute, course correct, and adapt in dynamic ways.

2. Accurately but constantly perceive or sense changes to their operating context and environment.

3. Test possible responses.

4. Implement changes and transformations in products, technology, operations, structures, systems, and capabilities as an integrated but whole system of routines.

The organization’s purpose or mission (i.e., outcomes other than profit or growth) and business model (i.e., how organizations make money) should be widely shared by all employees, where shared purpose and values drive positive behaviors that are performance-based and risk-based.

Organizational performance is dependent on the successful cascading of unambiguous strategy and to every individual in the organization where there is:

1. Strong employee involvement, buy-in, and commitment.

2. A disciplined focus on only a handful of executable strategic objectives.

3. Close alignment of employees’ economic interests with those of the organization.

Executives effectively delegate and empower sufficient authority and responsibility to employees so that the organization can execute strategies and respond to changes with success where there is no second-guessing from the corporate office; the only alignment is with basic, strategic intent or objectives.

There are regular strategy and operational review meetings with employees to discuss the impact of key risks and controls on strategy, performance, budgets, and forecasts.

The management of risk is an integral part of each cascaded and contextualized objective at all levels of the organization.

Risk management, being the foundation of the organization’s risk-based control and performance environment, develops cost-effective value-creating treatment plans that are at the same time key controls associated with the achievement of each objective. An effective system of risk management that is integrated with planning, budgeting, and reporting processes enables employees to make better business decisions. This is done by systematically identifying risks and existing controls and implementing risk treatments that should collectively enable the organization to achieve its objectives within an acceptable degree of residual risk and risk appetite.

Linking contextualized controls to the achievement of objectives ensures that organizational activities (including decision-making processes) are efficient and effective, where the best available information is reliable and timely, and the organization is compliant with applicable laws and regulations.

By actively involving employees in the activities that they are able for during the strategy formulation and cascading processes, the diversity of various organizational sub-cultures, performance management systems, and individual risk appetites can also be aligned and managed appropriately. This avoids or limits unnecessary risk-taking that has caused organizations to fall or fail (e.g., Barings, Enron).

Reporting against contextualized key performance measures and targets for each objective is also a report on the effectiveness of the corporate strategy, controls, and the risk management process for that objective. Integrated reporting should drive effective value creation (or preservation) for the organization.

Continuous learning, improvement, and employee coaching, teaching, and consultation are norms. Employees freely contribute and share their knowledge and skills with others. Best available information required for effective strategy execution, decision-making, and risk management flow vertically and horizontally across the organization.

An effective corporate governance foundation can be contextualized, designed, and implemented through the strategic utilization and combination of five lines of defense that are provided by:

1. Line management.

2. Independent functions (i.e., risk management, finance, people and culture, information technology).

3. Independent reviewers or assurance providers (i.e., external/internal auditors).

4. Executive management.

5. The board.

An enterprise-wide approach is required

An enterprise-wide approach is required for integrated strategy execution and risk management where the organization:

1. Responds dynamically and contextually to external and internal changes promptly by relying on the work of employees where they determine the how.

2. Operates effectively and efficiently within the approved level of risk and risk appetite.

3. Maintains a clear line of sight between individual performance and the achievement of corporate strategy and strategic objectives through contextualized management-by-objectives where the organization determines the what.

4. Prioritize and allocate limited resources to strategic areas and initiatives that matter most and adds tangible value for stakeholders

5. Identify and manage risks and controls at different levels of the organization and within the context they operate in, given the internal and external circumstances and available resources.

6. Measure, evaluate, and report on performance to key stakeholders.

7. Comply with applicable laws, regulations, and policies.

Implementing the integrated approach should involve the following activities:

1. Determine and contextualize the organization’s capacity, capability, and appetite for the required performance level and level of risk needed to deliver on the corporate strategy and strategic objectives.

2. Contextualize, understand, and cascade the corporate strategy and strategic objectives into operational and individual scorecards and objectives that are specific, measurable, achievable, reasonable, and time-bound (SMART).

3. Identify opportunities and threats (risks or known unknowns) that may threaten the achievement of organizational objectives and growth.

4. Identify and evaluate the design and effectiveness of key controls intended to manage these risks and create a risk-based control environment that drives the achievement of objectives.

5. Obtain appropriate independent assurances on the effectiveness of key controls across key areas of risk.

6. Prioritize and allocate appropriate and sufficient resources to activities and projects that add real value to the achievement of corporate strategy and strategic objectives.

7. Evaluate performance and report against the achievement of corporate strategy and objectives, budgets, risks, controls, and regulatory compliance.

8. Continuously improve, adapt, and change based on and lessons learned.

What about public sector organizations?

Public sector organizations may find it difficult to articulate their objectives clearly for various reasons. One of the reasons could be political.

Whilst the concept of an objective is commonly known in the private sector, public sector organizations can benefit enormously by having clear statements of “Why their organization exist?” and “What the organization is (actually) seeking to achieve?”.

Conceptually, objectives apply to all organizations. It is the level of specificity in articulating the objectives that will determine the level of analysis that can be performed on the organization and assess whether the organization has objectively achieved what it said or promised it would do.

Objectives are more relevant for public sector organizations as they seek to show higher ability and transparency for spending or utilizing public funds.

Arguably, publicly listed organizations fall into the same category as public sector organizations, where shareholders demand greater transparency and performance.

Chapter 2 — All in the strategy execution, risks, and controls

Many organizations are struggling to bridge the gap between strategy formulation and its day-to-day implementation. While many have aspired to achieve a level of sustained and profitable growth, few will achieve it. Excellence in execution and consistent execution of strategy by top management can be some of the key challenges of business executives.

Some strategy execution obstacles include:

1. Inability to manage change effectively or to overcome internal resistance to change.

2. Trying to execute a strategy that conflicts with the existing power structure.

3. Poor or inadequate information sharing between individuals or business units responsible for strategy execution.

4. Unclear communication of responsibility and ability for execution decisions or actions.

5. Poor or vague corporate strategy.

6. Lack of feelings of ownership and ability of a strategy or execution plans among key employees.

7. Not having guidelines or a model to guide strategy execution efforts.

8. Lack of understanding of the role of organizational structure and design in the execution process.

9. Inability to generate buy-in or agreement on critical execution steps or actions.

10. Lack of incentives or inappropriate incentives to execution objectives.

11. Insufficient financial resources to execute the strategy.

12. Lack of upper-management for strategy execution.

While executives recognize that risk management is an important ingredient in their organization’s overall business success, many organizations have formulated their strategies without full consideration of the amount of risk they are willing to take on when executing their corporate strategy.

The role of boards in managing strategic risks

Many organizations are undermining the role of their boards in strategy execution and risk management. While boards are taking more responsibility for strategy, risk management is still a weak spot. Many boards have limited or no understanding of the risks their organizations face. What’s more, boards only spend a small amount of their time on risk management.

This is where board must be fully engaged in understanding the link between risk management and strategy. They should expect regular risk updates from management and must be engaging in dialogues with the designated risk owners, not relying solely on discussions with the Chief Executive and Chief Financial Officers.

The board should not only evaluate risks to the organization now and next year, but also the risks and challenges that may emerge several years out. Having open communication between the board and senior management will enable the organization to use risk management as a tool that ties long-term strategy with short-term implementation.

2.1 Strategic management and strategy execution

Management is about directing and controlling an organization to achieve its objectives. It is the process of coordinating work activities so that they are completed efficiently and effectively with and through people.

Efficiency is about doing things right. That is, getting the most output from the least amount of input.

Effectiveness is doing the right things. That is, prioritizing work activities that will enable the organization to achieve its objectives within a given level of risk.

Investopedia defines strategic management as the management of an organization’s resources to achieve its goals and objectives. It involves setting objectives, analyzing the competitive environment, analyzing the internal organization, evaluating strategies, and ensuring that management rolls out the strategies across the organization.

Strategic management is about:

1. Analysing the vision, mission, strategic objectives, and environment. Basic questions include:

a. How do you objectively define success?

b. What is your compelling customer or stakeholder value proposition?

c. What things are going well now?

d. Where and how could things be better in the future?

e. Are there issues with performance, morale, and culture?

2. Decisions about two other basic questions on competitive advantage:

a. What business should you compete in to differentiate yourself, given that the essence of strategy is differentiation?

b. How should you compete in those businesses to implement your corporate strategy?

3. Prioritizing actions to execute the corporate strategy that requires the allocation of sufficient but necessary resources to bring intended values to reality (that is performance).

2.2 Disciplined and systematic strategy execution creates value

High performance is possible if management is serious and committed to value creation (or preservation) through disciplined and systematic strategy cascading and execution, which is multi-dimensional.

Create and implement a formal strategy execution process to enable superior performance.

~~~~~~~

2.2.1 Benefits of an effective strategy execution

Effective strategy execution should result in the following:

1. All employees should see the alignment of their job, performance, and positive contribution to the achievement of corporate strategy and strategic objectives. This is where there is a clear line of sight for value creation (or preservation) and performance.

2. Performance reviews of all employees who have personal performance and development objectives and plans are linked to corporate strategy, enhanced through the appropriate reward and performance-recognition systems that do not incentivize inappropriate behaviors.

3. functions and core processes are tightly aligned with the corporate strategy and fully the business units and operations.

4. Functional, operational, and business unit plans fully the achievement of the corporate strategy.

5. Opportunities and risks affecting the achievement of strategic objectives are identified and managed from an enterprise-wide perspective, where risks are the known unknowns (e.g., lack of staff competency may influence the effectiveness of strategy execution), or the effect of uncertainty on objectives.

6. All employees know regularly (more than annually) the progress they are individually making in contributing to the overall achievement and performance of the corporate strategy.

7. Organizational policies, procedures, systems, and processes are aligned with and complement each other from an integrated management perspective and fully the corporate strategy.

~~~~~~~

2.2.2 Get the right people on the bus!

People drive real tangible value in strategy execution.

Strategy execution requires the right people with the right skills, competencies, and knowledge to perform the right work in the right amounts at the right time to create the right value for the right stakeholders.

Organizations can unleash creativity, innovation, and empowerment by recognizing that individuals are the ultimate source of value and by creating an environment where they can make a positive difference and contribution.

Organizations require sufficiently skilled personnel to implement high-priority strategic initiatives.

2.3 What is required for effective strategy execution?

Effective strategy execution requires the following:

1. An agile mindset and iterations. (Chapter 3).

2. Necessary foundations for strategy execution. (Chapter 4)

3. A sound framework (Chapter 5) within which an integrated management system for strategy execution (Chapter 6) and strategy execution process (Chapter 7) occurs, where:

a. The process consists of actions taken to achieve an end.

b. The integrated management system brings together, as common and integrated touchpoints, several disparate management practices (or components) required for strategy execution.

Figure 2.1 below shows the relationship between the agile mindset and iterations, and the foundations, framework, process, and integrated management system for strategy execution.

~~~~~~~

2.3.1 Contextualized management-by-objectives

The management approach taken to execute strategy is contextualized management-by-objectives. Execute the corporate strategy within the given context and systems. Have a good understanding of the context and systems when applying management-by-objectives.

While management-by-objectives can be considered as an out-of-date concept, it is still a timeless conceptual as it clearly states the need and requirement to have clear objectives, given that management is all about directing and controlling an organization to achieve its objectives.

Management-by-objectives, also known as management-by-results, is a process of defining objectives within an organization so that management and employees agree on the SMART objectives to be achieved.

When employees themselves have been involved with the objective-setting process and choosing the agreed course of action, they are more likely to commit and fulfill their responsibilities.

There are five maturity levels of performance:

1. Level 1 — Functional separation of workflow is not present. The organizational chart is not up to date. Workers are individualized and do not interact collaboratively to achieve common goals. Personal objectives are not aligned with management objectives.

2. Level 2 — Organizational chart is present and posted. Functional tasks are clearly defined. Workflow interaction is clearly understood by all employees. Performance is measured as or fail against deadlines.

3. Level 3 — Top-management objectives are clearly defined and broken down (cascaded) as individual objectives for all employees. Employee performance is reviewed biannually.

4. Level 4 — Employees achieve personal and strategic objectives through process improvement, teamwork, and collaboration.

5. Level 5 — Employees create strategic objectives that sur corporate strategy where meeting stretch performance targets are the norm.

Strong leadership and executive commitment are required to lead people towards achieving their strategy-focused objectives. The combination of strong leadership and SMART objectives drives strategy execution and performance.

Chapter 3 — Agile mindset and iterations required in uncertainty

Organizations that are not nimble and agile can sink quickly. The 2020 pandemic has demonstrated how fragile some businesses are.

Moreover, in the world of constant change, the spoils go to the nimble.

In today’s competitive and uncertain business environment, agility, or the state of being agile, is required of organizations to create value for their stakeholders by successfully executing their strategy. The ability to respond quickly and appropriately to change, chaos, and uncertainty drive competitive advantage for the organization.

A mindset is a filter through which we experience and make sense of the world. It is a vehicle for control, coordination, and commitment to strategy execution and performance.

Agility is, therefore, about embracing constant change and making the appropriate decisions by the right people at the right time in the right context based on the relevant situation-dependent information becoming available at particular points in time when decisions and actions are taken. It is taking a just-in-time approach where the right amounts of relevant information and knowledge are processed when required, not in large or insufficient amounts of information that results in biases (i.e., cognitive and groupthink).

A timely approach tells us that your risk management process is applied at the optimum point in the decision-making process. If risk considerations are made too early or too late, either opportunity could be lost or there could be substantial costs of revising your decision.

Organizations cannot predict the future with certainty due to a lack of relevant information at the time of planning and decision-making. They may not know what lies ahead.

However, they should be prepared to actively consult with key stakeholders (e.g., customers, regulators) regularly and collaboratively to make timely, necessary, and participatory decisions when the relevant or best information becomes available. This requires continuous adaptation of plans, processes, and policies to suit the changing context or circumstance but focusing on the organization’s vision, mission, and corporate strategy.

The key for executives is to understand which decisions they need to focus on and which ones they can delegate. They also know when to decide. Any change in the landscape creates opportunities for somebody. The decision to grab a big opportunity can be destiny-changing for the organization. If you don’t do it, someone else will.

Unfortunately, traditional approaches to corporate planning assume a relatively stable world where information and knowledge are unchanging. They aim to build an enduring competitive advantage by achieving dominant scale, occupying an attractive niche, or exploiting certain capabilities and resources.

Globalization, new technologies, and greater transparency have combined to upend the business environment. Sustainable competitive advantage no longer

arises from positioning or resources.

Yesteryear’s business models do die, while new ones emerge. And yes, business models have their half-lives that can decay rapidly. Don’t be blindsided by it!

Change is good

Not only change is good, but change is also very good.

Winston Churchill (1874 to 1965) once declared, “To improve is to change; To be perfect is to change often.”

And Charles Darwin (1809 to 1882) once declared, “It is not the strongest of the species that survives, nor the most intelligent that survives. It is the one that is the most adaptable to change.”

By shifting the traditional mindset to managing, responding, and adapting to constant change and being flexible or nimble, organizations are free to explore new possibilities, avoid biases, innovate, pursue new revenue streams, and take on the immediate competitive advantage of any new opportunities coming their way.

By shifting attitudes and embracing a mindset of change and accepting this as a given, this may mean fewer unexpected twists and turns along the planned path where organizations can ensure that their product or service will continuously be fit for its intended purpose by satisfying the customer or stakeholder and creating value for them.

Embrace change rather than opposing or avoiding it. Do not confine the

organization by its plans, especially when plans no longer deliver the required or expected value due to changing circumstances, competition, or customer preferences. that plans are a means to an end, not an end in itself.

Agility is about continuously adapting the plans and activities to the context and adapting organizational policies, processes, and systems to create value, satisfy the customer or stakeholder, and ing the corporate strategy.

A good analogy is that of sailing a boat rather than driving a train to the destination. On a train, engers must go where the tracks take them. Changing a train route is a major undertaking that will require re-planning and a lot of work laying new tracks.

However, when sailing a boat, the sailor can quickly react to the conditions, take a slightly different route to avoid bad weather, or take advantage of a quick stop in a different port — while still steering towards the destination.

The destination is, of course, the organization’s vision and mission.

A successful corporate strategy does not add but regularly replaces and reprioritizes existing activities and resources in a systematic and meaningful manner for the main purpose of achieving the organization’s strategic objectives. Unfortunately, organizations have far too many conflicting priorities to be successful.

Executives must ruthlessly decide what initiatives to terminate and communicate that message or decision clearly and early. Terminate pet projects that do not add

any strategic value and divert resources to strategic value-creating activities and projects.

By specifying exactly and clearly what the ‘new’ strategy replaces, work becomes a positive and powerful force for organizational change, transition, and transformation. This significantly increases individual productivity, and organizational effectiveness and performance.

Being objective-focused rather than plan-driven

Traditional managers operating in a stable world-view focus on religiously following written plans with minimal or no change. They make and document advance decisions upfront, ready for execution. They feel good when they follow the plan to the detail, regardless of the actual outcomes or changes to the context. The achievement of objectives is secondary.

Agile leaders, on the other hand, operating in an uncertain world-view focus on constantly adapting their plans to achieve their objectives. They feel good when they achieved their objectives and have created or preserved value for their stakeholders where it is substance over form. Plans are only a means to an end.

However, the constraints and assumptions embedded in plans are still important to both the traditional manager and agile leader. Plans guide the organization and provide the necessary planned path.

Both traditional managers and agile leaders spend a fair amount of time planning, especially during the corporate planning or strategy formulation stage. However, they view plans in radically different ways — both believe in plans as baselines.

Traditional managers are constantly trying to ‘correct’ actual results to the planned baseline. Agile leaders, on the other hand, expect changes (uncertainties) and respond and adapt accordingly rather than follow outdated plans that no longer deliver the intended value. They value responding to change

over following a plan.

Given the constant changes to the competitive and business environment that organizations operate in, variations to and adaptations of plans will be common occurrences where plans are not sacrosanct. They should be flexible; they are guides, not straitjackets.

Agile leaders emphasize what to do rather than what the plan says. They rely on people (intangibles) rather than processes (constraints) to produce the required value and achieve their objectives.

Traditional managers allocate people (and resources) to a task within commandand-control structures and arrangements, whereas agile leaders motivate and lead people towards achieving goals through social influence, relationships, and contextualized management-by-objectives.

People ‘want to do the work’ for an agile leader rather than ‘having to do the work’ for a traditional manager.

Clear alignment and strong leadership required

Agile leaders must provide the required clarity, alignment, and leadership about the outcomes required by stakeholders and outcomes expected from their people. They nurture the vision and positively motivate people towards achieving the objectives.

By clearly aligning the organization towards the ruthless and disciplined achievement of strategic objectives, value creation (or preservation), and performance, organizational priorities become clear. In doing so, everyone can work effectively towards the same organizational vision, mission, and goals.

This should result in more collaborative or team-based decision-making and nurturing of shared values, especially within an uncertain environment.

There is total reliance on people to execute the strategy within the given context. There is less reliance on processes and formalities to structure work. There is also total reliance on competent leaders to lead people towards achieving the strategic objectives.

Just-in-time learning and decision-making

As the literature will attest, traditional command-and-control management is derived from the principles of Frederick Taylor’s scientific management.

In today’s world, however, there are tensions imposed by command-and-control management on teams and individuals as knowledge workers are replacing the workforce.

In Taylor’s world, the traditional manager had specialized problem-solving knowledge and skills. In today’s world, these key problem-solving knowledge and skills reside with knowledge workers (e.g., employees) and not the manager.

Agility requires a large degree of preparedness and flexibility, and the continuous sensing of the environment and context. It requires incremental decision-making by empowered individuals and teams that collaboratively consider the context and best available information at the time decisions are made throughout the corporate planning and strategy execution stages. Plans and processes are constantly adapted to the context and circumstances. Agility occurs when there are barriers and obstacles to overcome.

Adaptation is change with a purpose and working towards the achievement of an objective (e.g., to create positive value for stakeholders). In contrast, chaos is change without purpose, which is not agility.

In an uncertain world, plans are imperfect. No amount of sound advanced decision-making and planning can be humanly made upfront (especially at the planning stage) with absolute certainty that will cause the plan to be ‘perfect’ before its execution. Assumptions are therefore included in plans because the right information is not available at the planning stage. Inefficiencies are included or built into plans to cater for just-in-case surprises and gaming the allocation of unnecessary resources. This results in inefficient resource allocation and ‘gaming the numbers’ for personal self-interest.

With technology and social media, knowledge workers have instantaneous realtime access to large amounts of relevant information that will drive just-in-time learning and decision-making instead of yesteryear’s just-in-case learning and decision-making. This is a natural evolution of how the digital economy and knowledge worker makes decisions.

As part of the agile mindset, empowered but able team effectively solve problems (rather than executives!), execute the strategy, and make timely decisions on the fly when the required information becomes available to decision-makers and implementers. This will lead to a greater understanding of the context.

This will also reduce just-in-case or opportunistic gaming behaviors where resources can be objectively and systematically allocated to value-creating activities.

Agile iterations: cascade-execute-adapt

Once the organization’s vision, mission, and corporate strategy are approved and ready for execution, an agile iteration as shown in Figure 3.1 is required to create value incrementally founded on continuous adaptations and experimentations that are attributable to regular and changes in context and environment.

The cascade-execute-adapt iterations are continuous and will always benefit from regular received, experimentations, and learning from mistakes. Incrementally build value to achieve the organization’s vision and mission.

The agile iteration consists of the following:

1. Cascade the corporate strategy, objectives, and key performance indicators, and check for alignment. Ask the questions: What will we do? What are our measures of success?

2. Execute the strategy by systematically creating (or preserving) value for the organization’s stakeholders and conducting safe-to-fail experimentations to systematically navigate complex issues and uncover the relationship between cause and effect. The focus: Just do it!

3. Adapt (and improve) the organization’s performance and plans to the environment and context. These are agile course corrections based on regular

, improvement, and experimentation. Ask the questions: What did we do? What changes should we make to perform better or execute the strategy?

This approach emphasizes the following:

1. Focus on the achievement of organizational vision, mission, and corporate strategy.

2. Flexibility, resilience, and the ability to recover positively from constant contextual and environmental changes.

3. Being quick and well-coordinated in movement and decision-making.

4. Regular, timely, and appropriate from customers and stakeholders.

5. Continuous adaptations, experimentations, and transitions due to constant contextual and environmental changes.

6. Continuous improvements and value creation (or preservation).

7. Elimination of non-value adding and non-strategic activities, projects, and programs.

8. Regular and timely on the organization’s and employees’ performance.

Chapter 4 — Foundations for strategy execution

For strategy execution to be effective, an organization should have the following foundational elements or conditions in place, given its internal and external circumstances:

(4.1) Communicate and regularly and openly.

(4.2) Great execution requires great executable strategy.

(4.3) What gets measured, gets executed.

(4.4) Know your business, your people, and yourself.

(4.5) Adapt and change or perish.

(4.6) Strategies and plans are built to be executed.

(4.7) Execution requires vertical alignment and horizontal integration.

(4.8) Strategy execution is everyone’s job.

(4.9) Understand what you are able for.

(4.10) Dynamic governance drives strategy execution.

(4.11) Make human capital the creative core of strategy execution.

(4.12) Simplicity and brevity are keys to effective execution.

4.1 Communicate and regularly and openly

Executives should have excellent communication and interaction skills and processes to drive strategy execution and minimize blame and negative silo cultures within the organization.

Transparent and open information sharing, knowledge transfer, and common dialogues across organizational boundaries and silos are key drivers for successful strategy execution. It is essential that everyone understands their performance measures, targets, and conditions for organizational success and are fully committed to them.

Transparent communication requires the organization to break down silos and enable a boundary-less organization whose culture is focused on the performance of a healthier whole. Unnecessary silos invite hidden agendas rather than welcome efficient cross-functional collaboration and problemsolving.

Organizational silos are the root cause of most workplace problems and are why many of them never get resolved. In a workplace where silos exist, problemsolving and decision-making are more difficult because of self-promoters — rather than team players fostered by a cross-functional environment.

Breaking down silos allows a leader to engage their employees to get their hands dirty and solve problems together. It becomes less about corporate politicking and more about finding resolutions and making the organization stronger.

Failing to share information when deciding can also increase the organization’s exposure to risks, especially reputational risks. The best available information is required for sound decision-making and effective strategy execution.

The usefulness of information is enhanced if it is comparable, verifiable, timely, and understandable. Information can be obtained from two types of sources:

1. Direct sources — Observations and measurements of actual process operations or their outcomes.

2. Indirect sources — Measures that are derived from processes or outcomes under consideration.

Combinations of measurements from the various sources are chosen for necessity (depending on availability) or for convenience (timeliness, cost, etc.).

Successful strategy execution involves making the strategy real for employees by translating it into meaningful language and actions. Making strategy work requires transparent, accurate, and timely about actual organizational and individual performance. Use that information to fine-tune the corporate strategy, objectives, organizational performance, and the strategy execution process itself.

Get the corporate strategy out of binders and into the hands of employees by implementing communications and awareness program that is specific to the

corporate strategy, the execution process, and organizational context and maturity.

Failure to communicate the corporate strategy widely and effectively may create suspicion and anxiety that undermines team effort and trust to execute the strategy and may guarantee failure of the corporate strategy itself.

As it may be impossible to align every single employee’s objectives against the corporate strategy, organizations should provide all employees with information, training, and tools to manage their strategic alignment and performance. If they have access to information about the corporate strategy, objectives, key performance indicators, and progress-to-date on achieving those performance commitments, motivated individuals should be able to align themselves in ways previously unimagined, thus providing a positive momentum or driver for effective strategy execution.

4.2 Great execution requires great executable strategy

The starting point of any effective strategy execution is a sound corporate strategy that is executable. An executable strategy is a narrative that tells a comprehensive story of aspirations, of how value is created, how the change will unfold, what steps will be taken and why, and how those steps lead one to another.

The strategy has a compelling value proposition that clearly defines and focuses the organization on delivering value to its customers (and stakeholders). It involves decisions affecting what business the organization will compete in and how it will effectively allocate resources among those businesses.

Failure to execute customer-driven strategies, no matter how challenging such strategies may be, is likely to result in the eventual demise of the organization.

Depending on the organization’s context and maturity, your corporate strategy may need to be:

1. Recreated perhaps as often as every three to five years if new competitors arrive or markets unexpectedly shift.

2. Refreshed when there is ongoing strategy dialogue taking place and there is a need to update the organization’s perspective on long-term trends and strategic

assumptions

3. Recommitted to the organization as an established strategy.

An agile mindset will minimize or eliminate the need for having detailed assumptions made in plans as plans are continuously adapted (or changed) to suit the context and changes in the competitive environment. Assumptions are conditions that exist and may translate into risks if they do not hold true. At the root of every failed strategy is a set of assumptions about the future that eventually proved false.

Use ‘what-if’ scenario planning to evaluate and test management’s ‘view of the future’ by articulating different future conditions or events, their likely consequences, and how the organization can respond to or benefit from them.

If the strategy understands and meets the requirements, employees can explain precisely how the organization creates and delivers this value to the customer and stakeholders.

The corporate strategy for Budget Air is ‘to remain the most profitable airline (high-level objective) by offering the speed of airline travel at the price, frequency, and reliability of cars, buses, and trains (advantage) to price-sensitive travelers who value convenient flights (scope)’.

~~~~~~~

4.2.1 Objectives and key performance indicators (measures and targets)

Objectives and key performance indicators should evolve as the organization matures. strategy execution with high-quality measurable and contextualized:

1. Strategy-focused objectives that seek to answer the question: What is the corporate strategy trying to achieve?

2. Objective-focused key performance indicators that contain two elements:

a. Logical cause and effect performance measures that seek to answer the

question: How to monitor and measure performance success or failure against the objectives?

b. Numerical performance targets that quantify the levels of performance or rate of improvement required by the corporate strategy.

3. Strategy execution plan containing actions, milestones, and governance required to successfully execute the strategy.

Your key performance indicators should demonstrate the following properties:

1. Relevance — Logical and clear relationship to an objective.

2. Quantifiable — Numbers are best because they can be used for trends and are less open to misinterpretation than text-based qualitative indicators.

3. Verifiable — Experts or professionals working independently should agree on the choice of a particular performance indicator.

4. ability — One person with authority is able for the level of performance. t abilities should be avoided.

5. Actionable — There is a structure in place to regularly monitor and review the

data and actions taken. Comparable data is best so that benchmarking is possible.

In choosing key performance indicators, it is important to check that:

1. They are measurable.

2. Their use is efficient in of demands on time, effort, and resources.

3. The measuring process or surveillance encourages or facilitates desirable behavior and does not motivate undesirable behavior (e.g., fabrication of data).

4. Those involved understand the process and expected benefits and can give input to set the performance targets.

5. The results are captured and performance and reported in a form that will facilitate learning and improvement across the organization.

Use a mixture of lead and lag performance measures:

1. Lead — Measures that drive or lead performance. They normally measure intermediate processes and activities (e.g., personal goals alignment, revenue mix, strategic job coverage).

2. Lag — Measures that focus on results at the end of a period. They normally characterize historical performance (e.g., return on investment, employee satisfaction, revenue per employee).

Categorize and customize numerical performance targets into:

1. Baseline targets — This is the minimum level of performance for earning bonuses or incentive payments. For anything below this target, make no discretionary performance payments.

2. Stretch targets — Achieving beyond this performance target will earn the employee an exceptional performance bonus. It is the level of performance that maximizes (or stretches) individual potential to the reasonable point of possibly not achieving it in the short term.

3. Average targets — Mid-point between the baseline and stretch performance targets.

The expected level of performance for the organization is usually set between the baseline and stretch performance targets.

Different corporate strategies create exposures to different levels (and types) of risk. A risk appetite statement specifies the strategic boundaries for acceptable performance variability and loss exposure when executing the strategy.

~~~~~~~

4.2.2 Defining performance targets that matter

The board (or oversight body) and management must set reasonable, achievable, and executable performance targets based on the desired return or outcome and the optimal level of risk (and control) that each business unit within the organization is willing to accept in pursuit of their business objectives. They must consider and approve the organization’s risk appetite when evaluating strategic alternatives, setting related corporate strategy and objectives, and developing mechanisms to manage related risks (and controls).

Indiscriminate objective setting and aggressive performance targets can motivate negative risk-taking behavior.

Use the same measure as a performance target and a risk target where appropriate. This approach allows for clear and simple communication of the level of variation that management is willing to accept to achieve the objective.

Select the appropriate key performance indicators to enable the organization to track progress and performance toward the achievement of corporate strategy and objectives, mitigation of risk, and compliance with internal controls, policies, and regulations. They are the primary means for communicating performance results across the organization and providing a combination of

leading and lagging performance measures that result in a more balanced mix of forward-looking performance targets.

Selecting the wrong or inappropriate performance measures and targets will drive the wrong, negative, or opportunistic behaviors that can result in unintended consequences and poor performance.

Limit the number of performance measures and targets to five or less for each objective. This helps the organization to prioritize and focus based on the 80/20 Pareto Principle. That is why the term ‘key performance indicator’ is used rather than just ‘performance indicator’.

Four commonly used key performance indicators are:

1. Customer satisfaction.

2. Internal process quality.

3. Employee satisfaction.

4. Financial performance.

~~~~~~~

4.2.3 Logically linking cause and effect performance measures

A common way to choose and use key performance indicators is to apply management concepts from the balanced scorecard and strategy map. While the use of balanced scorecards and strategy maps may be considered out-of-fashion, the concepts behind these management tools can still be powerfully used.

The balanced scorecard has four cause and effect perspectives of financial, customer (or stakeholder), internal processes, and learning and growth. The key here is to understand your organization’s cause-and-effect relationships that create value for your stakeholders and customers. This causal link will improve your performance.

Structure performance scorecards around four cause and effect perspectives:

1. Financial — Defines the chain of logic by which intangible assets (e.g., people, information) are transformed into tangible value (e.g., revenues, projects). Answers the question: How do we look to our shareholders/stakeholders?

2. Customer — Clarifies the conditions that will create value for the customer or stakeholder. Answers the question: How do customers/stakeholders see us?

3. Internal processes — Define the core processes that will transform intangible assets into tangible customer and financial outcomes and value. Answers the question: What must we excel at?

4. Learning and growth — Defines the intangible assets that must be aligned and integrated to create tangible value. Answers the question: How can we continue to improve, create value, and innovate?

A balanced scorecard implementation can result in the following transformations:

1. Enhanced role clarity — Employees can develop an enhanced understanding of their job deliverables and abilities. This will enable them to appreciate their contribution in the bigger context of organizational objectives.

2. Enhanced self-esteem — Employees can feel significant, responsible, and valued by the organization. They can take pride in doing their job.

3. Empowerment, initiative, and enthusiasm — Employees can start taking initiatives to diagnose problems, analyze root causes, and resolve problems.

4. Ownership and ability — Employees can take an active interest in team activities and take initiatives to meet performance targets.

5. Creativity and innovative ideas — Employees can produce innovative ideas to resolve problems and improve processes and performance.

6. Enhanced supervisor involvement — Supervisors can take an active interest in their performance.

7. Resource availability — Team leaders can devote necessary resources for employees to continue working on their initiatives and achieve their objectives.

8. Enhanced focus on competency development — Competency gaps can be identified and managed in the context of strategic objectives and necessary training and development were provided.

9. Enhanced vigor — With clarity on objectives, everyone can have the energy and enthusiasm to work on their objectives and perform well.

10. Enhanced communication and information sharing — Communication and information sharing can be enhanced significantly.

11. Team cohesiveness — Interpersonal relationships can be improved significantly, where conflicts are reduced, and collaborative efforts are visible.

12. Enhanced focus on performance — Employees can become more focused and performance-oriented as they needed to show progress and achievement of objectives.

13. Objective assessment of performance — Scorecard reviews drive objective assessment of performance against targets where the team assigns individual performance ratings. Employees can get a sense of just and fair treatment.

14. Performance linked incentives and rewards — The organization could link productivity incentives to performance ratings of employees.

15. Public recognition — Teams can receive accolades as they proactively resolve problems and achieve their strategic objectives.

A well-designed performance scorecard that is ‘balanced’ can provide a chain of logical cause and effect relationships, represented by a strategy map. For example, learning and growth can lead to better business processes. This can result in higher customer loyalty and satisfaction, and thus higher revenues from satisfied customers. Although there are no set formats for balanced scorecards, they vary from organization to organization and sector-to-sector.

A strategy map can provide a uniform and consistent way to describe your strategy, so your objectives and measures can be visualized, established, and managed. It describes how intangible assets drive performance enhancements to the organization’s internal processes that have the maximum leverage for delivering value to your customer, stakeholders, and shareholders.

However, if the performance relationship between cause and effect is unknown (i.e., there is no visible causality) or that the relationship can only be established in hindsight, then the organization:

1. Must start innovating through systematic safe-to-fail experimentations.

2. Consider the outcomes of these experiments.

3. Respond appropriately by implementing the known relationship between cause and effect for improved performance and effective strategy execution.

Budget Air has developed a strategy map based on Kaplan and Norton’s balanced scorecard management tool. The percentages in the strategy map denote the best-in-class weighting or prioritization of each balanced scorecard perspective.

Figure 4.1 below shows Budget Air’s strategy map and balance scorecard.

~~~~~~~

4.2.4 Focus on systems and processes

As people are only responsible for a small percent of organizational problems, most organizational problems are systems and process-related. Therefore, organizations should spend more time, effort, and resources in managing and improving internal systems and processes, as indicated in Budget Air’s strategy map.

Budget Air’s strategy map has a 35% focus and prioritization on managing and improving internal processes.

4.3 What gets measured, gets executed

your strategy execution with a handful (not a long shopping list!) of high-quality SMART key performance indicators that stretch everyone’s performance towards achieving the corporate strategy. Motivate and reward employees to do more where their capacity and capabilities are constantly maximized with the allocation of appropriate resources, training, and coaching.

Unfortunately, when organizations do not know what to measure (or where they are going), they often measure too much (just-in-case mentality) in the hope that some measures will eventually hit the mark, including having business-as-usual measures that are operational and have no strategic significance. Having too many so-called ‘strategic’ objectives and ‘key’ performance indicators makes corporate strategy translation and cascading difficult and meaningless, especially for large and complex organizations.

Avoid ‘layering-on’ new measures onto existing (old) measures and failing to discard performance measures that reflect old priorities or out-of-date strategies and objectives. This confuses performance priorities, diluting the performance impact, and having a diverse set of measures that are not consistent, are meaningless, and counterproductive.

Organizations measure things to change those behaviors that are damaging to performance and reinforce behaviors that are positive contributors to performance. It follows that if organizations measure the wrong things, they are likely to motivate the wrong behaviors.

For example, in the early 1990s, Sears set sales goals for its auto repair staff at $147/hour. This specific challenging goal prompted staff to overcharge for work and to complete unnecessary repairs on a companywide basis.

Underperformers will most likely resist objective measurements or being performance managed. Counsel them to lift their level of performance.

4.4 Know your business, your people, and yourself

Executing well requires executives to live their business, get involved in the key details of the business model development and implementation to stay on top of what is happening, and learning what obstacles or risks lie in the path of good strategy execution and organizational performance. They should know the context of their organization and internal and external circumstances. Implementing change without fully understanding and appreciating the dependencies and context is counterproductive to any strategic initiative.

Management should know:

1. Their organization, core processes, and critical success factors.

2. Their capacity, capability, resourcing, and competencies to execute and perform well.

3. Key value drivers, risks, and controls that are linked to the corporate strategy, objectives, and key performance indicators.

4. Organizational issues relating to performance, morale, and culture.

Organizations should build long-term organizational and individual capabilities, capacities, competencies, and flexibilities to the strategy execution. This includes developing, deploying, and maintaining:

1. Workforce communication and engagement strategy and plan.

2. Workforce succession, capacity, and capability plan that includes a human capital strategic readiness matrix.

3. Individual skills and competencies plans.

4. Individual training, development, and coaching plans.

5. Organizational change management plan.

6. Organizational compensation and benefits strategy and plan.

Develop a human capital strategic readiness matrix consisting of a strategic gap analysis to determine the required number of employees based on existing strategic job families, competency profiles, and skills available within the organization.

Strategy execution is doomed to failure unless employees fully understand the

corporate strategy, have the right skills, competencies, capabilities, and capacities to implement them, and are motivated and rewarded to do so.

Budget Air has developed a human capital strategic readiness matrix as shown in Figure 4.2 below.

4.5 Adapt and change or perish

After a business implements a strategy, competitors will react. Organizations will need to adapt to meet the new challenges and uncertainties. There is no stopping point and no final battle. The competitive cycle continues perpetually. Adapt and change, or perish.

The business and risk landscape is continuously changing and evolving radically. Threats are coming harder and faster, from all directions, and in more subtly varied forms. The only solution is to build organizations that are agile, adaptable, and sustainable. Organizations that can survive and thrive amid disorder and uncertainties emerge stronger than before.

Planning for and managing and responding to change is the essence of any corporate strategy. As organizations are constantly adapting to the changing world, to new technologies, or to new ways of doing things, a sound implementable corporate strategy should clearly and regularly communicate a change agenda to employees so that they can always be flexible and resilient. Change is a given. It’s the new normal.

Speed, adaptability, and agility can be strategic differentiators. Find the real source of competitive advantage in management’s ability to consolidate enterprise-wide technologies and skills into capabilities and competencies that effectively empower individuals to adapt quickly to the changing opportunities and context. Organizations should also demonstrate the ability to execute well when new strategic opportunities arise.

There are three categories of change:

1. Managing risk and uncertainty in an operating environment (unpredictable world) — It is about recognizing patterns and early warning signals, developing new solutions and approaches to novel problems, and building resilience against good and bad shocks.

2. Managing organization’s response and approach to uncertainty — It is about seeing the connections between emerging signals, building an agile organizational culture that can deal well with uncertainty, recruiting and developing the right people to respond quickly and creatively to the unexpected, and implementing appropriate counter-moves, initiatives and directions.

3. Developing a new kind of management, leadership, and workforce for strategy execution — It is about organizational leadership bringing clarity and agility to an uncertain and often confusing world, and observe, understand, and react positively to uncertain situations and environments.

4.6 Strategies and plans are built to be executed

Always keep the end game in mind.

Plant seeds of execution problems and implementation issues early during strategy formulation and corporate planning processes. The processes of defining and deg the corporate strategy are not distinct or disparate from creating and implementing the corporate and business unit plans. Know what the end should look like.

Planners should always be thinking about the following as they formulate or review the corporate strategy:

1. Strategy execution and performance at the lowest organizational level from every employee’s and business unit’s perspective and limitations.

2. Intended outcomes or benefits, given the internal and external circumstances.

3. An exit strategy, especially if things do not go as intended.

Good planning enables and complements an effective strategy execution process. Involving actual doers in planning and participatory decision-making is essential

for successful strategy execution, thereby securing or gaining stakeholder commitment and buy-in.

This is where your plans must be constantly adapted to the changing context.

4.7 Execution requires vertical alignment and horizontal integration

Strategy execution requires two types of fit within the organization.

1. Vertically fit — Strategic or vertical alignment is the systematic synchronization of organizational levels, people, processes, systems, plans, objectives, incentives, and relationships that align the business, budgets, and operations to the corporate strategy.

2. Horizontal fit — Integrate and synchronize individual components across core processes, value chains, and boundaries of the organization for the key purpose of aggregated alignment of value creation with the corporate strategy. A value chain is a chain of activities that delivers a valuable product or service for the stakeholder.

The concept of fit or congruence is about the degree to which the goals, objectives, or structure of one component are consistent with the goals, objectives, or structure of another component. Other things being equal, the greater the total degree of fit between the various components, the more effective will be the organization.

This is where, taken together, the sum of parts must integrate seamlessly and work together cohesively as one to achieve objectives and key performance indicators.

An analogy of this would be an orchestra. Every musical instrument must work in harmony with each other to produce a musical piece.

~~~~~~~

4.7.1 Vertical alignment

Based on three cascading options, cascade (or ‘breakdown’) longer-term strategic objectives and key performance indicators into shorter-term operational, project, and program objectives and key performance indicators that are set for each level of the organization, right down to every individual in the organization. These objectives and key performance indicators will form part of the individual’s abilities as documented in their performance scorecards.

The three cascading options, as shown in Figure 4.3:

1. Adoption — Sub-level adopts the exact objective or key performance indicator as to its parent.

2. Distinctive — Sub-level develops objective or key performance indicators that are unique and cannot be explicitly or directly attributed to its parent.

3. Shared (relative or absolute) — Every child at the same level shares or contributes to the parent’s objective or key performance indicator, either on an absolute or relative basis.

A hierarchy of objectives shows how the corporate strategy is driven top-down and aligned across organizational levels and strategic initiatives. Strategic initiatives may consist of any number of portfolios, programs, and projects used as effective management tools for executing the organization’s corporate strategy.

Everyone across all levels of the organization and throughout the organization must understand and be ultimately able for the achievement of longerterm strategic objectives.

Individually, they have clear measurable shorter-term objectives that strategically align with and fully or complement each other. To achieve longer-term strategies, manage the short-term performance of all employees at the individual level.

Employees must understand how they can personally influence strategy execution and how their work is important to the overall execution outcomes. Develop appropriate incentive and reward programs, as well as clearly articulated career progression and succession paths. Align and synchronize all personal performance scorecards towards achieving the corporate strategy. The right organizational design, structure, and culture can effectively facilitate this.

Cascade multi-year activities or projects into manageable pieces of yearly activities, funded by a rolling annual budgeting process. Allocate and link resources to strategy execution across the organization.

Budget Air has a formalized cascading process.

1. Budget Air’s executives post their personal objectives beneath the relevant strategic objective during the Strategic Alignment Workshops to assess objective quality. all strategic objectives and key performance indicators by aligning individual executive objectives.

2. Small groups ‘vote’ on executive objectives using color-coded Post-ITs:

a. Green notes — individual objectives with the greatest outcome.

b. Red notes — Individual objectives that belong under a different strategic objective.

c. Yellow notes — Individual objectives that are unclear, requiring further review or clarification.

3. Assign small breakout teams to each strategic objective to assess for clear and comprehensive alignment of personal objectives with corporate strategy. The team first responds to green notes on objective impact. Thereafter, yellow notes on clarity. Finally, red notes on realignment.

4. Each breakout team finalizes the wording for its assigned strategic objective.

5. Teams determine if executive objectives the strategic objective. If further revisions are necessary, the original owner will review new or amended objectives and key performance indicators.

6. Each team presents the final wording of its strategic objective and corresponding executive objectives and key performance indicators.

7. The group discusses risks, controls, and overall budgets that are linked to the achievement of each strategic objective and identifies the next steps.

8. Strategic objectives and key performance indicators are subsequently cascaded throughout the organization level-by-level for all employees, totally embedding the corporate strategy as personal objectives and key performance indicators for the entire workforce of Budget Air.

9. Composition of employees’ objectives may include:

a. One financial performance objective, where appropriate. Not everyone has financial abilities.

b. One performance management or talent objective.

c. Two to five functional, team, individual, personal, or stand-alone local level objectives.

10. Responsibility for personal objective and key performance indicator setting and alignment rests with the individual.

11. Executives act as ‘checks and balances’ and agree to direct reports’ objectives and key performance indicators to ensure that strategic and individual objective alignment is obtained with clear performance line-of-sight towards the achievement of the corporate strategy.

12. This transparency or objective-to-objective alignment helps employees understand how individual actions will positively contribute to the achievement of Budget Air’s strategic objectives. It provides employees with clear guidance and performance line-of-sight that will help them set effective and aligned personal objectives.

13. Dynamic objective-to-objective adjustment speeds Budget Air’s response time to external changes, enabling the entire workforce to refine or redefine personal objectives when changes occur. This creates agility for Budget Air.

14. Periodic objective reviews between executives and their direct reports help ensure continuous enterprise-wide alignment by guaranteeing that each employee discusses personal performance and objective adjustments with the full and guidance of their supervisor.

15. Employees and executives meet quarterly to review performance progress against personal objectives, and development and training plans, making all necessary changes promptly.

~~~~~~~

4.7.2 Horizontal integration

Apart from vertical alignment, organizations should horizontally integrate and align objectives and key performance indicators to optimize workflows, collaboration, and teamwork across processes, value chains, functional areas, and organizational boundaries. This minimizes the silo effect that plague organizations into inefficiencies and in-fighting or finger-pointing.

For example, the procurement function may measure cycle times to improve customer satisfaction with the procurement process only. However, from the customer’s viewpoint, all processes, beginning with the need identification to the actual product delivery, represents the complete procurement cycle. To capture this entire end-to-end cycle, many business units (i.e., computer services, mailroom, procurement, receiving, property management, and transportation) must be involved to complete the organizational-wide procurement value chain for the customer. This is where organizations must use performance measures that capture their entire end-to-end customer experience cycle.

Customers do not see the process boundaries, but they care about the attributes or features of the final product or service delivered to them. They do not care about what goes on in the organization.

Avoid looking solely at individual transactions along the value chain. All customer-focused performance measures must measure the entire end-to-end cycle from the customers’ perspective where there is value creation for the customer. These are externally focused measures.

After the deployment of scorecards (especially after the vertical integration), executives need to re-examine their existing core processes along the value chain and determine if they are also linked to the corporate strategy, as shown in Figure 4.4. If such linkages are not found, the collective end-to-end processes and scorecards should be reviewed and amended if required.

Horizontal integration is about synergizing and synchronizing:

1. Objectives and key performance indicators of business units, departments, and functions at the same organizational level or across the value chain using tools like service level agreements and lean management (e.g., 6-sigma).

2. Cross-boundary processes and activities that create value for the customer across the entire value chain where:

a. Activities are strategically reinforcing (i.e., aligning all activities that the corporate strategy).

b. Enterprise-wide collaboration, communication, and integration breaks down organizational boundaries and silos.

c. Individuals and teams cooperate and collaborate to deliver the required value to the customer or stakeholder.

d. Waste or non-value adding activities are minimized or eliminated, where waste is defined as whatever that does not deliver value.

3. Policies and procedures across organizational boundaries that must work in

concert and harmony with each other to fully and drive performance and value creation (or preservation). The concept of consistency or fit implies that there is integration and alignment of policies and procedures with the organization’s strategic positioning, and customer and stakeholder requirements.

4. Risk tolerances and appetites and controls across the value chain and organizational boundaries.

Budget Air’s corporate key performance indicator of “86% zero-min on time punctuality” (see Figure 4.1) is cascaded vertically and horizontally across the following are processes that are parts of a larger value chain:

1. 96.53% zero-min on-time punctuality for ground operations.

2. 96.16% zero-min on-time punctuality for flight operations.

3. 98.16% zero-min on-time punctuality for engineering and maintenance.

~~~~~~~

4.7.3 Strategically align functions to create value

functions like people and culture, finance, and information technology should clearly articulate how they can contribute positively to the value-creation end-to-end activities of the organization and business units they serve and .

Instead of striving to be the best in class in everything they do, functions must become fit-for-purpose from a value creation perspective. They must change their portfolio of activities to focus primarily on those that are strategically important to the enterprise or that add high value.

All functions most operate in sync across the entire end-to-end value chain that delivers value to customers, both externally and internally, as shown in Figure 4.5. This ensure that the organization’s investments in ing functions full reflect the strategy and needs of the business, with the goal of creating differentiated business-driven opportunities.

Functional performance scorecards that are strategically focused and based on external and internal customer requirements, agreed with service levels, and deliverables, contain no more than 20 key performance indicators.

For example, if the business unit is expected by management to collect monies from their customer within 45 days of product delivery, they would expect their Finance to generate accurate invoices within two business days of the receipt of an acknowledged or signed delivery order. The two-business day (or service level) target shall be one of many targets contained in Finance’s performance scorecard. If the manager in Finance cannot meet this two-day service level as initially requested by the business unit, aim for a mutual compromise, with each manager giving reasons for their expectations, requirements, and limitations. Apart from coming to a mutually negotiated position, this two-way communication process facilitates learning and understanding of each other’s processes and issues, all guided by a common goal of meeting external customers’ requirements and expectations, thus reducing elements of selfinterest. This promotes open measurement, , and collaboration, eliminating or minimizing potential blame culture or silo-effect between functions and business units.

Cross-check and fine-tune function’s objectives, key performance indicators, and action plans against each element of the corporate strategy, strategic objectives, and key performance indicators for consistency and alignment, using cross-referencing techniques.

From a risk management perspective, in systematically translating and allocating the strategic objectives across the value chain and into core and functions, risk can be identified and managed, as shown in Figure 4.6.

4.8 Strategy execution is everyone’s job

Strategy execution is all about getting things done through people. It involves every individual in the organization.

Strategy execution is about the whole of organizational teamwork and collaboration where every individual is striving and being led towards a common vision and goal. This is what makes strategy execution extremely difficult for organizations, often demoted to the too-hard basket, which is unfortunate.

~~~~~~~

4.8.1 Personal ability vital

Effective collaboration, integration, and synchronization vital for strategy execution and decision-making cannot occur if personal responsibilities and abilities are unclear, inconsistent, or non-existent.

Working as a team, every individual should be personally able for their performance, risks, and controls. They should have the appropriate empowered and delegated decision-making rights and authority for executing or performing their work within defined amounts or thresholds of residual risk and risk

appetite.

With clear abilities (not responsibilities), all employees should understand how their job and performance are specifically aligned with and contributes positively to the overall achievement of the corporate strategy. This creates a clear performance line-of-sight.

Many CEOs fear that their employees are working on unproductive or misdirected activities that are unrelated to the organization’s strategy. They know that to achieve long-term success, everyone must be aligned behind their strategy.

Organizations should, therefore, create and sustain an environment and culture that enables and s personal abilities. The ‘it’s not my job’ syndrome should be minimized or eliminated through the appropriate people and culture, compensation, benefits, and rewards systems.

Without personal ability, organizational and personal performance will be sub-optimal because people do not know who is doing what, when, and why, leading to a lack of strategy execution focus and poor organization performance. Without ownership, authority, and ability for objectives, key performance indicators, risks, controls, and actions:

1. and performance cannot be effective (e.g., sub-optimal).

2. Compensation, benefits, and rewards cannot be objectively assigned, especially for pay-for-performance reward schemes and bonuses.

3. Thrust for positive change, agility, and strategic differentiation cannot effectively work.

Five key aspects of ability relevant for strategy execution:

1. ability is a relationship — ability is a two-way street or a contract between two parties, employees, and employer.

2. ability is results-oriented — ability does not look at inputs and outputs. It looks at outcomes or performance.

3. ability requires reporting — Reporting is the backbone of ability. Without it, ability will not stand up.

4. ability is meaningless without consequences — A key word used in defining and discussing ability is an obligation. Obligation indicates liability, which comes with consequences, especially if there is underperformance. Deal appropriately with poor or underperformance.

5. ability improves performance — The goal of ability is to improve performance, not to place blame and deliver punishment. In taking acceptable or calculated risks, organizations learn positively from their mistakes.

~~~~~~~

4.8.2 Empowered and delegated decision-making rights

Empower employees with the appropriate delegated decision-making rights and authority to execute the assigned work that they are personally able or responsible for.

Document decision-making rights in job descriptions, work plans, and limits of authority instruments.

The organization’s capability to make effective decisions and make them quickly affects strategy execution. This is where a good decision executed quickly beats a brilliant decision implemented slowly or poorly. When organizations can’t make the right decisions quickly and effectively, and execute those decisions consistently, they will lose ground.

4.9 Understand what you are able for

Based on regulatory and business context, organizations should know what they are able for from the eyes of their external customer and stakeholder, and where their ability line can be drawn along the hierarchy of outputs (or outcomes), especially from a strategy execution perspective.

Private and public listed organizations will draw their ability line at results achieved, where profitability and return on investments matter most.

Public sector organizations that work collaboratively in partnership with other organizations to deliver community benefits or long-term outcomes (e.g., public housing) should be clear about what they are able for to their community and stakeholders.

~~~~~~~

4.9.1 ability line — What are we able for?

Organizations should write SMART objectives that tell their stakeholders the

specific results they are seeking to achieve. ability line is the reasonable level of results, given the resources and strategies used. It is generally based on applicable regulatory, legal, and contractual requirements.

For example, public sector organizations may be able for different hierarchical levels of ability based on the position of the ability line where each level has different objectives:

1. Increase stakeholder awareness — e.g., run 10 different ments over three months.

2. Increase stakeholder knowledge and skills — e.g., increase skills and knowledge of the staff.

3. Use of service — e.g., increase utilization of services by 10% within this financial year.

4. Efficiency — e.g., cut the cost of service delivery by 15% within this financial year.

5. Effectiveness — e.g., achieve and maintain accreditation for all accreditable services within two years.

6. Satisfaction — e.g., achieve an above-average level of stakeholder satisfaction

of 85% within this financial year.

7. Change behavior — e.g., increase the proportion of our target market to use our services by 10% within this financial year.

8. Achieve results — e.g., increase revenues by 10% within this financial year.

~~~~~~~

4.9.2 Delegation limits

The individual’s financial and non-financial delegation limits should also be synchronized and aligned with their position relative to the organization’s ability line, and applicable risk appetite and tolerance thresholds.

Risk appetite is how much risk the organization wants and risk tolerance is how much risk the organization can live with. Where appropriate, derive risk appetite and tolerance thresholds from key performance indicators.

4.10 Dynamic governance drives strategy execution

Corporate governance is the framework of rules, relationships, systems, and processes within and by which authority is exercised and controlled in organizations. It encomes the mechanisms by which organizations, and those in control, are held to .

Corporate governance influences how the objectives of the organization are set and achieved, how risk is monitored and assessed, and how performance is optimized.

Effective corporate governance structures encourage organizations to create value, through entrepreneurialism, innovation, development, and exploration, and provide ability and control systems commensurate with the risks involved.

Good governance is an objective-focused concept that enables the organization to:

1. Make timely strategic decisions, apply the same principles of setting objectives, and evaluate performance measures.

2. Achieve its corporate strategy, strategic objectives, and key performance indicators.

3. Manage potential opportunities and risks inherent in pursuing the corporate strategy and achieving objectives and key performance indicators.

4. Optimize organizational and individual performance and value contribution or creation for the customers and stakeholders.

The effective management of risks at all levels of the organization is integral to good governance and performance. It provides the best available information required for effective and timely decision-making.

This enables the organization to:

1. Share performance and risk-based information horizontally between business units, value-chains, and functions.

2. Escalate and cascade this information vertically (top-down and bottom-up), thereby providing management and employees with a clear view of performance, risks, and controls facing the organization.

The choice of strategy may influence organizational structures, culture, and processes. They, in turn, can collectively enhance or limit organizational performance and the effectiveness and implementation of the strategy execution plan. Structures and processes may also affect the speed at which organizations can adapt to changing environments.

Organizations should translate their corporate strategy into an appropriate organizational design and structure that effectively and logically connects the dots between objectives and key performance indicators, and strengthens and improve performance, reporting relationships, information flows, decisionmaking rights, and social networks.

Culture, values, and beliefs elicit and reinforce employee attitudes and behaviors, which, in turn, can affect organizational performance and strategy execution.

Organizations should ensure that their culture is a source of competitive advantage, allowing culture to be an enabler rather than a hindrance to strategy execution.

4.11 Make human capital the creative core of strategy execution

To execute successfully, organizations must make human capital the centerpiece of their corporate strategy. Build organizational capabilities that the innovation, collaboration, and continuous learning essential for success in today’s complex, fast-changing environment.

A workforce made up of talented, motivated, and engaged knowledge workers is a huge advantage for strategy execution.

Strategy execution is doomed to failure unless knowledge workers:

1. Fully understand their objectives and the corporate strategy and strategic objectives.

2. Have the required skills, competencies, knowledge, and talent to implement and achieve them.

3. Have the required execution capabilities, resources, capacity, and organizational .

4. Are motivated and committed to do so.

As such, organizations should hire candidates or assign employees based on their ability to positively the corporate strategy and organizational culture and add tangible and measurable value for their customers and stakeholders.

This is where organizations should establish and quantify direct cause and effect linkage and relationship between employee engagement and specific business results and performance (e.g., reduced shrinkage, increased sales, etc.).

As strategic initiatives continually change to suit the ever-evolving external and competitive environment, it is unfortunately very difficult for organizations to realign their workforce and people and culture strategies and plans constantly and to constantly fiddle around with well-established compensation and benefits strategies just to keep up. This creates a problematic but real disconnect between people and cultural practices and corporate strategy.

Therefore, organizations of every type, people processes are failing to keep pace with a changing business landscape.

4.12 Simplicity and brevity are keys to effective execution

Effective strategy execution boils down to simplicity and brevity.

Simplicity and brevity contribute to clarity, especially for larger organizations. They help organizations stay focused on one big thing. Focusing on one big idea is one strategic business statement that is created to focus the entire organization on a single medium to a long-term organization-wide goal which is audacious, likely to be externally questionable but not internally regarded as impossible, but achievable.

Simplicity and brevity are about taking the complex and making it simple so that everyone in the organization fully understands:

1. Where they want to get to?

2. Who their customers and stakeholders are?

3. How and when they will get there?

When the business landscape is simple, organizations could afford to have

complex strategies. But when the business landscape is so complex, they need to simplify.

Take that 200-odd slide deck and condense it all into one page. Having a onepager makes the corporate strategy so much easier to understand, communicate, and execute.

The 80/20 Pareto Principle helps explain the power of simplicity. The principle is alive and well in most businesses:

1. 80% of profits come from 20% of customers.

2. 80% of problems are generated by 20% of employees.

3. 80% of sales are generated by 20% of salespeople.

Staying within this principle encourages clarity. It provides a digestible amount of information tackled by the least educated in the organization. Information will not be read, understood, or listened to if it is not brief and succinct.

Condensing the corporate strategy to a one-pager forces the organization to focus on what is critical. It forces the organization to clarify its thoughts; it forces decisions as to what not to do. There is no more hiding behind words, PowerPoints, or politics.

The one-pager metaphor will remind everyone that simplicity and brevity are essential elements for effective communication at the operational levels.

When things are not simple, there is increased potential for confusion, misunderstanding, and poor strategy execution and performance. There is a likelihood of misalignment of thought, actions, and ultimately leading to underperformance.

Chapter 5 — Framework for strategy execution

Strategy execution will depend on the effectiveness of a framework that comprises of the following components and arrangements, centered on an agile mindset (Chapter 3) and foundations for strategy execution (Chapter 4):

(5.1) Management mandate, commitment, and leadership.

(5.2) Understanding the organization and its context.

(5.3) Establishing communication, , and reporting mechanisms.

(5.4) Implementing:

a. An integrated management system for strategy execution. (chapter 6)

b. The strategy execution process. (chapter 7)

(5.5) Monitoring and review of the framework.

(5.6) Continual improvement of the framework.

Articulate the framework in a dedicated strategy execution plan that sets out how to:

1. Manage the strategy execution process within a specific context, based on specific governance, quality, and compliance requirements and expectations.

2. Integrate the strategy execution process into the fabric and discipline of the organization.

3. Ensure that the strategy execution process and integrated management system for strategy execution are sustainable, effective, and efficient.

Tailor or customize the framework and strategy execution plan to organizational context, culture, and maturity.

5.1 Management mandate, commitment, and leadership

Strategy execution requires strong and sustained governance, leadership, commitment, and mandate by the board and management. This includes prioritization and allocation of adequate financial and non-financial resources and embracing a culture of performance, discipline, and ability.

Leadership within the context of strategy execution comprises the following activities:

1. Promote strategic focus and clarity with:

a. SMART objectives at all levels of the organization, as far as practical.

b. Handful of meaningful key performance indicators that are based on the 80/20 Pareto Principle.

c. Series of team-based initiatives designed to sign up people at every level of the organization by giving them maximum freedom in how to achieve the corporate strategy.

2. Generate engagement and commitment and avoid a vicious cycle of secrecy, blame, isolation, avoidance, lack of respect and trust, and feelings of helplessness.

3. Prioritize, allocate, and commit scarce organizational resources and activities strictly following strategic objectives, and linking budgets, prioritization, and value creation (or preservation) to the corporate strategy.

4. Foster collaboration and teamwork — A collaborative mindset arises when there is alignment and synchronization of the whole system of organizational resources, practices, norms, language, stories, and habits.

5. Create appropriate milestones of achievement — Effectively use key performance indicators to enable and drive each employee to focus on the appropriate milestones and measures of progress and performance.

6. Manage pace, agility, and politics effectively — Employees should be free from the following:

a. Constraints of unnecessary and non-value adding policies, procedures, rules, and regulations.

b. Constant changes and ambiguity to objectives, roles, responsibilities, and priorities (i.e., chaos).

c. Over-engineered and complex processes that do not add any strategic value to the organization.

5.2 Understanding the organization and its context

The design of the framework for strategy execution consists of two components:

1. Understanding the organization and its context. (this section)

2. Establishing communication, , and reporting mechanisms. (Next section: 5.3).

Context is king. It is important to evaluate and understand both the external and internal context of the organization since these can significantly influence the design and effectiveness of the following:

1. Organizational structures and ability line.

2. Individual decision-making capabilities and abilities.

3. Corporate strategy, strategic objectives, and key performance indicators.

4. Framework and integrated management system for strategy execution.

5. Strategy execution plan.

6. Strategy execution process.

7. Change management processes and practices.

Establishing the context will capture the essence of the corporate strategy, the internal and external environment in which organizations pursue their objectives and key performance indicators, and diversity of risk appetite and tolerance thresholds — all of which should help reveal and assess the nature and complexity of their risks and controls.

Changing context should trigger different decisions and strategic initiatives to create or maintain sustainable value for stakeholders.

Organizational context includes:

1. Relationships, perceptions, and values of internal and external stakeholders.

2. Social, political, legal, regulatory, financial, technological, economic, natural, and competitive environment.

3. Key drivers and trends having an impact on the corporate strategy, objectives, and key performance indicators of the organization.

4. Governance and organizational structures, culture, roles, and abilities.

5. Capabilities, understood in of resources and knowledge (e.g., capital, time, people, processes, systems, and technologies).

A critical part of establishing the context is identifying and analyzing stakeholders’:

1. Values.

2. Expectations.

3. Tolerances of and attitudes towards ability, performance, risks, and controls.

Internal controls help an organization get to where it wants to go and avoid pitfalls and surprises along the way. They are actions taken by management, the board, and employees to manage risk and to increase the likelihood that established objectives and goals will be achieved. Management plans, organizes, and directs the performance of sufficient actions to provide reasonable assurance

that objectives and goals will be achieved.

Controls are meaningless without a related or corresponding objective. They should be embedded in activities that enable organizations to achieve their objectives and effectively manage their opportunities and risks.

To understand whether they have the right controls over the right things, executives should start with objectives and the associated risks. There is always a cost associated with implementing a proposed treatment plan or maintaining an existing control.

Controls and treatments can modify risk by changing any source of uncertainty (e.g., by making it more or less likely that something will occur) or by changing the range of possible consequences and where they may occur.

Controls offer several mission-critical benefits to an organization, specifically to:

1. Improve corporate governance.

2. Promote operational efficiency and effectiveness.

3. Manage risks that a linked-to objectives.

4. Ensure reliability and accuracy of financial statements.

5. Ensure compliance with applicable regulations and laws.

5.3 Establishing communication, , and reporting mechanisms

The organization should establish and maintain:

1. Consultation, communication, , and reporting mechanisms with internal and external stakeholders to and encourage commitment, ability, and ownership for strategy execution and organizational performance.

2. Regular monitoring and review of the effectiveness, efficiencies, and quality of these mechanisms.

Monitoring and review are two different things – monitoring is continuous, whereas review occurs periodically.

1. Monitoring is about “continual checking, supervising, critically observing or determining the status to identify change from the performance level required or expected.” (ISO Guide 73:2009) It focuses on efficiency.

2. Review is an “activity undertaken to determine the suitability, adequacy, and effectiveness of the subject matter to achieve established objectives.” (ISO Guide 73:2009) It focuses on effectiveness.

The identification, engagement, and management of stakeholders are important for successful strategy execution. Each stakeholder group has different levels of attitudes and tolerances for risk.

Consult stakeholders (where appropriate and practical) on the frequency, format, and amount of reporting information they want to receive for decision-making, monitoring, and review.

Reporting is an essential component of management, , and ability processes. It provides key decision-makers with crucial information to help steer the organization towards achieving its objectives.

Organizational structure, maturity, and culture may influence the effectiveness of communication and information flows within an organization.

5.4 Implementing the strategy execution process

Apply the strategy execution process through a strategy execution plan. Develop a strategy execution plan as part of strategic planning or strategy formulation activity.

The strategy execution plan may comprise the following:

1. Governance structure, arrangements, and abilities for strategy execution and the strategy execution process.

2. Action agenda for the next 30, 60, or 90 days that specifies who is able for each critical task of the strategy execution plan and how performance against the plan will be measured, monitored, and reviewed.

3. Contextualize the strategy execution framework to the organization, its corporate strategy, culture, and context (internal and external).

4. Information on the corporate strategy, and organizational risk appetite and tolerance.

5. Criteria and mechanisms for cascading and aligning the corporate strategy,

strategic objectives, and key performance indicators throughout organizational levels and across value chains (vertical alignment and horizontal integration).

6. How strategic and operational risks and appetite for risk are identified, assessed, and managed at different levels of the organization.

7. How various management practices and common touchpoints are practically integrated into one coherent management system for strategy execution, especially across the end-to-end value chain.

8. Mechanisms for stakeholder communication, engagement, reporting, and change management.

9. How strategic initiatives and actions are defined and prioritized, linked to the appropriate budget and resource allocations.

10. Criteria and mechanisms for escalating, aggregating, consolidating, and communicating information about performance, risks, controls, and budgets to the level above, right up to the board, and across organizational boundaries and value chains.

11. Continuous performance reporting, , improvement, experimentations, and adaptation.

12. Regular monitoring and review of the effectiveness, efficiencies, and quality of the strategy execution plan and the framework, process, and integrated management system for strategy execution.

Bring together a project team that has the delegated authority to remove institutional barriers and have them think through specific strategy execution issues, risks, and opportunities.

Implementing the corporate strategy also involves managing the strategy execution process, which includes:

1. Monitoring and review of the process, performance, and outcomes.

2. Comparing to actual results, benchmarks, and best practice.

3. Evaluating the effectiveness and efficiency of the process.

4. Controlling for variances and deviations.

5. Making necessary and timely adjustments or changes to the process.

5.5 Monitoring and review of the framework

An effective framework should create the right environment, drivers, and organizational culture for strategy execution and performance. The performance measures for the framework itself should be developed, reviewed, monitored, and reported as part of the integrated reporting process.

Regularly monitor, review, and report on whether the framework for strategy execution and strategy execution plan is sustainable, still appropriate, and effective, given any potential changes to the organization’s context and regulatory environment.

Conduct a comprehensive review of the framework to determine whether:

1. The strategy execution plan is being implemented as planned.

2. The framework and processes adopted are operating as planned.

3. The level of risk is within the criteria and threshold, or in accordance with the organization’s risk appetite statements.

4. Objectives are being positively influenced by the management of

opportunities and risks.

5. Relevant stakeholders are receiving sufficient reporting and information to enable them to discharge their roles, responsibilities, and abilities in the governance structure.

6. People across the organization have sufficient skills, knowledge, capabilities, and competencies to carry out their responsibilities and abilities.

7. Resources and funding are adequate.

8. Lessons have been learned from actual outcomes and experimentations, including losses, near-misses, and opportunities.

5.6 Continual improvement of the framework

Based on the results of monitoring and review, make timely and appropriate decisions on how the framework for strategy execution and strategy execution plan can be improved further to increase organizational effectiveness, capability, and capacity to sustain or enhance the strategy execution process and improve performance.

Use quality management approaches to sustain the framework and process for strategy execution, where appropriate.

To achieve sustained success:

1. Have a long-term planning and strategy execution perspective.

2. Constantly monitor and regularly analyze the organization’s context, competitive advantage, critical success factors, and customer or stakeholder value proposition.

3. Identify all relevant internal and external stakeholders and assess and manage their potential impacts on the organization’s performance, as well as determining how to meet their requirements and expectations in a balanced and cost-effective way.

4. Continually communicate, consult, and engage internal and external stakeholders and keep them informed of and updated on the organization’s activities, projects, plans, and corporate strategy.

5. Establish mutually beneficial relationships with suppliers, partners, and other stakeholders.

6. Make use of a wide variety of approaches, including communication, consultation, negotiation, experimentation, and mediation to balance the oftencompeting perceptions, requirements, and expectations of stakeholders and customers.

7. Identify associated short- and long-term risks (strategic and operational) as well as the appetite and tolerance for risk and deploy activities and controls to mitigate or enhance them.

8. Anticipate future resource requirements (including competencies and skills required of its employees and workforce) and their deployment.

9. Establish processes appropriate to executing the corporate strategy and ensure that it can respond quickly or timely to changing circumstances.

10. Regularly evaluate and ensure compliance with laws, contractual obligations, policies, procedures, and taking appropriate and timely corrective and preventive

actions.

11. Ensure that employees have access to coaching, learning, development, and training programs.

12. Establish and maintain processes for innovation, change management, and continuous improvement.

Continual improvement of organizational performance is interrelated with the continual improvement of risk management performance. Improved risk management, based on risk-based decision-making, can reduce uncertainty in achieving objectives, minimize volatility, and increase agility.

Chapter 6 — An integrated management system for strategy execution

Organizations use a variety of management systems to direct and control their activities to achieve their objectives.

When the organizational structure is complex, the organization needs to develop one robust, practical, yet simplified, integrated management system that will fully integrate the relevant management practices and common touch-points of the business into one coherent and synchronized management system that enables and drives the achievement of its corporate strategy.

Instead of ‘silos’ of disparate systems and practices, this is a genuinely coordinated and synchronized system – one that is greater than the sum of individual parts, collectively achieving more than ever before in of its overall performance and effectiveness.

Integrating is about understanding the common but essential elements or touchpoints of each management practice, its context, purposes, and objectives, and combining or integrating them into a single coherent, integrated management system that fully s and complements each other for the sole purpose of achieving the organization’s objectives and key performance indicators.

Integration does not simply involve introducing established and standardized management tools and processes into existing management systems. It requires the adaptation and alteration of those tools and processes to suit the needs of decision-makers and their existing processes for decision-making.

The integrated management system creates common tools, syntax, data structures, processes, and measures for effective strategy execution. These management practices are a means to an end that should be utilized and maximized strategically for both organizational and individual performance.

Some benefits of implementing an integrated management system include:

1. Ability to create unified objectives and to focus on achieving them.

2. Reduced cost through reduced duplication and maximization of effort and resources.

3. A greater understanding of common control and regulatory requirements.

4. Defined boundaries and abilities around unique roles, responsibilities, and abilities.

5. Increased effectiveness of timely decision-making.

6. Enhanced levels of organizational harmonization, alignment, and synchronization, leading to increased productivity, quality outcomes, and improved performance.

7. Enhanced stakeholder satisfaction through more effective communication, interaction, and confidence in the strategy execution process and organizational performance.

The integrated management system for effective strategy execution may comprise the following management practices:

(6.1) Governance.

(6.2) Planning and stakeholder management.

(6.3) Objective and key performance indicator setting.

(6.4) Portfolio, program, and project management.

(6.5) Resource management and budgeting.

(6.6) Risk management.

(6.7) Human capital management.

(6.8) Knowledge management.

(6.9) Assurance, audits, and independent evaluations.

(6.10) Performance monitoring, review, and reporting.

(6.11) Performance management.

(6.12) Compensation, benefits, and rewards.

(6.13) Change management.

(6.14) Compliance management.

(6.15) Quality management and continuous improvement.

Tailor or customize these management practices to the organizational context and maturity. Organizational governance, structures, and arrangements should fully and enhance the implementation of the integrated management system.

Figure 6.1 below shows the relationship and interdependencies between various management practices within the integrated management system for strategy execution.

An integrated management system required for strategy execution should allow for more effective and efficient communication of information in the following directions:

1. Vertically, either top-down or bottom-up, throughout organizational levels or layers.

2. Horizontally with other business units, departments, sections, projects, and across value-chains and organizational boundaries.

3. Holistically, from an enterprise-wide or portfolio perspective (across the organization).

The strategy execution plan should specifically address the incorporation of relevant management practices into an integrated management system that will enable and fully the strategy execution framework and process.

6.1 Governance

Governance is a guidance system for the achievement of objectives. It provides a logical structure within which management practices operate and are managed and controlled. Parts of this structure may be mandatory and set by legislation, regulation, or listing rules in different jurisdictions, or by policy directives for public sector organizations. Others are discretionary set by boards and management, which can vary from organization to organization, even within the same statutory environment.

Having the appropriate governance structures and arrangements for strategy execution is vital for the success of the organization in its quest to achieve its objectives and ultimately their corporate strategy.

6.2 Planning and stakeholder management

Planning is a critical management practice that involves setting SMART objectives and key performance indicators for the organization, business units, departments, functions, projects, and value chains. They provide the necessary baseline and guide for strategy execution.

Beyond that, plans should be flexible and are constantly adapted to their context to achieve the intended outcomes where organizations value change over strict adherence to the plan (the agile mindset).

Align all plans and processes to the organization’s strategic objectives. In each plan, there will be corresponding objectives and key performance indicators aligned to the overall achievement of the corporate strategy, taking into applicable business-as-usual or stand-alone objectives that have not been cascaded down but appearing uniquely at various organizational levels (level or local objectives).

By actively engaging employees as key internal stakeholders and knowledge workers during strategy formulation and planning, individuals:

1. Know what their important objectives and priorities are, especially from a time-management and prioritization perspective.

2. Can embrace these personal objectives and priorities ‘ionately’.

3. Know what to do through action plans.

4. Have the ability, capacity, resources, and discipline to follow through on them.

Specifically, strategic planning is the process by which an organization:

1. Determines its objectives and key performance indicators.

2. Determines its enterprise-wide risk appetite and tolerance thresholds.

3. Identifies prioritized strategic initiatives necessary to achieve its strategic objectives and key performance indicators and resourcing them accordingly as a sign of management commitment.

4. Understands opportunities and risks associated with achieving its objectives and key performance indicators in line with the organization’s risk appetite and tolerance thresholds.

6.3 Objective and KPI setting

Involving the doers should result in the necessary commitment to perform, guided by objectives and key performance indicators. Executives and the doers should be personally involved in:

1. Day-to-day (operational) or business-as-usual objective and key performance indicators setting.

2. Prioritizing and choosing the required course of action and priorities based on (or linked to) defined corporate strategy, objectives, and key performance indicators that have been cascaded from the level above.

Organizations should develop performance tracking processes based on agreed informational sources and systems.

Reduce performance slack, disengaged employees, and excess capacity through stretched performance targets, appropriate workforce planning, and pay-forperformance reward systems, thereby increasing or maximizing performance.

The issue of disengaged employees can significantly impact organizational performance and strategy execution. When employees are engaged and thriving in their overall lives, they are more likely to maintain strong work performance.

~~~~~~~

6.3.1 It is all about the customer

While most organizations continue to be internally focused on cost, productivity, and processes, high performing organizations’ objectives are related to improving the customer’s experience. Their business objectives include:

1. Providing the right information to the right person at the right time.

2. Finding better ways to interact with customers.

3. Delivering new services or products to customers.

~~~~~~~

6.3.2 Setting high-quality SMART objectives and key performance indicators

Key performance indicator setting is inherently difficult. It takes a while to gather data and validate the key performance indicators’ cause and effect logic (i.e., causal relationship), measures, and targets.

Unfortunately, many organizations have difficulties in quantifying their results or value drivers, especially from a cause-and-effect logical perspective.

Key performance indicators can also lose their validity and reliability when methods used for evaluating non-financial attributes are inconsistent across the organization. For example, an organization cannot track customer satisfaction at the individual client level when the organization tracks employee performance at the business unit level — it is impossible to determine how individual employee performance can directly influence customer satisfaction when the level of analysis is different or inconsistent with each other.

~~~~~~~

6.3.3 Plan results, not activities

Write performance commitments using the SMART test: Objectives or key performance indicators must be specific, measurable, achievable, reasonable, and time-bound. For example, launch three new services by March 20XX for a total of $5 million in incremental revenue by December 20XX.

Once defined with clarity, commitments can positively drive strategy execution to measurable results and create a higher level of focus, ability, and performance.

6.4 Portfolio, program, and project management

Projects are effective means to deliver value to an organization. Project-based organizations are organizing their delivery of projects in the most effective manner, resulting in the emergence of program and portfolio management.

Projects, programs, and portfolios are vehicles to execute the corporate strategy. Collectively, they form a hierarchy of initiates as shown in Figure 6.2 below:

1. A portfolio consists of programs and projects that are managed at an organizational, program or functional level.

Portfolio management is the selection and management of an organization’s projects, programs, and related business-as-usual activities.

2. A program is a temporary, flexible organizational structure created to coordinate, direct, and oversee the implementation of a set of related projects and activities to deliver outcomes and benefits related to the organization’s strategic objectives.

Program management is the coordinated organization, direction, and implementation of a group of projects and activities that together achieve outcomes and realize benefits that are of strategic importance.

Program risks are risks associated with transforming the corporate strategy into shorter-term solutions and outcomes via a collection of projects or programs.

3. A project is a temporary organization that is created to deliver one or more business products and services according to an agreed business case.

Project management is the planning, monitoring, and control of all aspects of the project and the motivation of all those involved in it to achieve project objectives that are on time and to specified cost, quality, scope, and performance.

Project risks are risks relating to the delivery of a product, service, or change, usually within the constraints of time, cost, scope, and quality.

Use a Project Management Office to oversee the management of projects, programs, or a combination of both, focusing on the coordinated planning, prioritization, and execution of projects (and activities) that are linked to strategic objectives.

The goals of portfolio management include:

1. Portfolio value maximization.

2. The alignment with and achievement of strategic objectives.

3. Portfolio balancing of individual components within the portfolio, especially within the boundaries of risk appetite and tolerance thresholds.

6.5 Resource management and budgeting

If a corporate strategy is important, then executives must communicate this fact not only through words but also through actions. Proper allocation of resources through budgets will speak volumes in the business world that shows a ive organization that does not pay lip service.

Budgets can serve at least six key functions if done correctly:

1. Setting targets.

2. Aligning incentives.

3. Developing action plans.

4. Allocating resources.

5. Coordinating across all functions.

6. Monitoring and controlling finances.

Resource management is the efficient and effective allocation and deployment of appropriate and sufficient organizational resources to :

1. Each level of ability and authority.

2. Individuals in achieving the required outcomes and strategic objectives.

Organizations should continuously optimize their cost structure and approach to resource allocation and invest in capabilities critical to organizational success and strategic performance, while proactively minimizing or cutting costs in less critical or non-strategic areas to fund these strategic investments. It is about positively linking their strategic growth and cost agendas, not just cost-cutting.

When resources are allocated from the bottom up instead of from the top down, they get out of sync with what the board is trying to accomplish. For example, the total cash investment in acquisitions, R&D, and fixed assets have not earned back its cost of capital for many organizations because of wrong allocation or ineffective strategy execution.

As with plans, constantly review and adapt budgets to the ever-changing context and competitive environment. Flexible resourcing and budgets are required based on the agile mindset.

Prioritize and resource all strategy-focused initiatives and activities. Note the following linkages:

1. Link cross-organizational strategic initiatives to a dedicated strategic expenditure (STRATEX) budget. Protect that strategic money (or allocation) by creating special rules for allocating them. The CEO is the budget holder for this strategic budget. Strategic initiatives are organizational-wide programs and projects outside the organization’s day-to-day or business-as-usual operational activities, managed by dedicated strategic owners. All business units and functions should participate collaboratively as a team in at least one strategic initiative.

2. Link operational activities, projects, and programs to day-to-day strategyfocused:

a. Operational expenditure (OPEX) budgets.

b. Capital expenditure (CAPEX) budgets.

3. Link future forecast for operating and capital expenditures to the strategy execution plan where there should be allocation of sufficient resources in the future.

4. Link controls to objective-focused risks where there will be allocation of adequate resources for implementing risk treatment plans and maintaining existing controls.

Adopting a rolling forecast to supplement existing approaches or, in some cases,

to replace less-effective alternatives can help organizations become more agile and more adaptive.

Manage discretionary and non-discretionary spending separately by adopting zero-based budgeting that determines the minimum amount of non-discretionary expenditures needed to ‘keep the lights on’ throughout the organization.

Create a separate rolling budget, a discretionary expenditure pool that can be allocated over the year rather than at a single point in the calendar. This flexibility is particularly important for volatile emerging markets and cyclical industries, where the benefits of moving resources quickly are often high. The rest of the spending should go towards strategic initiatives, based on strategic investment guidelines.

One of the most difficult parts of allocating resources is getting out of businesses that have served the organization well in the past but are now stagnant or not performing. One useful approach is for the organization’s investment committee (or similar) to conduct a formal exercise at least once a year imagining that the organization is not in any of its businesses and then to ask whether the market fundamentals would make investments in each of them compelling.

Even without moving capital or people, organizations can shift management’s emphasis dramatically by taking a clean-sheet approach to the way executives spend their time.

Set a time ‘budget’ for executives to clarify how much leadership capacity exists to ‘finance’ initiatives and whether management is focused on the highest strategic priorities.

~~~~~~~

6.5.1 Procedural justice required

The importance of procedural justice in developing, executing, and implementing the strategy execution plan should not be understated.

Procedural justice concerns the fairness and transparency of processes when making decisions about resource allocations (not specifically to the outcomes themselves). Fair processes lead to intellectual and emotional recognition, which leads to trust and commitment, which leads to voluntary cooperation in strategy execution.

A fair process requires engagement, explanation, and clarity of expectations and performance.

6.6 Risk management

Manage opportunities and risks within the context of achieving objectives and within organizational risk appetite and tolerance thresholds. The organization’s risk appetite and tolerance determine the type and amount of risk an organization is willing and able to accept in pursuit of its objectives.

Risk management is the foundation for the organization’s control environment and sound corporate governance to achieve its objectives. The management of risk is part of each objective at all levels of the organization. It develops costeffective risk treatment plans that are at the same time the controls associated with achieving each objective.

Effective risk management is about ensuring an organization’s sustainably and success through:

1. Managing the opportunities and risks that the organization can control regardless of how they may be defined, both good and bad.

2. Adapting to risks that the organization cannot control.

Apply the principle of cascading responsibility for performance to risk management. The underlying aim is to ensure that at all levels of the organization, all employees:

1. Understand the applicable risk appetite and tolerance thresholds in their area of responsibility and for the whole organization.

2. Are aware of the key risks and controls that may affect organizational performance and achievement of corporate strategy and strategic objectives especially in the area they are able for.

3. Take responsibility and ability for the management of those objectivefocused risks and associated controls and budgets.

4. Manage, monitor, and review performance, risks, controls, and budgets.

Risk management provides the foundation for informed decision-making. The value of risk management is that it enables decision-makers across the organization to make better quality, timely, and risk-informed decisions that are within the acceptable levels of risk. These decisions drive performance and should be the basis for every employee’s compensation and rewards.

The risk management process maintains the appropriate risk-based control environment that provides reasonable assurance to the board and management that objectives will be achieved within an acceptable degree of residual risk.

Reporting against performance measures and targets for each objective is also a report on the effectiveness of controls and the risk management process for that objective. Risk management reporting is an integral part of performance

reporting and it is not a separate exercise.

Risk management deals with threats and opportunities affecting the organization’s value creation (or preservation). It facilitates:

1. An enterprise-wide view of risks and controls gained at a strategic level linked to the achievement of strategic objectives.

2. A common understanding and management of these key enterprise-wide risks and controls, and the overall level of risk exposure, risk appetite, and the control environment within the organization.

3. An integrated but synchronized response to multiple risks across the organization, especially from a holistic perspective.

4. An effective organizational-wide response to the potential interrelated impacts, threats, and opportunities.

5. Achievement of strategic objectives and key performance indicators within the board-approved corporate risk appetite and tolerance thresholds.

An effective risk management that will enable:

1. Every employee to understand the organization’s risk appetite, risk tolerance, performance targets, and where are the ‘edges of the envelope’ for each business line, product, geographic unit, and value chain.

2. Every employee to operate at or near the ‘edges of the envelope’ without crossing the line, where risk-takers (e.g., executives) take measured risk without crossing the line and risk-averse employees (e.g., doers) take on more measured or acceptable risk to reach the line.

3. Employees to raise issues (known knowns) and identify risks (known unknowns) for discussion and management without fear of repercussions within a positive organizational culture of mutual trust and respect.

4. Fearless and objective reporting of performance (or non-performance), variances, compliance, budgets, and lessons learned.

5. Every business unit within the organization to assess, monitor, and consistently manage residual risks..

There needs to be greater opportunities and abilities for managing operational risks and controls at lower organizational levels, leaving executives to manage strategic risks and controls that matter most to the organization.

Strategic risk cannot be delegated easily by the CEO to the departments such as health and safety, insurance, or treasury. These risks should remain the CEO and the board’s priority risk issue.

Organizations should be selective by prioritizing and concentrating on key strategic and operational risks and controls that they can reasonably control and resource, thereby giving them the required strategic value or competitive advantage.

~~~~~~~

6.6.1 Risk-focused controls and control environment

Organizations must have the necessary control environment to enable them to implement their corporate strategy and achieve their objectives.

Link controls to risks. They provide the necessary organizational value and reasonable assurances that objectives can be achieved within an acceptable degree of residual risk and risk appetite.

Organizational risk appetite should determine the appropriate balance between risks and controls. This is integral to the decision-making process. Too many controls may limit the organization from achieving its objectives and key performance indicators.

The control environment is “the attitude and actions of the board and

management regarding the importance of control within the organization. The control environment provides the discipline and structure for the achievement of the primary objectives of the system of internal control. The control environment includes the following elements: integrity and ethical values; management’s philosophy and operating style; organizational structure; assignment of authority and responsibility; human resource policies and practices; and competence of personnel.” (Institute of Internal Auditors Research Foundation, 2011)

There are two common types of control environment:

1. Risk-focused control environment where there are systematic decision-making processes to prioritize control activities and deploy resources based on the level of risk.

2. Compliance-based control environment where potentially costly, complex, and inflexible layer-upon-layer of over-engineered controls are created and maintained to meet the needs of multiple stakeholders and regulatory requirements.

In a risk-focused control environment, the organization’s key performance indicators and risk appetite threshold define the level of control environment that is required for implementing its corporate strategy.

From a cost-benefit perspective, organizations cannot practically determine the required controls without knowing their risk appetite and the risks that may affect the achievement of their objectives.

The risk management process considers the effectiveness of existing controls. Where existing controls (e.g., strategic and operational controls) are ineffective, risk treatment plans are developed and implemented to strengthen existing controls and the control environment. Once implemented, risk treatments provide the necessary controls.

When deg risk treatments, there should be consideration of how the performance of the resulting controls will be monitored and made available to future decision-makers, who may be relying on those controls to achieve their objectives.

After identifying the key risks and risk appetite threshold for their objectives, develop and implement cost-effective risk treatments using project management methodologies to mitigate or enhance the identified risks and strengthen the control environment so that the organization can achieve its objectives.

Build segregation of duties and authorization limits and controls into the selection and development of control activities.

Allocate adequate resources to ensure that key controls are operating effectively. Treatment owners are to implement proposed risk treatments within an agreed timeframe, cost, and specifications. Regularly monitor, review, and report on the implementation status of all proposed risk treatments.

There may be the implementation of business-as-usual, regulatory, or contractual operational controls unrelated to risks or achievement of strategic objectives. Where practical, limit these with business process re-engineering initiatives and process automation using the appropriate technologies and systems.

~~~~~~~

6.6.2 Risk escalation

Risk escalation is an important management practice for knowing and understanding the key risks (or emerging risks) by people with the authority to manage them (usually at the higher organizational level).

Emerging risks are risks that are new or already known but are difficult to assess or quantify.

It is not appropriate for managing risks at the operational or lower level if they pose an extreme risk to the organization and require the allocation of substantial strategic risk treatment resources. Where a risk poses a very high threat to the organization, especially when the residual risk is beyond pre-defined organizational risk appetite or tolerance threshold, inform the board immediately without exceptions.

Risk escalation should be a transparent and objective process of communicating vital information to the attention of higher management (or board) based on predefined and agreed risk escalation criteria and thresholds. Include the criteria in the organization’s risk management policy or plan.

A risk management plan specifies the approach, management components, and resources for the management of risk.

~~~~~~~

6.6.3 Risk aggregation

Risk aggregation is the “combination of some risks into one risk to develop a more complete understanding of the overall risk” (ISO Guide 73:2009) that is directly related to the corporate strategy and strategic objectives.

For example, take a higher objective-focused risk profile view of a group of risks and compute its aggregated level of risk, which is the combination of consequence and likelihood, as a single-risk rating.

A risk profile is the organization’s documented understanding of risk exposures. It effectively informs management about the appropriate allocation of resources for the control of identified risks.

Risk aggregation is not widely used, unfortunately.

Information from lower-level risk s may be rolled up or aggregated upwards based on root causes, themes, or common elements. Connect them by

way of risk aggregation mechanisms and organizational structures with the key purpose of developing a strategic or higher-level risk profile or risk rating that is linked to corporate strategy and objectives. The level of analysis becomes important.

Organizations may assess levels of exposure through risk aggregation across:

1. The entire organization (enterprise-wide).

2. Product or service lines.

3. Customer or stakeholder groups.

4. Geographical locations.

5. Business units or departments.

6. Value chains and processes.

~~~~~~~

6.6.4 Issue management

Distinguish and manage risks and issues appropriately where:

1. (Known unknowns) Risk is the effect of uncertainty on objectives and should it occur, may affect (positive or negative) the achievement of objectives — e.g., a widespread pandemic may impact vaccine supply. Risk should be described as the combination of the likelihood of an event (or hazard or source of risk) and its consequence and should not be described as an event.

2. (Known knowns) Issue is an event that has already occurred and is known, where it is not planned, requires management action, and has an impact upon the achievement of objectives — e.g., development of immunization policy did not have the full engagement of all stakeholders.

6.7 Human capital management

Manage and employees so that they can positively contribute to the overall effectiveness and efficiencies of the organization. Human capital management includes the process of acquiring, training, managing, retaining, and exiting employees.

From a strategic perspective, it is about linking the workforce (people and culture) and the people and culture function to strategic objectives to enable and improve performance and develop a positive culture that fosters innovation, flexibility, change, and competitive advantage.

There are opportunities, uncertainties, and risks in 22 workforce practices that are foundations for better organizational performance:

1. Staffing – Establish a formal process by which committed work is matched to resources and qualified individuals are recruited, selected, and transitioned into assignments and jobs.

2. Communication and coordination – Establish timely communication and interaction throughout the organization. Ensure that the workforce has the skills to share information and coordinate activities efficiently.

3. Work environment – Establish and maintain physical working conditions and

to provide resources that allow individuals, teams and workgroups to perform their tasks efficiently without unnecessary distractions.

4. Performance management – Establish objectives related to committed work against which team and individual performance can be measured, to discuss performance and progress against these objectives, and to continuously enhance or improve performance.

5. Training and development – Ensure that all individuals have the skills required to perform their assignments and are provided with relevant training and development opportunities.

6. Compensation – Provide all individuals with remuneration and benefits based on their contribution and value to the organization.

7. Competency analysis – Identify the knowledge, skills, and process abilities required to perform the organization’s business activities so that they may be developed and used as a basis for workforce practices.

8. Workforce planning – Coordinate workforce activities with current and future business needs at both the organizational and workgroup levels.

9. Competency development – Enhance constantly the capability of the workforce to perform its assigned tasks and responsibilities.

10. Career development – Ensure that individuals are provided opportunities to develop workforce competencies that enable them to achieve career objectives.

11. Competency-based practices – Ensure that all workforce practices are based in part on developing the competencies of the workforce.

12. Workgroup development – Organize work around competency-based process abilities.

13. Participatory culture – Enable the workforce’s full capability for making informed decisions that affect the performance of business activities and the achievement of objectives.

14. Competency integration – Improve the efficiency and agility of interdependent work by integrating the process abilities of different workforce competencies.

15. Empowered workgroups – Empower workgroups with the responsibility and authority to determine how to conduct their business activities most effectively to achieve business objectives.

16. Competency-based assets – Capture the knowledge, experience, and artefacts developed in performing competency-based processes for use in enhancing capability and performance.

17. Quantitative performance management – Predict and manage the capability of competency-based processes for achieving measurable performance objectives and outcomes.

18. Organizational capability management – Quantify and manage the capability of the workforce and of the critical competency-based processes it performs.

19. Mentoring – Transfer the lessons of greater experience in a workforce competency to improve the capability of other individuals or workgroups.

20. Continuous capability improvement – Provide a foundation for individuals and workgroups to continuously improve their capability for performing competency-based processes that are aligned with organizational strategy and outcome.

21. Organizational performance alignment – Enhance the alignment of performance results across individuals, workgroups, and team with organizational performance and business objectives.

22. Continuous workforce innovation – Identify and evaluate improved or innovative workforce practices and technologies and implement the most promising or effective ones throughout the organization.

6.8 Knowledge management

Knowledge management is a discipline that promotes an integrated approach to identifying, capturing, evaluating, retrieving, and sharing all an organization’s information assets. These assets may include databases, documents, policies, procedures, and previously uncaptured expertise and experience in individual workers.

Strategy formulation and execution is a constant learning and improvement process for the organization. The quality of strategy and its execution depends on the quality of the organization’s learning, improvement, and mechanisms, and the quality and availability of information used for decisionmaking, adaptations, and experimentations.

Organizations should strategically use their information resources and knowledge assets by ing and applying experience, lessons learned, and business intelligence, and putting all these into good use while formulating and executing the corporate strategy.

6.9 Assurance, audits, and independent evaluations

Assurance is a term that usually describes the methods and processes employed by an assurance provider to evaluate an organization’s disclosures about its performance as well as underlying systems, data, and processes against suitable criteria and standards to increase the credibility of the disclosure.

Assurance increases the likelihood of achieving objectives and key performance indicators within an acceptable degree of residual risk, and risk appetite and tolerance thresholds. The level of assurance is reliant on the effectiveness and maturity of controls and the control environment.

~~~~~~~

6.9.1 The internal audit function

As part of the organization’s independent assurance activities, the internal audit function must align its focus and activities to key strategic risks and controls and assist the organization to achieve its objectives.

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s performance and

operations. It helps an organization to accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.

Internal audit should actively work with management to systematically review systems, processes, and operations, and identify how well risks, appetite for risks, and controls are managed strategically, including whether the right processes are in place and agreed procedures and controls are being adhered to.

From the perspective of strategy execution, there are three aspects of the internal audit function:

1. Evaluation of effectiveness and efficiencies — Establish performance criteria for the framework, process, and integrated management system for strategy execution and assess their success and performance in achieving the objectives.

2. Audit for quality and improvements — Actions should meet pre-agreed or intended specifications or requirements. Strategic projects or initiatives should follow established lead times and terminate without exceeding the planned amount of resources. Stakeholders should also be satisfied with how the execution process took place.

3. Audit for compliance — Audit to determine whether the organization followed the rules-of-the-game or compliance requirements.

The internal audit strategy describes the role of internal audit within the organization’s overall assurance strategy and provides an important link between

the internal audit charter and detailed internal audit work plan.

The internal audit work plan can be yearly or on a 12-month rolling basis that is monitored and reviewed quarterly.

~~~~~~~

6.9.2 Value-added auditing

Organizations need to implement risk-based auditing or value-added auditing where the auditor is responsible for providing senior management and even the board reasonable assurance that:

1. SMART objectives had been deployed or cascaded across the organization (vertical alignment) and into the value chains (horizontal alignment).

2. Strategic objectives are being achieved within acceptable levels of risk.

3. Applicable laws and regulations are being complied with.

~~~~~~~

6.9.3 Organization-wide assurance mapping

Align all assurance activities to the corporate strategy and strategic risks through a comprehensive assurance mapping process that determines where key risks and controls lie within the organization.

An organization-wide assurance map of all assurances and reviews conducted by independent parties can effectively prioritize resources to close potential assurance, control, or performance gaps linked to key risks, controls, and strategic objectives. Assurance mapping exercises can involve the mapping of assurance activities and coverage against one or more of the following: (Refer to Figure 6.3 for an example of an assurance map of functions)

1. Corporate strategy.

2. Strategic objectives and key performance indicators.

3. Key strategic risks and controls.

4. Critical business functions, processes, and value chains.

6.10 Performance monitoring, review, and reporting

Performance reporting is important for understanding how effective and efficient the organization is performing so it can:

1. Continuously and regularly evaluate and adapt its objectives and key performance indicators to achieve its corporate strategy.

2. Make timely adjustments and improvements as necessary.

3. Drive organizational and individual learning and improve performance.

Performance reports may cover the following:

1. Progress towards the achievement of objectives.

2. Performance tracking against measures and agreed to targets.

3. Financial performance and budget variances.

4. New and emerging risks and issues.

5. Level of risk against risk appetite and tolerance thresholds.

6. Implementation progress of performance plans, risk treatments, and audit recommendations (internal and external).

Develop a calendar of events as shown in Figure 6.4 below.

~~~~~~~

6.10.1 Integrated reporting is vital for value creation (or preservation)

Organizations should have an integrated report generated from a fit-for-purpose integrated reporting system that concisely consolidates, aggregates, and communicates how their performance, corporate strategy, governance, risk, controls, and resource utilization have resulted in the positive creation (and maintenance) of value over the short-, medium-, and long-term.

An integrated report should provide insight into the organization’s strategy, and how that relates to its ability to create value in the short, medium, and long-term. It should also show as a comprehensive value creation story, the combination, inter-relatedness, and dependencies between the components that are material to the organization’s ability to create value over time.

The integrated reporting system should consolidate the common reporting elements and stakeholder requirements across the entire organization. This should simplify the reports and reporting processes, thereby consuming fewer resources and employees’ time.

Reports generated or produced must create value for the recipient and contributes positively to quality decision-making.

~~~~~~~

6.10.2 Automation

Employees can spend significant amounts of time reporting status and giving updates. Without automated systems and simplified processes, paper-based reporting is ineffective in the long term.

Improving information technology and management capacity and capability should help organizations integrate a growing body of more granular, useful performance information into management reports, thereby making it easier to organize information for analysis and decision-making and streamlined integrated reporting.

Data mining and analytics technologies and scenario-planning capabilities can make it easier for organizations to identify impending risks and issues and improve performance.

6.11 Performance management

Performance management is a cyclical process aimed at tracking and improving the intended performance of employees. This ensures the alignment of individual employees’ activities and performance with the corporate strategy, strategic objectives, and key performance indicators. This includes personal development objectives and plans.

Link employees’ performance objectives, compensation, benefits, and rewards to corporate strategy and its successful performance.

At the highest level, the CEO (or equivalent) is personally able to the board (or able officer) for the successful execution of the corporate strategy, measured by high-quality, long-term corporate key performance indicators that are also closely linked to how executives are adequately compensated for performance improvement and acceptable risk-taking. The organization’s strategic key performance indicators could also be the CEO’s performance indicators, where appropriate.

Likewise, business unit managers are personally able for the successful execution of the business unit strategies that have been cascaded from the corporate strategy. Process managers or owners are personally able for processes, and project managers are personally able for the successful implementation of assigned projects. These able persons (e.g., business unit managers, process managers, etc.) should positively add tangible value to the success of the CEO’s performance in executing the corporate strategy.

However, if there are portions of non-attributable business unit’s activities to a business unit manager, especially due to reporting lines or organizational structure, then the business unit’s performance scorecard is not also the business unit manager’s scorecard. Develop a separate business unit manager’s scorecard.

6.12 Compensation, benefits, and rewards

Apart from performance management, compensation, benefits, and rewards are an integral part of people and culture practices that help in rewarding and motivating employees and improving organizational effectiveness and performance.

Compensation is all forms of pay and benefits are indirect financial and nonfinancial payments arising from an employee’s employment with the organization.

Organizations should make every effort to:

1. Link the achievement of strategic objectives to compensation, benefit, and reward strategies and systems.

2. Recognize and reward calculated and acceptable risk-taking as well as objective achievement.

When times are hard, it is equally hard to keep and motivate employees by routinely upping their pay. Many studies suggest that for people with ‘good’ salaries, non-financial incentives work better (i.e., praise from executives, leadership attention, a chance to lead projects, etc.).

6.13 Change management

Managing change and transition are the essences of any strategy, where:

1. Change is situational (e.g., new boss, the new technology, the new building).

2. Transition is the psychological process people go through to come to with the new situation or change.

This implies that there will always be change and transition for everyone in the organization when the corporate strategy is executed. With every change or transition, employees would want to know how change affects their day-to-day workflow, tasks, and responsibilities.

Change management addresses the human risks in strategy execution. It is about successfully transitioning individuals, teams, and the organization to a desired future state as articulated by the corporate strategy.

Within the context of strategy execution, when employees think about their jobs differently by learning new competencies and demonstrating different behaviors and mindsets, the rate at which they adapt and perform the necessary change and transition will dramatically improve the likelihood of achieving the objectives.

6.14 Compliance management

Organizations manage regulatory and compliance risks by doing the following:

1. Maximize any competitive advantages and opportunities that may arise.

2. Minimize any negative outcomes or reputational risk from non-compliance.

Organizations can strategically transform compliance into a source of competitive advantage. This may seem highly improbable at first sight when organizations face an expensive and burdensome array of new regulations. But those new regulations are an opportunity to claim industry leadership as everyone will be in the same boat.

Compliance is an outcome of an organization meeting its obligations that should be aligned to the organization’s overall strategic objectives and risks. These are rules of the game that organizations must follow and maximize to win the game and become more competitive.

Organizations can perform more effectively (i.e., create or capture more value or better manage risks) when they comply with applicable laws, search for innovative opportunities created by regulation and deregulation, and proactively anticipate future regulation. They can also reduce potential reputational risk to their organization due to poor compliance.

All regulatory and compliance activities should be risk-based. This ensures that prioritized resources are devoted to those high-risk obligations and compliance that have the most impact on the achievement of strategic objectives. There need to be processed for informing the management and board of all significant or potentially significant:

1. Regulatory and compliance obligations, failures, risks, and issues.

2. Corrective and preventive actions and activities that are being implemented.

Adopting a risk-based approach to managing regulatory and compliance risks should result in:

1. Improved outcomes with treatments and controls prioritized to deal with the most significant risks (e.g., reputational risks) and issues.

2. Efficiency gains as resources are strategically prioritized and used where they will most likely improve compliance outcomes and organizational performance.

3. Reduced regulatory and compliance costs or increased opportunities.

4. Better for compliance as processes are clear and cost-effective.

5. Risks and issues being managed in a prioritized way.

Executives should work collaboratively with those responsible for compliance to ensure understanding, assessment, and management of compliance-related risks. This includes possible reputation risk, potential loss of customer confidence, and business disruption risk.

Too many organizations put a Band-Aid on the obvious wound without making the necessary investments to fix the underlying compliance problem.

6.15 Quality management and continuous improvement

Quality management is the process of meeting the quality or requirements expected by stakeholders. The quality of something can be determined by comparing a set of inherent characteristics with a set of requirements. If those inherent characteristics meet all requirements, high or excellent quality is achieved. If those characteristics do not meet all requirements, a low or poor level of quality is achieved.

From the perspective of strategy execution, use quality management to:

1. Prioritize quality or improvement projects that are strategic, value-adding, and have the highest positive impact on the achievement of objectives and performance.

2. Develop and improve the strategy execution plan, objectives, and key performance indicators.

3. Improve the quality of integrated reports and reporting systems and processes.

4. Improve the framework, process, and integrated management system for executing the strategy.

5. Ensure necessary compliance with requirements of laws, industry and organizational standards and codes, principles of good governance and accepted community and ethical standards.

6. Streamline the number of key controls required, thereby improving the effectiveness of the controls and control environment.

7. Reduce waste and improve the value.

8. Sustain organizational success and performance.

There are various triggers for continuous improvement, including the following:

1. Routine monitoring and review of the framework and process for strategy execution, which identifies opportunities to improve.

2. New knowledge and research findings become available.

3. A substantive change to the organization’s internal and external context.

Chapter 7 — Process for strategy execution

The strategy execution process is a key component of the framework for strategy execution and comprises the following activities that operationalize the integrated management system:

(7.1) Establish governance over the process.

(7.2) Communication, consultation, and collaboration.

(7.3) Establish the context (including developing the strategy execution plan).

(7.4) Stakeholder engagement and management.

(7.5) Translate and cascade the corporate strategy and objectives.

(7.6) Determine capacity and appetite for risk.

(7.7) Identify and assess risks.

(7.8) Measure project and portfolio performance.

(7.9) Develop an enterprise-wide view of performance, risk, and control effectiveness.

(7.10) Improve governance, risk management, and controls.

(7.11) Continuously monitor and review performance and strategic assumptions.

(7.12) Reward performers and deal positively with underperformers.

Tailor or customize these activities to your organizational context and maturity. These activities are not sequential. The process for strategy execution should be fit for its purpose and relevant to the achievement of the corporate strategy and strategic objectives.

7.1 Establish governance over the process

Oversight, authority, and ability for the strategy execution process are critical. This ensures that there are commitment and resources allocated, and the execution and evaluation of the process for strategy execution.

The board is a sponsor of the strategy execution process. It should designate an appropriate process owner at the executive level who will be ultimately and solely able.

Roles, responsibilities, and abilities for strategy formulation and execution should be clearly articulated within a delegation matrix using decision-making tools like RAPID, which ask these key questions:

1. Who should recommend a course of action on a key decision?

2. Who must agree to a recommendation before it can move forward?

3. Who will perform the actions needed to implement the decision?

4. Whose input is needed to determine the decision’s feasibility?

5. Who decides or brings the decision to closure, commits the organization to implement it, and is ultimately able for its success or failure?

7.2 Communication, consultation, and collaboration

Communication and consultation are the continual and iterative processes that an organization conducts to do the following:

1. Provide, share, or obtain information for decision-making.

2. Actively engage in dialogue with internal and external stakeholders.

3. Effectively coordinate actions and strategic initiatives throughout and across the organization.

This should facilitate truthful, relevant, accurate, and understandable exchanges of information that create value for the stakeholder, considering privacy, confidentiality, and integrity aspects.

Perceptions can vary due to differences in values, needs, strategic assumptions, and concerns of stakeholders. As perceptions and views can have a significant impact on decisions made, stakeholders’ requirements should be identified, recorded, and considered in the information-gathering and decision-making processes.

The following questions can keep an organization in check in of its current perceptions about the corporate strategy and strategy execution:

1. Dominating ideas — What are our dominating ideas?

2. Boundaries — What are the boundaries you need to be aware of?

3. Assumptions — What assumptions are you making or accepting?

4. Essential factors — What are the essential factors of success?

5. Avoidance factors — What must you avoid going forward?

Collaboration is working with each other to do a task and to achieve shared objectives, sharing information where appropriate.

Avoid promoting cross-unit collaboration for collaboration’s sake. Internal collaboration can deliver tremendous benefits: it can also backfire if its costs prove larger than expected.

Key question – Would the return exceed the combined opportunity and collaboration costs? Initiate a collaboration project only if the answer is ‘Yes’.

7.3 Establish the context (including developing the strategy execution plan)

By establishing the context and understanding of the organization’s maturity or lifecycle, the organization could effectively articulate the corporate strategy, objectives, and key performance indicators, and adequately define the external and internal parameters and operating environment to be considered when executing its strategy and managing its risks, controls, and budgets.

At the foundation of effective management is the fundamental truth that all organizations, like all living organisms, have a lifecycle and undergo very predictable and repetitive patterns of behavior as they grow, mature (develop), and die. At each new stage of development, an organization is faced with a unique set of challenges. How well or poorly management addresses these challenges and positively leads a healthy transition from one stage to the next has a significant impact on the success or failure of their organization.

One such organizational lifecycle is the Adizes Organizational Lifecycle shown below. There are many variations of this lifecycle that you can use to determine your organizational context and maturity.

At each stage of the lifecycle, there are different management approaches that you can take. It must not be a one-size-fits-all management system.

For example, organizations at Prime:

1. Is guided by the vision of its reason for being. There is a clear purpose and people know what they will do, and will not do, “they walk their talk”.

2. Operates in a focused, energized, and predictable manner, where stretch goals are set, aligned, and consistently achieved.

3. Knows what to do, and what not to do – priorities are clear. It enjoys a certain composure and peace of mind when making tough decisions.

4. The entrepreneurial spirit is fully institutionalized. Evidence of organizational fertility abound. This creativity repeatedly produces controlled, profitable innovation.

The problems faced organizations at Prime include:

1. Senior management is in a continuous struggle to maintain the delicate balance between flexibility and control. This is because flexibility and self-

control are incompatible and there is no stable equilibrium. Sometimes the Prime organization is more flexible than controllable, and sometimes it’s not flexible enough.

2. Don’t have enough good people to run all their business units.

3. Being complacent. Prime is a temporary condition, not a permanent destination. The organization cannot simply reach Prime, sit back, and rest. Management must proactively work to promote activities that retard aging and sustain the vitality of Prime.

The agility mindset is the understanding that the context and lifecycle by which the organization executes its strategy and makes the timely decision is based on the best available information.

Consider stakeholders’ concerns and perceptions when developing the corporate strategy and strategy execution plan. This includes understanding the board’s appetite and capacity for risk.

7.4 Stakeholder engagement and management

Stakeholder engagement is the process used by an organization to engage relevant stakeholders for a purpose to achieve accepted outcomes.

Stakeholder management involves getting the required and commitment of those instrumental (i.e., stakeholders) in achieving (or preventing the achievement of) the corporate strategy and strategic objectives and who may influence the outcome of decisions.

Engaging stakeholders, especially the doers, from the beginning at the strategy planning or formulation stage should increase the likelihood that they and implement the key decisions made, resulting in stakeholder commitment and buy-in during strategy execution.

Quality stakeholder engagement can:

1. Enable better management of risk and reputation.

2. Allow for the pooling of resources (knowledge, people, money, and technology) to solve problems and reach objectives that cannot be reached by single organizations.

3. Enable the understanding of the complex operating environments, including market developments and cultural dynamics.

4. Enable learning from stakeholders, resulting in product and process improvements.

5. Inform, educate, and influence stakeholders to improve their decisions and actions that will have a positive impact on the organization.

6. Contribute to the development of trust-based and transparent stakeholder relationships.

Establishing stakeholder relationships require organizations to:

1. Determine the nature and extent of stakeholder relationships.

2. Develop activities for communication, consultation, engagement, collaboration, and reporting.

3. Establish and implement a stakeholder engagement, communication, and consultation plan.

4. Monitor and report key stakeholder relationships and their effectiveness.

Gain an understanding of stakeholders’ perceptions, requirements, and expectations by determining the sort of influence and intensity they may have on organizational objectives and key performance indicators.

7.5 Translate and cascade the corporate strategy and objectives

Translate and cascade clearly defined corporate strategy and customer value proposition into measurable day-to-day (operational) short-term objectives, key performance indicators, and action plans relevant for all employees and teams within the organization.

Make ability and responsibilities clear and precise based on organizational structure, culture, reporting lines, and maturity.

~~~~~~~

7.5.1 Align strategies with corporate vision and mission

All strategies (e.g., corporate and business units) should be aligned to and fully the organization’s Corporate strategy. The corporate strategy refers to how the organization defines and sharpens its basic character and vision. It builds a sense of purpose amongst employees and creates personal commitment to the mission, vision, and overall strategy of the organization.

~~~~~~~

7.5.2 Cascade the corporate strategy

The central element of formulating the corporate strategy is the development of a clearly articulated strategic plan. Translate and cascade the strategic plan into lower-level sub-plans (e.g., business unit plans, operational plans, project plans, etc.) within a given hierarchy of plans.

Translate and cascade strategic objectives and key performance indicators that are contained in the strategic plan as lower-level strategies (e.g., business unit strategy), objectives, and key performance indicators within a given hierarchy of objectives.

Business unit strategy refers to the competitive strategy of a particular business unit within the organization.

Figure 7.1 below provides an overview of the cascading process within the hierarchy of objectives.

Translate and cascade the strategic objectives as:

1. Business unit strategies.

2. function strategies.

3. Operational objectives that include business-as-usual or stand-alone objectives relevant to organizational levels or jobs.

4. Program and project objectives.

5. Process and value chain objectives.

6. Objectives for individual employees.

Individuals should be able for their performance objectives and key performance indicators, which comprise the following:

1. Selected cascaded top-level objectives and key performance indicators.

2. Specific business-as-usual or stand-alone objectives and key performance indicators that are only relevant for that individual, team, project, or business unit and not part of any higher-level objectives and key performance indicators.

Individuals should check that the weighted or prioritized objectives and key performance indicators for which they are able do not:

1. Contradict each other so that they are vertically and horizontally aligned and synchronized.

2. Overlap with each other, avoiding blurred or inconsistent responsibilities and abilities.

3. Undermine the priority given to strategic objectives, key performance indicators, and strategic initiatives, thus losing focus and direction on what is important strategically to the organization.

4. Over-measure by keeping the number of key performance indicators to a minimum, telling a compelling and concise investment and value creation story (be mindful of the 80/20 rule).

Having a clear value creation story and knowing the logical cause and effect strategic linkage or causal relationships are crucial steps to achieving success. Moreover, when people encounter a story-doing organization, they often want to tell all their friends about it.

The value creation story can also be told to your stakeholders and customers. And if it resonates with them emotionally and it is easy to , they will rave about it.

~~~~~~~

7.5.3 Align and prioritize all organizational activities to the corporate strategy

Monitor and review every activity, project, and program (other than the most functional) against its relevance and linkage to the corporate strategy, strategic objectives, and key performance indicators.

Execute strategies and objectives using tools like portfolio, program, and project management at the lower organizational levels, apart from the ongoing operational and compliance management processes. Project and program managers must understand the strategic priorities and initiatives, including how their project or program objectives contribute positively to the overall strategic priorities and corporate strategy.

Each program and project should specific strategic decision gateway evaluations to determine whether to continue, to put it on hold, or to kill it altogether. Eliminate non-value-adding programs, projects, and activities that have no strategic significance or relevance.

The real power of program management is the ability to integrate and lead interdependent project managers and teams to deliver their parts of the solution or value in a coordinated and orchestrated manner that ultimately accomplishes the attainment of strategic objectives and key performance indicators.

Projects should be undertaken only when they:

1. Comply with standards or requirements set by the business for profitability, organizational growth, and performance.

2. Create strategic value or outcome for the organization and fully the corporate strategy.

7.6 Determine capacity and appetite for risk

Organizations should make informed and rational business decisions about the risks they want or willing to take in pursuit of objectives and key performance indicators.

Clearly define the acceptable level of risk that everyone can take based on the organization’s overall risk appetite and tolerance thresholds. Risk appetite is how much risk the organization wants or is willing to accept, and risk tolerance is how much risk the organization can live with or is willing to allow.

As an organization defines its objectives, it should also define its risk appetite or the amount of risk it is willing to accept in pursuit of its mission. Failure to define risk appetite could result in taking on too much risk to achieve objectives or, conversely, not taking on enough risk to seize crucial opportunities. The definition of its risk appetite serves as a basis for determining risk tolerance, or the acceptable levels of variation that management is willing to allow for any particular risk as it pursues objectives.

Risk appetite and tolerance thresholds are, therefore, determined with objectives and key performance indicators, as shown in Figure 7.2 below. The costbenefit/feasibility threshold represents a cross-over point whereby it is no longer economically feasible to on any additional cost to the customers or stakeholders for achieving an incrementally higher level of performance.

The risk appetite statement reflects the board’s view on what degrees or levels of risk are acceptable (or unacceptable) to the business in executing its stated corporate strategy.

The statement should link risk exposures to financial performance in a way that offers insights into risk-taking strategies, and where strategic choices should align with the organization’s risk tolerance.

Three key elements for framing risk appetite assertions:

1. Articulate risks that are acceptable or on-strategy that the organization intends to take.

2. Articulate risk that is undesirable or off-strategy that should be avoided at all cost.

3. Define strategic (e.g., new products), financial (e.g., return on assets), and operational (e.g., safety targets) parameters, where appropriate, that provide the necessary thresholds or boundaries within which the corporate strategy is executed and expressed as performance targets, ranges, floors, or ceilings.

At a minimum, the risk appetite statement should convey the following:

1. Risk appetite threshold, which is the degree of risk that the organization is prepared to accept in pursuit of its strategic objectives after considering the interests and perceptions of stakeholders.

2. Risk tolerance threshold, which is the maximum level of risk that the organization is willing to operate within, expressed generally as a financial limit and based on its risk appetite, risk profile, and capital strength.

3. Processes for ensuring that risk appetites and tolerances are set and continuously reassessed at appropriate levels and thresholds, based on:

a. Estimates of impact if risk tolerance threshold is breached.

b. Likelihood that each material risk may be realized.

c. Expected performance that is beyond the baseline performance target.

4. Processes for monitoring, review, and evaluating compliance with each risk appetite and tolerance threshold and for taking timely and appropriate action where there is a breach of the threshold.

5. Timing and processes for the regular review and assessment of risk appetites and tolerances.

~~~~~~~

7.6.1 Manage different employee attitudes to risktaking

Problems with behavior and culture are the root of many organizational scandals and collapses.

Hence, normalizing different levels of employee attitudes and perceptions to acceptable risk-taking within the organization is vital for effective strategy execution. As executives have the propensity to take risks (i.e., being a risktaker), appropriate controls, processes, and policies should be in place to limit and manage excessive or unnecessary risk-taking that may go beyond the organization’s risk tolerance threshold.

On the other hand, operators (e.g., operational staff, front-line staff) have the propensity to exercise control (i.e., being risk-averse), and they should be actively encouraged and motivated to take calculated and considered risk by setting and clarifying the appropriate amount of risk appetite and decisionmaking limits and rights.

During the financial crisis, risk management, or the lack of it, was examined, questioned, and sometimes blamed for the financial state of banks and other financial institutions.

For Lehman Brothers, risk management was demoted in status and brushed under the rug as the organization ran itself into the ground, refusing to look at the truth behind massive profits being made from mortgage-backed securities. Therefore, a strong risk management and control structure is important to balance risk-taking with the potential implications of putting excessive capital at risk.

By acknowledging that there are different attitudes of risk-taking within the same organization, effective managers of risks could either avoid threats or take advantage of opportunities, thus creating the appropriate risk and organizational culture that can maximize or enhance the organization’s strategic value.

More broadly, a positive organizational culture understands:

1. Risk factors or causes threatening what the organization is trying to achieve.

2. How to prevent or mitigate these risk factors or causes.

3. Opportunities the organization faces in the pursuit of its objectives and to perform well.

4. How to leverage this knowledge to capitalize on opportunities.

Factors influencing the organization’s culture include:

1. Risk awareness based on individuals’ and stakeholders’ beliefs, perceptions, and judgments about the significance of the risks, controls, and performance.

2. Risk tolerance where the decision to act on or accept risk is based partly on an individual’s appetite and perception for that risk.

3. Risk ownership as a measure of an individual’s authority and acceptance of abilities and willingness to act appropriately based on best available information.

~~~~~~~

7.6.2 Risk tolerance

Risk tolerance is defined as the “organization’s readiness to bear the risk after risk treatment to achieve its objectives” (ISO Guide 73:2009). It is the absolute boundary or threshold of the risk-taking outside which the organization is not prepared to venture into at any cost in pursuit of its objectives.

For example, “we will not deal with a certain type of customer” or “we will not

expose more than X percent of our capital to losses in a certain line of business.”

To execute any given strategy, employees need to be able to adapt as the situation changes. Boundaries give them the freedom to do that. When there is no given boundaries, people create more rigid ones for themselves.

~~~~~~~

7.6.3 Risk appetite

Within the boundaries set by risk tolerance thresholds, the risk appetite is a narrower performance range or threshold that articulates the maximum amount of risk that the organization is willing and prepared to take or accept to achieve its objectives and key performance indicators.

Risk appetite is the “amount and type of risk that an organization is willing to pursue or retain” (ISO Guide 73:2009). It helps executives and employees understand the organization’s risk profile by finding an optimal balance between risk and return or growth and nurturing a healthy but acceptable risk-taking culture.

Based on personal performance objectives and key performance indicators, the number of risk thresholds applicable for each individual should be clearly defined, documented, and monitored. This will affect the practical level of risk

tolerance the organization can collectively take in pursuit of performance and corporate strategy, thereby avoiding the situation where one individual can bring down the entire organization (e.g., Barings Bank, Enron).

Budget Air uses its corporate key performance indicator to set the levels of risk appetite and tolerance. The airline industry’s average for on-time punctuality is 82% and Budget Air’s historical performance target has generally been at 85%, which is 3.6% above the industry average.

The cost to achieve a performance target of 90% and above is not economically feasible as it is not possible to on the additional cost to the customer.

At the corporate level, management sets the expected performance target at 86%, with a risk tolerance threshold for on-time punctuality of between 82% and 90%, or a 4.6% variation from the expected performance target of 86%. Budget Air has a low-risk tolerance for failure to meet customers’ expectations for on-time punctuality, which is the key success factor for Budget Air achieving its corporate strategy. For this corporate-level on-time punctuality objective, the risk appetite threshold is set at between 84% and 88%, or 2.3% variation from the expected performance target of 86%, well within the risk tolerance range of 82% and 90%.

7.7 Identify and assess risks

A risk is a known unknown that, should it occur, may have an effect on the achievement of objectives. A risk can be either an opportunity (i.e., an uncertainty that may have a favorable or positive impact on objectives) or a threat (i.e., an uncertainty that may have an unfavorable or negative impact on objectives).

~~~~~~~

7.7.1 Identify risk linked to the achievement of objectives

The ability to identify, assess, and manage risks and appetite for risks at all levels of the organization and implement the necessary treatments is often indicative of an organization’s maturity and ability to respond and adapt to change.

When risk management is embedded or integrated into the organization, it regularly prompts periodic reviews of objectives and strategic assumptions that could impact the achievement of its objectives and the development of appropriate risk responses.

Decision-makers should adopt the practice of always asking What are the assumptions here? and What are the uncertainties associated with the assumptions?

In practical , there are several common methods for identifying risks:

1. Self-assessment questionnaires — This is a bottom-up approach whereby employees identify and assess the areas that present the most risks to the business. Provide a standard self-assessment questionnaire with instructions to employees best placed to understand the key objectives, risks, and controls. Aim to achieve consistency in risk ratings and assessment across business units.

2. Process and risk mapping — This is a systematic and analytical approach that considers the major steps in key business processes as prompts to identify process objectives, risks, and controls. Do not exclude risks arising from interdependencies between different processes and risks.

3. Facilitated workshops — Undertake a series of workshops to consider each risk category linked to objectives involving employees who understand the risk category, risks, and controls. Circulate relevant material in advance for review and, with the aid of a facilitator, conduct a structured discussion in which the group seeks to reach an understanding and consensus on key risks and controls faced by the business.

~~~~~~~

7.7.2 Risk assessment

A rigorous risk assessment enhances the quality of the corporate strategy and strategic objectives as well as their execution. By examining the risk profile of the organization, executives can evaluate how the business and competitive environment have changed or might change in the future. This will facilitate an evaluation of the strategic alternatives as well as understand the consequences of taking action to mitigate one risk relative to the impact on other risks. Excessive levels of risk may lead to decisions to exit a market or discontinue a product or service.

To be meaningful to management, prioritize identified risks that are linked to objectives:

1. The use of standard risk assessment matrix and templates provides a helpful structure for this process, assisting employees to consider the risk descriptions, causes, drivers, different types of risk effects, and the most appropriate risk, control, and treatment owners.

2. Standard criteria for risk assessment are helpful for consistently aggregating the results across risk classes and the organization.

3. Assess risks on an inherent basis (before any proposed risk treatments are added to the current controls) and on a residual basis (with the assumption that

the proposed risk treatments are implemented). In practice, it can be difficult to disregard any controls already in place to make an inherent risk rating.

When assessing an organization’s risk exposure:

1. Start with a top-down risk assessment of the most important strategic risks that are linked to the achievement of the corporate strategy, strategic objectives, and key performance indicators.

Strategic risk can impact an organization because of major changes in the environment in which it operates, over which it has little or no control.

Actions taken to address one type of risk, such as strategic risk, can often increase exposure to other risks, such as operational or financial risks.

2. Undertake a middle-up risk assessment focused on business and functional units (as opposed to a bottom-up risk assessment that may sometimes translate to process-level operational risks).

If the organization starts with a bottom-up risk assessment, especially from an operational perspective, there is a potential danger of too much operational detail. This will make it difficult to aggregate risks into an enterprise-wide view of key strategic risks.

The bottom-up approach tends to identify risks that are business-as-usual or

operational, where the organization has already put a lot of effort into managing them. Unfortunately, such approaches can sometimes fail to identify the big strategic risks that could kill the organization.

It is important to identify the interrelationships and interdependencies of risks and clearly understand the velocity at which risks may occur. For example, a reputational crisis may make it harder for the organization to recruit highly skilled people. Executives need to think carefully about the way risks interrelate to each other.

Different types of risk can interact with each other to produce an even greater loss in value. Along with assessing internal risk dependencies, organizations need to understand the risk profiles of their key suppliers and customers to assess the potential impact of those vulnerabilities on their overall risk profile.

In addition, when an organization takes action to address one type of risk, it can unwittingly increase their exposure to other risk categories. Risk management strategies should include an analysis of how responses to one type of risk might trigger other types of risks within the organization.

Risk assessment begins and ends with specific objectives and is the overall process of risk identification, risk analysis, and risk evaluation: (refer to ISO Guide 73:2009)

1. Risk identification is the process of finding, recognizing, and describing the threats and opportunities as well as the appetite for risks.

2. Risk analysis is the process to comprehend the nature of risk and determine the level of risk. By quantifying risk, organizations have a more reliable and objective way to measure how each function or project contributes to the management of each risk that affects performance. The level of risk is the magnitude of risk or combination of risks expressed in of the combination of consequences and their likelihood.

3. Risk evaluation is the process of comparing the results of risk analysis with pre-defined risk criteria (contained in the risk assessment matrix) to determine whether the risk and/or its magnitude is acceptable or tolerable. Risk criteria are of reference against which the significance of risk can be evaluated, and it is based on the organization’s strategic objectives and risk appetite and tolerance thresholds.

This where the risk criteria must be consistent with the objectives of the organization and aligned with its risk attitude. If the objectives change, the risk criteria need to be adjusted accordingly. It is important for effective risk management that the risk criteria are developed to reflect the organization’s risk attitude and objectives.

Risk attitude is an organization’s approach to assess and eventually pursue, retain, take or turn away from risk. (ISO Guide 73:2009)

Organizations must prepare a short list of prioritized key risks that have strategic significance and not a long shopping list of non-strategic ‘risk’.

After cascading the objectives and determining the objective’s risk appetite and tolerance thresholds, this assessment activity should comprise the following and re-occurring at all levels of the organization:

1. Identify the risk (as well as the appetite for risk) that could impact the achievement of objectives, where the effect is a potential deviation from expected performance — positive and/or negative.

a. Risk is an objective-focused concept.

b. Risk management enables the organization to achieve its objectives by proactively managing potential threats, opportunities, and performance deviations where risk-based, strategy-focused controls are developed, implemented, and maintained.

2. Linked to the achievement of strategic objectives (and key performance indicators) are strategic risks. Strategic risks are opportunities or threats to an organization’s ability to set and execute its overall corporate strategy based on the strategic plan.

It concerns where the organization wants to go, how it plans to get there, and how it can ensure survival. This is where strategic risk management is of central importance to the management of shareholder value.

3. Linked to the achievement of operational objectives (and key performance indicators) are operational risks. Operational risks are potential internal operational loss with some adverse outcome (e.g., financial loss):

a. Resulting from acts undertaken (or neglected) in carrying out business activities (e.g., inadequate or failed internal processes and information systems).

b. From misconduct by people (e.g., breaches in internal controls and fraud).

c. From external events (e.g., unforeseen catastrophes).

4. Analyze the identified risk and appetite for risk by understanding the nature and its cause and evaluate the adequacy and effectiveness of existing controls to determine the level of inherent risk.

a. Inherent risk is a risk with current controls already in place but without any consideration and implementation of new risk treatments.

b. The level of risk will depend on the adequacy and effectiveness of current controls.

c. The effectiveness of control is dependent on its design that addresses the risks’ root causes and its operating effectiveness (i.e., whether the control is wellmanaged and operating as intended).

5. Based on the objective’s risk appetite, compare the results of the risk analysis with the risk criteria to determine whether the level of inherent risk is acceptable or not. Document the risk criteria within a customized strategy-focused risk

assessment matrix.

Consistently apply the risk management languages, risk criteria, rating scales, and categories contained in the risk assessment matrix through an organizational-wide risk management policy and plan.

6. If the level of inherent risk is not acceptable based on the pre-defined risk criteria, develop and implement cost-effective risk treatments to mitigate (or enhance) the risk to a level that is acceptable to the organization.

Once implemented, the proposed risk treatments become existing controls. If it is a threat, mitigate the level of risk.

If it is an opportunity, enhance the level of risk.

7. Assess the potential effectiveness of proposed risk treatments as if they have been implemented and decide whether the projected level of residual risk or risk remaining after implementing the risk treatments, is tolerable or not using the same risk assessment matrix.

Generate new risk treatments to mitigate the risk further to a tolerable level if the level of residual risk is not acceptable. This reiterative cycle continues until the level of residual risk is acceptable.

8. Document the generated information from the risk assessment activity in a risk , which is a record of information about identified risks, controls, proposed treatment plans, and able persons (risk owner, control owners, and treatment owners).

It is important to allocate ownership of risks, controls, and treatments to individuals with the authority, capability, capacity, and resources to implement and manage them effectively. The risk owner may delegate tasks to others as and when appropriate but remains able for the successful completion of the tasks.

By fostering a multi-level approach to the management of risk within the organization, there are different categories of risk management:

1. Risk management at the organizational level — enterprise-wide risk management

2. Risk management at the strategy level — strategic and portfolio risk management.

3. Risk management at the program level — program risk management.

4. Risk management at the project level — project risk management.

5. Risk management at the discipline level — fraud risk management,

occupational health and safety, information security, environment, etc.

Different areas of risk may require different tailored processes within the same organization. While all processes should be consistent with ISO 31000, there will be differences in the systems, models, and level of judgment involved. Tailor each process to its specific purpose.

Budget Air uses the risk assessment matrix (or risk criteria) as shown in Figure 7.3 below to assess identified risks that are linked to its corporate strategy. The matrix forms part of its risk management policy or plan. Budget Air has modified the consequences criteria to suit its operating context.

In one of Budget Air’s subsidiaries (BA Catering), upon completion of the initial risk identification and assessment in each department using BA’s risk assessment matrix, the Enterprise Risk Management (ERM) Unit for BA Catering collects the risk s from each department and business unit. BA Catering could have its risk assessment matrix due to its small-sized operations.

To analyze, aggregate, and quantify the risk assessment information, BA Catering’s ERM Unit then:

1. Sorts the information by risk category.

2. Reviews risks within each risk category for similarities or common risk themes.

3. Assigns an alphanumeric code to each risk theme and enters the code into the spreadsheet.

4. Sorts the data by the new risk codes or risk themes to bring all similar risks together from across the organization into the same risk category.

5. Calculates a weighted average risk ranking for the aggregated risks for each risk category (e.g., the average level of risk within each risk category) and enters it into the spreadsheet.

6. Re-sorts the information by the weighted average risk ranking across the entire risk population to identify BA Catering’s most significant risks. Determines an appropriate cut-off point (often a natural break in the ranking order) and refers those risks to the ERM Steering Committee for possible monitoring.

7. For top risks, evaluates the number of departments that reported similar risks. Whenever there are identified risks for three or more departments, obtain information on the risk management activities related to that risk item.

If one or more departments are developing a risk treatment plan, facilitate the sharing of information regarding risk treatments across relevant departments.

8. For top risks, perform additional analysis regarding the interrelationships between the risks and their related risk treatment activities. Prepare an annual report identifying key risks and their interrelationships, along with observations of how departments, if any, are achieving efficiencies in those areas. Share the report with all relevant departments and decision-makers within BA Catering.

After the aggregation and quantification, the ERM Unit will re-evaluate the effectiveness of existing risk treatment plans. It is likely that many, but not all, of the risks identified, will be known.

However, the extent to which they are understood and visible may vary as the aggregation and quantification processes may highlight new concerns for BA Catering. As such, existing risk treatment plans may need to be re-evaluated to determine their adequacy and effectiveness considering the higher level of

assessed risks due to aggregation.

Based on the above assessment, the ERM Unit will compile a list of the most significant risks to BA Catering. This list will be presented to the ERM Steering Committee for review and evaluation.

The ERM Unit will also present a list of key risk categories used in the risk assessment for approval by the ERM Steering Committee. After assisting in the facilitation of risk assessment sessions and analyzing the risk assessment information, the ERM Unit will revise the current list of risk categories. The ERM Unit will then make recommendations to the ERM Steering Committee on the revised risk categories for use in future risk assessments.

BA Catering’s ERM program uses indicators to track the status of each identified risk, with quarterly monitoring and review of each indicator and summarized reporting of the risk status. Monitoring, review, and reporting start at the departmental level.

The ERM Unit compiles the information into summary reports for decisionmakers. Summary reporting of risks provides status and improvement goals and opportunities (including risk treatment plans, timelines, and treatment owners). The ERM Unit reviews the reports regularly.

~~~~~~~

7.7.3 Document risk information in risk s

An extract of a risk format is shown in Figure 7.4 below.

Options for structuring risk s:

1. Centrally using one organizational-wide risk that records all strategic and operational risks.

2. Decentralized using several dedicated risk s maintained at various levels and parts of the organization by able executives depending on the organization’s requirements, structure, and operating context.

An organizational-wide risk management plan should effectively link all risk s together so that vital information for decision-making can flow effectively and efficiently between them.

A risk management plan specifies the approach, the management components, and resources applied to the management of risk (ISO Guide 73:2009).

~~~~~~~

7.7.4 Enterprise-wide view of risk

Enterprise risk management effectively requires an organization to take an

enterprise-wide view of risk (and control) to determine whether the organization’s residual risk profile is commensurate with its overall organizational risk appetite and tolerance relative to the achievement of its strategic objectives. This is where management:

1. Considers how individual risks and controls interrelate with each other.

2. Develops a view of risk (and control) or risk profile from different perspectives:

a. Organizational or enterprise-wide level.

b. Business unit level.

c. Portfolio or program-level.

~~~~~~~

7.7.5 Develop a portfolio view of risk

Organizations should manage both singular and aggregated risks to execute their corporate strategy effectively.

As an illustration to develop a portfolio view of risk, identify and manage two key sources of risk.

1. Portfolio risks are risks in the portfolio that relates to the management of the portfolio consisting of:

a. Specific portfolio-level risks arising during the management of the portfolio itself and are linked to the achievement of strategy-focused portfolio objectives that have been cascaded from the level above.

b. Escalated component risks (from the level below) from individual projects (or activities) within the portfolio and other portfolio components based on predefined escalation criteria that express the escalation threshold or trigger for which a project risk should be escalated up into the portfolio level.

Risks could be aggregated and escalated either by simple summation or by synergy (e.g., the whole is greater than individual parts) if it is a group of common project risks.

c. Delegated strategic risks (from the level above) affecting portfolio objectives or requiring portfolio-level action based on pre-defined delegation criteria and threshold.

d. Interrelationship risks arising from how risks within the same portfolio interrelate with each other between (and amongst) portfolio components.

2. Project risks are risks of each project within the portfolio itself, where project risks can be linked to the following:

a. Strategy-focused project objectives that have been cascaded from levels above where project risks are identified through a risk assessment process.

b. Decisions about the overall project scope, structure, context, and content (matters that are inherent to the project).

Strategically select portfolio projects based on the selection criteria for portfolio components to maintain the overall balance and risk exposure at a level that is consistent with the portfolio risk appetite and well within the thresholds of organizational risk appetite and tolerance.

Assess all portfolio risks, including project risks, escalated risks, delegated strategic risks, and interrelationship risks against the same portfolio-level risk criteria, thereby prioritizing and managing them consistently.

As a risk response, a portfolio risk may also be:

1. Escalated to the strategic level (to a level above) if:

a. It impacts a strategic objective.

b. Senior management action is required.

2. Delegated to the project level (to a level below) if:

a. it impacts one or more projects within the portfolio

b. project manager action is acceptable, given the level of risk.

Therefore, while risks are rated individually to the objectives they impact, it is also important to bring risks together in a portfolio view that pinpoints interrelationships between risks across the organization. Correlations may exist, in which increased exposure to one risk may cause a decrease or increase in another.

Concentrations of risks may also be identified through this view. The portfolio view helps organizations understand the effect of a single event and determine where to deploy systematic responses to risks.

The portfolio view, therefore, enhances the ability to identify events and assess

similar risks across the organization, to ensure that risks are managed consistent with risk tolerance levels reflecting the growth and return objectives, and to develop adequate risk responses.

Risks in different business units may be within the risk tolerance thresholds of individual units. However, taken together, these individual business unit risks may exceed the organization’s risk appetite threshold.

Conversely, risks may naturally offset across the organization. For example, some individual units may have higher risk appetite thresholds while others may be relatively risk-averse or have lower risk appetite thresholds, such that the overall risk is within the organization’s overall risk appetite threshold, thereby avoiding the need for risk response.

Budget Air wants to assess the performance and risk of one portfolio consisting of three projects. Develop a portfolio view of residual risk based on the following activities: (Refer to Figure 7.5 below)

1. In Section A, identify the common portfolio risk causes from all portfolio risks that are linked to portfolio level objectives. Risk causes can be identified from a risk description, which is a structured statement of risk that usually contains four elements: sources, events, causes, and consequences: (ISO Guide 73:2009)

a. Risk source is an element that alone or in combination has the intrinsic potential to give rise to risk.

b. Event is the occurrence or change of a particular set of circumstances.

c. Consequence is an outcome of an event affecting objectives.

A simplified example of a risk description: Dangerous worksite and hazards (event) caused by poor housekeeping and occupational, health, and safety procedures (cause) may lead to injuries to persons coming onto the project site (consequence).

2. In Section B, identify the common risk causes that are appearing across 50%

or more of the individual portfolio components. Portfolio components comprise programs, projects, and activities.

3. For each section in Column 1, list risk causes in order of their level of risk with higher-rated risks at the top starting with Class 4 risks.

4. For each portfolio component in Columns 2 to 4, compute the risk impact or impact of risk causes on the objectives of all components within the same portfolio.

5. Compute the risk correlation by cause in Column 5 by adding or subtracting individual risk impacts (+ve and -ve) for each risk cause listed on each table row across Columns 2 to 4.

6. For each section in Column 6, compute the aggregated risk ratio based on all risk correlations by causes appearing in Column 5.

7. Compare the risk ratios appearing in Column 6 for Sections A and B. If the risk ratio for Section B is higher than the risk ratio for Section A, then the total risk of individual portfolio components is higher than the risk of the whole portfolio. A portfolio is balanced only when the risk ratio for Section A is equal to or higher than the risk ratio for Section B.

~~~~~~~

7.7.6 Balance the portfolio’s risk portfolio

Portfolio management is about doing the right projects, creating a link from the projects to organization’s strategy and, simultaneously adopting the long-term view of organizational performance.

A well-balanced portfolio enables an organization to achieve its growth and profit objectives associated with its corporate strategy without exposing the organization to undue risks.

Balancing the portfolio requires the organization to ensure that the risks of individual portfolio components (e.g., programs or projects) do not exceed the overall risk profile and risk tolerance of the entire portfolio. It is a way of addressing multiple objectives and to reduce the level of risk.

Once the portfolio components are balanced from a risk management perspective, the organization can evaluate the risk index for the portfolio, and performance and controls effectiveness for each project or component within the portfolio.

~~~~~~~

7.7.7 Evaluate the risk index for the portfolio (or enterprise-wide)

A single-number view of risk or risk index customized to its unique circumstances and operating environment could provide some value to the board and management. Calculate the risk index through the analysis of risk ratings or levels of risk using the risk assessment matrix.

The risk index could be broken into different parts of the portfolio, allowing the organization to ‘drill down’ and focus on specific issues and causes driving its risk profile. For example, link the risk index to strategic objectives or a portfolio.

The risk index (shown in Figure 7.6 below) for Budget Air’s portfolio of three projects is ‘3.2’. It is classified as a ‘Class 3’ risk based on the risk assessment matrix and weighting based on the total funding or resourcing for individual projects within the portfolio.

~~~~~~~

7.7.8 Key performance indicator (KPI), key risk indicator (KRI), and key control indicator (KCI)

There are three types of indicators used for strategy execution that may overlap with each other: (Refer to Figure 7.7 below)

1. Key performance indicator (KPI) is an indicator used by an organization to define its performance targets based on its objectives, and to monitor and review its progress towards achieving these performance targets.

KPI answers the question: Are we achieving our desired or expected levels of performance?

2. Key risk indicator (KRI) is an indicator used by an organization to help define its risk profile, and to monitor and review changes in that profile.

KRI answers the questions: How is our risk profile changing to meet our objectives? Is it within our desired levels of risk?

3. Key control indicator (KCI) is an indicator used by an organization to help define its control environment, and to monitor and review levels of control relative to desired levels of risk and performance.

KCI answers the questions: Are our organization’s controls effective to achieve our objectives? Are we ‘in control’?

Deterioration in KCIs may show an increase in the residual risk consequences and/or likelihood. They are relevant to specific control activities.

There may also be indicators in the form of risk appetite and tolerance thresholds that form part of the family of indicators that are useful for strategy execution. Use risk thresholds alongside performance targets. These could be improved over time as objectives, corporate strategy, and risk awareness develop and mature. These performance targets will help drive the desired behavior, outcomes, and improve the organization’s risk profile and performance over time.

The key attributes of key risk indicators:

1. Highlight current levels of risk by providing a reasonable measure of the status of an identified risk and the effectiveness of its control. Risk indicators can provide information that gives a useful ongoing view of the underlying behavior and drivers of the risk profile.

2. Highlight trends and changes in levels of risk by monitoring changes in risks and controls, and the risk profile itself.

3. Provide early warning signals through predictive risk indicators that highlight changes in the risk environment, control effectiveness, and emerging risks, before they crystallize and result in loss or other exposure.

4. Enable timely actions that prevent or minimize material loss or incident.

5. Express potential escalation criteria for risk management by using thresholds or triggers to convert raw indicator data into meaningful risk ratings to aid effective decision-making.

In Budget Air, a key risk indicator for monitoring and responding to risk around the effectiveness and continuity of essential business functions relates to staff turnover levels. This is important for strategic job positions (particularly for ‘A’ Grade strategic positions) where there is a critical level of dependency.

Escalate any breached thresholds to an appropriate level of management:

1. Below 4% — No risk. Budget Air is comfortable with the level of staff turnover. No further escalation or treatment is required.

2. Between 4% and 6% — Potential risk. The risk is a concern and Budget Air’s people and culture would be expected to actively monitor and establish causes and actions. Escalation required.

3. Above 6% — Significant risk. Proactive action and immediate escalation with the explanatory report required.

~~~~~~~

7.7.9 Avoid listing ‘risk’ for the sake of it — Move beyond compliance

Organizations can end up with a long list of ‘risk’ (possibly an inventory of 100 ‘risks’!) rather than a risk management system that effectively manages a handful of key risks that have strategic consequences.

Organizations often skip over the important part: that is providing a strategic lens into risk and asking the question: In the context of our products, services, and strategic objectives, what are the big risk causes that would make it difficult for us to be successful?

It is not the quantity, but the quality of risk identified and the effectiveness of the risk management process that will make a competitive difference and improve performance.

Risk treatment plans (being part of a risk ), treatment owners, and timelines for completion should be continuously tracked to closure and regularly reported. By monitoring and review the implementation status for each risk treatment, organizations can be certain that they have an effective risk management process that keeps them on track to achieve their strategic objectives and organizational growth.

As is the case with risks, controls should be also owned by someone able or responsible for their operation and effectiveness. The control owner would normally be the person who manages the control daily and can be someone other than the risk owner. This does not affect the overall responsibility of the risk owner for the proper modification of that risk, and for the design, implementation, application, monitoring, and evaluation of corresponding controls.

The critical success factor is therefore to focus attention on a manageable or controllable small number of key strategic risks and applying the lessons learned to identify and manage key risks across the organization.

7.8 Measure project and portfolio performance

After balancing the project portfolio from a risk management perspective, it is not enough to track the performance of individual projects within the portfolio in an isolated way.

Portfolio managers need to understand, track, and manage individual project’s:

1. Performance (including risks and controls).

2. Interrelationships with the performance of other projects (or components) within the portfolio.

~~~~~~~

7.8.1 Evaluate individual project performance

Score and rate the performance of each project within the portfolio. For example, use a performance scoring scale of ‘0’ (rated as ‘unsatisfactory’) to ‘3’ (rated as ‘highly satisfactory’) based on the following performance criteria:

1. Alignment with corporate strategy — Projects are undertaken within the portfolio should the achievement of strategic objectives. Terminate projects that do not have strategic importance or value.

2. Achieving project and portfolio objectives — At the next level down, projects (and components) undertaken within the portfolio should achieve their own (project or component) objectives that are aligned with portfolio objectives.

Align portfolio objectives with strategic objectives. There should be a clear performance line-of-sight between project objectives and corporate strategy through the appropriate portfolio objectives.

3. Project implementation — Rate standstill project as inactive. Calculate percentage delay based on the original implementation period derived at the project approval stage.

For example, for a project with an approved implementation period of five years, if there is a one-year delay after two years of implementation, it would be considered to have delayed by 20% (1/5) at the time of assessment or project evaluation.

4. Project dependencies — The likely success of a project is dependent somewhat on the degree of dependency it has with other activities and projects within or outside the portfolio.

The project will experience significant complexity and challenges if it is highly dependent on other projects or activities for its success and completion, especially if project governance and management are weak.

Dependencies between activities and projects within a portfolio are characterized by mandatory or discretionary; and internal or external.

5. Project cost overrun — Report or escalate any cost overruns as soon as practicable. These overruns may influence the funding or resourcing required for sustaining or continuing the project. Approve, communicate, and document any change in project cost.

6. Changes in project scope — When there is reduced or changed project scope, calculate any potential cost variations based on the changed scope. Approve, communicate, and document any change in project scope.

Performance rating labels (e.g., ‘unsatisfactory’, ‘partly satisfactory’, ‘satisfactory’, and ‘highly satisfactory’) could be used, as shown in Figure 7.8 below. Use weightings where appropriate to reflect the importance against various criteria in the assessment process to reflect project context or circumstances and organizational requirements, policies, and maturity.

Clearly and objectively define the performance or evaluation criteria. This will ensure that there is limited or no room for subjective interpretation or manipulation of actual performance results. Customize the performance scoring criteria based on the requirements, context, and maturity of the organization.

Based on the performance criteria and scoring shown above, Budget Air assesses Project A’s performance rating as ‘satisfactory’ with a performance score of ‘2.2’, as shown in Figure 7.9 below.

Since Project A’s previous performance score was ‘1.8’ (rated as ‘partly satisfactory’), there has been an ‘improvement’ in its performance over the reporting period.

~~~~~~~

7.8.2 Aggregate performance of multiple projects as a portfolio (or program)

Determine the overall performance of the portfolio by the aggregated performance of all projects within the portfolio, based on either a weighted performance score or an average performance score.

The customizable scoring criteria to weight the performance scores can be simple or complex, depending on the specific business requirement and operating context.

For Budget Air, the performance rating for the aggregated performance of a portfolio with three projects is ‘partly satisfactory’ with a performance score of ‘1.7’, as shown in Figure 7.10 below. Since the portfolio’s previous performance score was ‘2.4’ (rated as ‘satisfactory’), there is a ‘regression’ in its performance over the reporting period.

7.9 Develop an enterprise-wide view of performance, risk, and control effectiveness

Combine the performance score and risk class for each project contained within the portfolio into a graphical representation, superimposed with the overall control effectiveness for each project. This should significantly enhance the information required for decision-making.

~~~~~~~

7.9.1 Evaluate control effectiveness

Evaluate the effectiveness of existing controls based on two criteria: (Refer to Figure 7.11 below)

1. Design effectiveness — Refers to whether the design of the controls achieves the intended control objectives of addressing the root causes of risk.

Design decisions involve the acceptance of some degree of risk. Balance the cost of control against the benefit or value of controlling the risk. It is possible to reach a position where the incremental cost of implementing additional or

enhanced controls is greater than the benefit or value derived from controlling the risk (cost-benefit analysis).

2. Operating effectiveness — Refers to whether controls are consistently operating as designed or intended. It considers how the control is operating in practice.

Control effectiveness assessment is ‘best guess’ based on recent experiences and knowledge of errors, complaints, or praises. If there is some uncertainty in the control effectiveness rating, err on the lower side of the effectiveness scoring.

For example, if it is believed that the control meets the design effectiveness score of ‘3’ but the assessment is based on gut feeling, a score of ‘2’ is probably more appropriate without additional evidence being provided.

If the control effectiveness rating is ‘ineffective’, an explanation should be given, and a decision taken as to whether to accept the level of risk or to reengineer the control to improve its control effectiveness.

After balancing the portfolio from a risk management perspective, Budget Air consolidated and diagrammatically represented the following assessments for each project within the portfolio: (Refer to Figure 7.12 below)

1. Risk (plotted on the horizontal x-axis).

2. Performance (plotted on the vertical y-axis).

3. Control effectiveness (color-coded bubbles).

Concerning Project C, it has:

1. A ‘Class 2’ residual risk rating.

2. An ‘unsatisfactory’ performance rating that is beyond Budget Air’s risk tolerance threshold.

3. An ‘ineffective’ overall control effectiveness rating that takes into key controls currently in place to mitigate the risks to the project and proposed risk treatments.

In comparison to Project C, Project A has:

1. A ‘Class 3’ residual risk rating.

2. A ‘satisfactory’ performance rating that is above Budget Air’s risk appetite threshold.

3. An ‘effective’ overall control effectiveness rating that considers key controls currently in place to mitigate the risks to the project and proposed risk treatments.

Project C should therefore be eliminated from Budget Air’s portfolio of three projects because it is performing poorly, has a higher residual risk rating (i.e., high-risk project), and has poor overall control effectiveness when compared to other projects within the portfolio.

By removing Project C from the portfolio, the performance, risk, and control effectiveness of each project remaining within the same portfolio should be rebalanced and re-evaluated (or recalibrated) as there may be a dependency factor that needs to be reassessed.

Document and approve the criteria used for evaluating the performance, risks, and controls of each project within the portfolio.

~~~~~~~

7.9.2 Eliminate non-core and high-risk activities

Focus well on disciplined strategy execution. This requires organizations to identify the non-core and high-risk product or service lines and have the management ‘guts’ to make the hard or unpopular decision to eliminate projects. Underperformance and high-risk ventures are no longer appropriate, especially if they do not have strategic value to the organization.

Executives must make difficult trade-offs between the funding of promising

growth opportunities (which require nurturing with more capital) and retiring underperforming ones (which may need pruning). The willingness to rob Peter to pay Paul is one of the hallmarks of a dynamic top team.

7.10 Improve governance, risk management, and controls

Governance activities emanate from risk management and organizational culture. An organization’s success is driven by how wisely it takes considered risks and how effectively it manages the risks it faces, all of which occur in the context of the organization’s culture.

Independent assurances, audits, and evaluations are a catalyst for improving an organization’s governance, risk management, controls, and resource allocation.

Collectively, they provide reasonable (not absolute) assurances to the board and management that objectives and key performance indicators can be achieved within an acceptable degree of residual risk and risk tolerance, and in compliance with the requirements of laws, industry and organizational standards and codes, principles of good governance and accepted community and ethical standards.

~~~~~~~

7.10.1 Integrated assurance — Five lines of defense

Organizations should strategically employ the five lines of defense (or layers of protection) that could protect the stakeholders and organization from excessive risk-taking leading to long-term instability and poor performance:

1. Operational management and employees — the first line of defense.

2. functions — the second line of defense.

3. Independent assurance providers — the third line of defense.

4. Executive management — fourth line of defense.

5. Board (or able officer) — fifth line of defense.

Organizations should avoid focusing solely on internal audits as the primary means of gaining independent assurance but use the wider spectrum of control and management options available in other forms of lines of defense.

The first line of defense involves the organization’s operations and front-line employees where there are operational transactions. Operational management has the responsibility for overseeing the daily operations of employees, services, practices, mechanisms, processes, and systems, including day-to-day risks and controls management. Line management is responsible for identifying, assessing, and managing risks and for ensuring that the appropriate control activities and risk treatments are in place.

Implement systems of control self-assessment at the first line of defense, where practical. Control self-assessment is a technique used to assess the effectiveness of risk management and control processes. In contrast to a traditional audit, the first step in control self-assessment is to document the organization’s control processes and the environment to identify suitable operational ways of measuring or testing each control. The actual testing and assessment of the controls are performed by employees whose day-to-day role is within the area of the organization that is being examined as they have the greatest knowledge and understanding of how the processes operate.

The second line of defense requires centralized functions like risk management, compliance, people and culture, finance, etc., to provide the necessary oversight, , monitoring, and reporting over the first line of defense including control self-assessment systems.

The third line of defense involves those independent functions like internal and external auditors and board committees (e.g., risk, audit). They provide the board and management with a reasonable level of independent and objective assurance concerning the effectiveness of the organization’s corporate governance, risk management, and control processes required to implement the corporate strategy and achieve its objectives within the acceptable level of residual risk.

The fourth line of defense involves the organization’s executive team appointed to run the business and to provide reasonable assurance to the board and stakeholders that corporate strategy and objectives can be achieved within the acceptable level of residual risk.

Each executive could attest annually that:

1. The organization has risk management processes in place consistent with the international risk management standard ISO 31000 (or equivalent)

2. These risk management processes are effective in controlling risks to a satisfactory or acceptable level

3. A responsible body or audit committee verifies that view.

The fifth line of defense involves the board itself that sets and approves the organization’s risk appetite and tolerance thresholds and provides governance oversight over the strategic activities and performance of the organization. The board is able to stakeholders for executing the corporate strategy within the agreed level of risk appetite and tolerance.

When assessing the adequacy of risk management, the board should consider amongst other things:

1. Processes for establishing the organization’s strategic objectives with appropriate consideration to risks, controls, and budgets.

2. Processes for determining and monitoring the organization’s risk appetite and tolerance thresholds.

3. Adequacy and maturity of the organization’s risk management policies and plans to strategy execution.

4. Adequacy and effectiveness of management’s processes for identifying, analyzing, evaluating, and treating new, emerging, or modified risks.

5. Whether there is effective and efficient communication of risk, control, and budget information across and throughout the organization.

6. Processes for monitoring and optimizing performance, and whether they consider levels of risk and adequacy and effectiveness of controls.

7. Whether there is sufficient visibility of the levels of risk across the organization and whether they are at acceptable levels.

Each of these lines of defense plays a distinct but important role within the organization’s wider governance framework.

Building on one another, the combination and balance of all five lines of defense determine the strength, effectiveness, and maturity of the organization’s corporate governance and control environment. As such, there should be proper coordination and information sharing among these lines of defense to foster greater efficiency and effectiveness, especially from the perspective of strategy execution and organizational performance.

These lines of defense, staffed with capable, competent, and skilled people, instilled with a strong sense of risk awareness and positive organizational culture, are at the heart of effective risk management and strategy execution.

7.11 Continuously monitor and review performance and strategic assumptions

Test and apply hypothesized corporate strategy in the real world during its execution. Hold regular but dedicated strategy review meetings to adapt the organization, strategic plan, and strategy execution plan to the operating context and competitive environment based on the best available information received.

These meetings attempt to answer the question: Are we executing our corporate strategy well and delivering the required or promised customer/stakeholder value proposition?

Frequent strategy review meetings accomplish several things:

1. Focus — They keep people continuously focused on strategy execution and the achievement of strategic objectives, avoiding operational (day-to-day) distractions that can take people’s eyes off the ball.

2. Flexibility — They keep the teams agile and responsive to change. As people get into strategy execution, teams need to respond appropriately.

For example, one team member says, “I’ve got three people out with the flu, so I’m at a standstill on this.” Another team member says, “I can loan you a couple

of my people for a week.” Alternatively, the executive can say, “Outsource that piece so we can move ahead.”

3. Alignment — These meetings not only help the organization stay focused and flexible. They also keep team flying in formation with each other and constantly mindful of how they are collectively affecting each other.

These meetings make it much harder for one person to ‘succeed’ at the expense of teammates thereby breaking down organizational silos and increasing teamwork and collaboration.

In contrast, operational meetings attempt to answer the question: Are our day-today operations under control, efficient, and within budget? Unfortunately, these operational meetings can easily consume planned strategy review meetings due to their operational urgency rather than their strategic importance.

Organizations must continuously put their strategy execution and strategic assumptions under full review, checking them regularly against changes in external and competitive environments as well as internal environments and contexts. Any emerging risks and issues that may impact the achievement of the corporate strategy and strategic objectives should be dealt with immediately and escalated or aggregated for reporting to the higher organizational level.

~~~~~~~

7.11.1 Keep a keen eye on strategy execution

Dedicated strategy review meetings, in addition to the operational meetings (and reports), can:

1. Continuously monitor and review the strategic plan and the progress towards achieving the corporate strategy, strategic objectives, and key performance indicators.

2. Test and review strategic assumptions and logical cause and effect relationships contained in the corporate strategy, strategic plan, or strategy map.

3. Actively engage employees and stakeholders in regular strategic and performance discussions, consultations, and communications.

4. Focus on issues and make regular strategic decisions beyond the annual planning and budgeting processes or cycles.

The annual strategic planning is an antiquated idea. You can’t wait for your normal planning cycle to change your strategy. Shifts in the global financial system, marketplace, and geopolitical and digital arenas don’t wait. When an early warning signal appears, executives and managers must get over it right away.

5. Monitor and review the performance and effectiveness of the following:

a. Framework and process for strategy execution.

b. Integrated management system for strategy execution.

c. Strategy execution plan.

6. Capture, analyze, and disseminate lessons learned and information as part of the agile, continuous improvement, and experimentation mindsets.

Regularly track, compare, and analyze actual performance results with the original performance forecast and assumptions contained in prior years’ plans to avoid pouring good money after bad and accepting underperformance relative to long-term expected performance.

~~~~~~~

7.11.2 Beware of potential execution gaps

Execution gaps can occur anywhere within organizations. From a service-quality

perspective, there are several known execution gaps that an organization should know: (Lovelock, C. (2007). Services Marketing. Pearson Education International.) (Refer to Figure 7.13 below)

1. Knowledge gap — This gap occurs if management’s perceptions about customers’ expectations happen to be wrong. This gap is the result of a mismatch between management perceptions and customers’ expectations.

2. Standards gap — This gap exists when the service standard for delivery is not perfect enough according to management’s perceptions about customers’ expectations.

3. Delivery gap — This gap is the result of inconsistencies between delivery standards and service production.

4. Internal communications gap — This gap can be measured by observing the difference between a salesperson’s perceptions about the quality level and the organization’s ability to deliver the service accurately.

5. Perceptions gap — This is the difference between actual delivery and customers’ perceptions.

6. Interpretation gap — This is when the customers’ thinking about promises is inconsistent with the promises of the organization.

7. Service gap — This gap exists when service perceptions are not matching with customers’ expectations of actual service quality delivered by the organization.

~~~~~~~

7.11.3 Publicly displayed scoreboards motivate people

Publicly displayed performance scoreboards showing updated key performance indicators and statistics on organizational and team performance can promote a transparent and team-based performance culture of vitality, agility, and continuous learning. Everyone should know the updated performance scores during strategy execution.

Using sports teams as an illustration to build a performance culture that is transparent and inclusive:

1. Objective of sports teams are very clear (e.g., to win the league).

2. Measurement is simple, both in the short term (e.g., by the number of goals scored per game) or long-term (e.g., by position on the league table).

3. Communication of performance to their ers is clear and instant where everyone knows when a goal is scored or when the team wins a match or when updated league tables are reported within minutes of each match finishing.

~~~~~~~

7.11.4 Integrated reporting is required

Many executives can feel frustrated about the lack of meaningful data in their organization. With all the business intelligence dashboards and analytics software on the market, they do not have all the data they need at their fingertips to make timely decisions.

Integrated reporting could effectively provide an enterprise-wide but consolidated view of organizational performance. The integrated report could include:

1. Success towards the achievement of objectives and key performance indicators as documented in the strategic and operational plans.

2. Aggregated, consolidated, or escalated information on performance, risks, controls, and budgets from lower organizational levels based on pre-defined criteria and business rules.

3. Implementation status of agreed risk treatment plans.

4. Emerging risks, issues, and incidents arising during the reporting period.

5. Effectiveness of key controls to enhance (if it is an opportunity) or mitigate (if it is a threat) key risk.

6. Budget and resource variations (overspending or underspending) and constraints.

7. Success in implementing internal audit or independent assurance providers’ recommendations.

8. Level of compliance towards the requirements of laws, industry and organizational standards and codes, principles of good governance and accepted community and ethical standards.

7.12 Reward performers and deal positively with underperformers

Effective leaders and manages get the right people on the bus, get the wrong people off the bus, and put the right people in the right seats. They stick with that discipline — first the people, then the direction — no matter how dire the circumstances.

Unfortunately, putting the wrong person in a job and not dealing with the mismatch is one of the most common failures of management. This is where not every member of the executive team may be fully committed to the organization’s strategic plan.

Effective performance and strategy execution require workforce alignment and synchronization across the entire organization. An organization with an aligned and synchronized workforce to the corporate strategy has:

1. Right types of people with the necessary knowledge, skills, and competencies that will enable them to achieve their objectives resulting in:

a. Person-job-fit or an employee’s suitability for the job.

b. Organization-people-fit or fit between the personality of the individual (e.g., values, beliefs, interests) and the culture or climate of the organization.

2. Employees positively acting and behaving in ways that will enable the organization to succeed, perform, and create (or preserve) value for its customers and stakeholders.

Identify and manage root causes of employee underperformance. The reasons for underperformance could include the following:

1. Poor or inappropriate performance measures and targets.

2. Poor communication of performance expectations and requirements.

3. Lack of from management.

4. Inadequate resources in people, budget, and time.

5. Problems outside the office with the spouse, children, or parent care.

When underperformance is detected, a performance improvement plan may be required in addition to coaching and close supervision.

Performance issues often revolve around a common lack of understanding of the

actual performance expectations.

Use objective and documented key performance indicators in a personal performance scorecard to avoid misunderstanding, perceived underperformance, and deterioration of a working relationship between an employee and their superior (as an employer).

~~~~~~~

7.12.1 Positively motivate the workforce for performance excellence

One of the biggest challenges that organizations face in strategy execution is the selection and deployment of the appropriate motivational techniques or rewards that build wholehearted commitment to performance excellence and winning attitudes among employees.

A properly designed and implemented compensation and reward structure and system is management’s most powerful tool for mobilizing individual commitment to the successful execution of the corporate strategy.

Unfortunately, there are often differences in perceptions between management and their employees on the achievement of organizational objectives. For example, management strives for the growth of their organization, while

employees strive to grow with their employer. Management wants to achieve their formulated objectives, while employees want to understand their role in achieving these objectives.

There are uncertainties about which rewards motivate employees. Money may be a factor that attracts them to work for the organization but does not play a big role in retaining and motivating them to perform successfully. Career development and public praise are two of the many other ways of motivating employees to improve their business judgment.

Organizations could motivate employees through:

1. Personal ability and rewards for real outcomes and positive value creation (or preservation).

2. Effective employee communication, education, training, and awareness about the corporate strategy, objectives, and key performance indicators.

3. Getting the doers involved in developing their performance objectives, indicators, and scorecard.

4. Linking employees’ objectives, compensation, benefits, and rewards to the corporate strategy and strategic and business unit objectives.

5. Personal training and development programs that provide them with specific knowledge, skills, and competencies required for executing the corporate strategy.

6. Allocating sufficient tools and resources (financial and non-financial) that can enable them to perform their work effectively and efficiently.

~~~~~~~

7.12.2 Personal performance scorecards

Personal performance scorecards can be a useful performance management tool in an incentive and reward program that explicitly links compensation, benefits, and rewards to the attainment of agreed performance targets.

The personal performance scorecard fulfills two functions:

1. Focuses employee attention on the activities and performance measures and targets that are most critical to achieving the corporate strategy.

2. Provides extrinsic motivation by objectively rewarding employees when they and their team succeed in achieving the agreed performance targets.

Personal performance scorecards can present a transparent and objective snapshot of the organizational, business unit, and team/individual weighted key performance indicators. It also acts as an effective two-way communication and performance management tool that eliminates or minimizes negative perceptions, miscommunications, and misunderstandings between employees and their supervisors.

As the personal performance scorecard contains most of the common information used elsewhere, the scorecard may also function as an integrated job description and performance evaluation tool by inserting individual performance scores after the review period based on actual performance.

The reason for this multiple usage of the personal performance scorecard is to reduce people and culture’s istration time in developing and updating various documents at different times of the year.

Therefore, an enhanced personal performance scorecard could also serve as a: (Refer to Figure 7.14 below)

1. Performance scorecard or evaluation tool.

2. Job description.

3. Training needs analysis.

4. Personal improvement and development plan.

~~~~~~~

7.12.3 Reward positive performance

Exceptional employee performance that is stretched together with positive behaviors, integrity, and attitudes should be regularly motivated, rewarded, and reinforced by appropriate compensation, benefits, and rewards that are closely linked to corporate strategy, objectives, and acceptable risk-taking.

Organizations can boost performance through group ability for results and shared responsibility for team effectiveness and performance.

Positively manage free-rider behaviors by developing team-based targets, rewards, or group incentive pay based on long-term pay-for-performance rather than focusing exclusively on individual short-term tasks or efforts.

The organization, CEO, and employees should never compromise their integrity (perceived or real) in their quest to make the performance numbers.

Creatively use base, variable, and team-based financial compensation to positively motivate employee performance and reduce the overall cost for the organization. Where possible, eliminate the following practices:

1. One-size-fits-all — Customize compensation, benefits, and reward schemes to individual employee performance, skills, competencies, and behaviors because everyone is created and motivated differently.

2. Moving-the-goalpost — Most often, the quantum of discretionary monetary reward for bonuses is not known before the end of the performance or review period. Bonuses may change or never materialize in some cases because noncontractual monetary rewards are usually given at the discretion of management.

Instead, allocate a fixed budget for discretionary monetary rewards before the start of the financial year with no ifs-and-buts or excuses midway through.

3. Bell-curve, force ranking — When the employee achieves their expected performance target, reward them accordingly without excuses. Organizations should avoid force-ranking employees and their performance based on statistical performance bell-curve analysis.

A bell-curve allocation tool is only acceptable when there are no measurable performance targets for employees and that an objective system of measurable performance is absent.

Depending on the personal abilities of individuals, the following compensation, benefit, and reward scheme should positively reinforce the achievement of strategic objectives and organizational growth:

1. Compensate CEOs or executives for the delivery of sustainable and exceptional long-term returns and organizational growth.

2. Compensate business unit managers for adding superior multi-year value to the organization, customer, and stakeholder.

3. Compensate middle managers and front-line employees for delivering exceptional performance on key deliverables and targets that they can personally influence directly (e.g., short-term objectives) and have control over.

~~~~~~~

7.12.4 Strategy-focused compensation philosophy

A clearly articulated strategy-focused compensation philosophy is an organization’s commitment to how management values their employees. Gauge the value management places on employees by asking the question: In tough times, does our company think of employees as costs to be cut or assets to be developed?

A compensation philosophy gives the organization and employees an objective but tangible frame of reference when discussing salary matters and performance.

The purpose of a good compensation philosophy is to attract, retain, and motivate good performance. To accomplish these goals, organizations should use a mixture of three main components:

1. Base or fixed pay, also called salary (i.e., financials)

2. Incentives or variable pay (i.e., cash or non-cash, like stock)

3. Benefits or non-financial rewards (i.e., training, development).

A compensation philosophy is a blend or balance of all three components since the organization should pay for whatever it promised to its employees. The right blend and balance depend on individual organization, industry, maturity, and culture.

~~~~~~~

7.12.5 Workforce and people and culture scorecards

Organizations can excel well in any competitive environment if they have three key elements in place:

1. Strategy for the business (i.e., corporate strategy)

2. Strategy for the workforce that is linked to the strategy for the business

3. Strategy for the people and culture function that is linked to both the strategies for the business and workforce.

The reality is that organizations that do not stress differentiation and performance in the execution of their workforce strategy (in addition to the execution of their corporate strategy) will severely underperform.

The first step toward differentiating the execution of a workforce strategy is to recognize and accept that some job positions and roles in the organization are ‘A’ Grade strategic positions that have important strategic influences on the execution of the corporate strategy.

Effective processes for identifying these ‘A’ Grade strategic positions do not include scientific methods of job evaluation that systematically rationalize the value of jobs in one organization in comparison with the value of jobs in another organization or industry.

Use three corresponding scorecards to measure the success of these three strategies:

1. Balanced scorecard, which includes operational, financial, and customer success, or variations of some form of performance scorecard.

2. Workforce scorecard, which includes workforce success, competencies, behavior, mindset, and culture.

3. People and culture scorecard, which includes people and culture practices, people and culture systems, and people and culture staff competencies.

From a human capital perspective, organizations must be able to manage and overcome the following challenges if they want to maximize the contribution of their workforce in executing their corporate strategy.

1. Perspective challenge — View the workforce in of potential contribution or value creation (or preservation) rather than as a cost to be minimized.

Ask the key question – Do we understand exactly how our workforce capabilities, behaviors, and integrity positively enable and drive the execution of the corporate strategy and organizational performance?

2. Indicator challenge — Replace conventional benchmarking performance measures with cascaded SMART objectives and key performance indicators that will differentiate and enable workforce and individual performance and improvements.

Ask the key question – Have we correctly identified and then correlated SMARTer performance indicators for workforce performance and success (specifically workforce competencies, behavior, integrity, mindset, and culture)?

3. Execution challenge — Hold executives and people and culture staff tly able for workforce quality, improvement, and performance.

Ask the key question – Do all people (especially executives and employees) have sufficient and timely information and access to the workforce and personal scorecard performance data so that they can be used to transparently and objectively communicate performance expectations, monitor performance progress, and perform well?

Effective strategy execution requires a series of people and cultural activities that include the following:

1. Clarify the organization’s strategic choice and value proposition that are based on the corporate strategy.

2. Develop and maintain a workforce and compensation philosophy and governance system.

3. Identify and monitor ‘A’ grade strategic positions and strategic job families.

4. Develop and maintain a human capital strategic readiness matrix.

5. Assign personal authority and ability for workforce success and individual performance.

6. Design and implement a workforce performance scorecard.

7. Design and implement a people and culture performance scorecard.

8. Restructure or redesign the people and culture function to fully the business units and organization.