I have written about the need for bigger businesses to recognise that they have three categories of risk: operational, strategic, and external.  Operation risks are probably the best known and most studied.  In this article I will look at strategic risk.

There are different types of strategic risk.  These vary according to the nature of the business.

  1. High Risk, slowly evolving
  2. Diverse and complex risks
  3. A quick-changing risk environment.

Each of these requires a different approach, so you must first decide which type you are dealing with.

  1. Requires a manager with the ability and authority to make the necessary decisions and access to people with the right technical knowledge. It may well also require an external consultant.
  2. Requires a culture of risk-awareness throughout the business, but also a central Risk Management team to act as facilitators to other managers.
  3. Requires collaboration between line managers and embedded risk experts. The latter should support but challenge the former.


The role of top management is to strike a balance between risk, opportunity and cost based on information and analysis provided by the line managers and internal and external risk managers.