Enterprise Risk Management: Strengthening Singapore’s Competitive Advantage

ETHOS Issue 07, Jan 2010

The concept of Enterprise Risk Management (ERM) is not new to the Singapore Government. Many public sector organisations already implement risk management, either as a deliberate initiative or as part of the inherent nature of their work. However, ERM has much more to offer the public service as a whole, because of its two key value propositions: its ability to serve as a unifying framework for strategic planning and the opportunity it offers to enhance Singapore's competitive advantage in an ever more complex and turbulent future.

ERM AS UNIFYING PLATFORM

ERM recognises uncertainty as the fundamental driver of strategy

At its heart, ERM is a way of thinking that recognises uncertainty as a fundamental driver of strategy. As a concept, it can be applied to all levels in an organisation or across agencies, yet is scalable enough to engender thinking about key strategic challenges at the sectoral or national level. One fundamental strength of ERM, as opposed to many other strategic planning methods, is that it avoids over-reliance on past data as the basis of decision-making.

ERM highlights multi-agency trade-offs, and therefore motivates a WOG approach

At a strategic level, the sources of uncertainty are complex and intertwined. A risk-driven approach lends itself to framing issues in a Whole-of- Government (WOG) context. By moving away from outcomes and intents of individual government organisations and looking upstream to consider risks and their drivers, ERM helps to transcend the traditional demarcations and roles that separate government organisations.

ERM unifies strategic planning tools

Different types of strategic planning tools are more suited to different levels of uncertainty.¹

Traditional planning tools which project only one state of the future can be grossly inadequate in the face of deeper uncertainty. To address this inadequacy, scenario planning tools were developed. The scenario planning approach, which describes discrete (and sometimes artificial-seeming) future states of the world, copes best with up to "Level 2" states of uncertainty. ERM, by helping planners to better appreciate the level of uncertainty at which a risk resides and applying the appropriate tools, offers a way to think about issues more holistically and at different levels of predictability, thereby deriving more calibrated and thorough plans.

STRENGTHENING SINGAPORE'S COMPETITIVE ADVANTAGE

The realm of greater uncertainty is also a source of greater opportunity. In a predictable environment, Singapore must compete with other countries on known terms and resources. However, in a world where turbulent events are becoming more frequent and intense, a key competitive advantage will reside in Singapore's ability to compete in terms of speculative capabilities—making successful strategic bets despite limited or imperfect information. As countries continue to grapple with how best to deal with great uncertainty, Singapore can seize the initiative by leveraging on its small size, networked government and future-oriented outlook to tackle issues head on and in advance.

The work of any effective government involves sensing, strategy-making and implementation. Individually, these elements may at best be adequate in an uncertain environment. The value of ERM is in providing a framework that exploits the synergy and feedback between these mechanisms.

Sensing

In a volatile environment, it is imperative to have the capacity to process information and make sense of the surrounding events. Sensing is about detecting the weak signals presaging turbulent events. To find these weak signals requires not only sound hypothesis-making and insightful analytics, but also a culture that allows pertinent signals to bubble up to top management.

Strategy-Making

For each level of uncertainty, there are tools available to manage vulnerabilities (the downside of risks) and seek opportunities (the upside of risks). Clearly, it is important to first appreciate at which level of uncertainty an identified risk resides, since to underestimate a risk is to potentially be exposed to its unmitigated effects. For instance, an investor who relied solely on historic market data would probably have had a rude shock when the financial crisis struck.

Managing Vulnerabilities

At the first level of predictability ("Known Knowns"), one has high confidence that the future is known and looks very much like the past. Therefore, strategic planning simply involves allocating resources based on extrapolating from past events. Such environments are now very rare. Even when it occurs, it can be dealt with using Specific Operation Plans (SOPs). Since scenarios have been pre-specified, specific contingency plans may be put in place, with actions specified in each scenario.

At Level 2 ("Known Unknowns"), plausible scenarios are presumed to be known, so resources may be applied directly to lower the risk at source. For major contingencies, scenarios can be plentiful—the key to managing such a broad range of possibilities is not to create individual response plans, but to develop deep pockets of capabilities. When necessary, these capabilities can be applied to manage any fallout.

The risk incurred by organisations that have become very adept at scenario-based vulnerability management, and which then cease to plan beyond Level 2, is to be blindsided by inadequate scenarios or unforeseen circumstances. For example, assuming a discrete number of terrorist tactics will blind security forces to terrorist innovations such as the September 11 attacks. Therefore, effective strategies should not rely on knowing the specific source or nature of a risk, only its dimension of operation. Approaches to managing such vulnerabilities include diffused capacity building, de-correlation of risks, business continuity plans and resilience plans.

Finally, at Level 3 ("Unknown Unknowns"), even the dimension of risk is unknown. Besides building strong sensing mechanisms to give some early warning, organisations need to be able to react quickly to events. Therefore, the ability to assemble emergency response teams on the fly and subsequently dissolve them quickly to restore normalcy is crucial in dealing with strategic surprises and black swans.

Such "Hastily Formed Networks" or HFNs are a key to systemic responsiveness. This capability to group and ungroup task forces swiftly was an important factor in Singapore's successful battle with SARS in 2004. Similarly, when the financial crisis struck in late 2008, governments which had the ability to react quickly saw better outcomes than those where bureaucratic obstacles slowed down decision-making and response. By the same token, enhancing flexibility in planning (for example, adopting quarter-to-quarter planning frameworks) and flexibility in problem solving (e.g., developing HFNs) would allow better preparation for such uncertainty. This has implications on the way government organises itself. There could be a lot more organically and spontaneously formed need-based groupings, rather than more rigid structures that are costly to maintain.

Seizing Opportunities

Implementations of ERM that focus solely on managing vulnerabilities fail to recognise the value of a risk-oriented approach in seizing opportunities.

Traditional cost-benefit analysis would suffice to analyse opportunities at relatively low levels of uncertainty (Level 1). Given discrete options, portfolio management and game theory may shed light on the best set of opportunities to pursue.

However, true opportunities begin to reveal themselves in regions of greater uncertainty (Level 2). Here, Blue Ocean thinking² helps to systematically explore new opportunities. The value innovator is the person who is able to make smart trade-offs, sensing where risk must be taken to exploit new opportunities. Conversely, there must be significant uncertainty for such strategies to prevail.

In Level 3, where even the dimensions of risk cannot be fathomed, seizing opportunities no longer relies on a specific framework. Instead, opportunities are best sought through an appropriate market system which encourages experimentation and accepts failure. By the law of large numbers, a small number of entrepreneurs will find breakthrough opportunities. Such market systems require government action to promote free market forces: by providing accessible infrastructure, making available seed funding and removing market entry barriers. In Singapore, however, given our small size, it may be necessary to "strategically direct" innovation by identifying a promising industry, sector or research area. The performance of these attempts should not be measured only by the number and value of successes, but also the learning value that we extract from each experiment.

Good ERM measures can themselves become opportunities. For example, Singapore's approach to managing its risks and vulnerabilities with respect to water supply has led to its being recognised as a world leader in water management and technology.

MAKING THE MOST OF ERM: GUIDING PRINCIPLES

In order to fully exploit the value proposition of ERM as a unifying platform for strategic thinking, planning and advantage, three guiding principles are proposed:

1. Develop the common language of ERM

Effective dialogue is founded on a common language. Although risk management is a mature concept, ERM has taken on several different manifestations. To effectively work across ministries and departments, we need to decide on a common language and a unified process. A forthcoming manual created by the ERM workgroup will provide the initial basis for just such a common language for the Singapore Public Service.

2. Link ERM with resource planning and allocation and decide trade-offs at the highest levels

In every resource planning and allocation exercise, ERM should feature as a key framework in management decisionmaking. This will also link background thinking and considerations to actual policy and planning, in a coherent manner that facilitates future thinking and review.

3. Implement ERM through WOG groups, but these groups should change periodically

Across ministries and departments, there is no natural platform best suited to considering the cross-cutting issues raised by risk scanning or assessment. Therefore, ERM groups need to be deliberately formed for this task. Given the diversity of issues and players, there is no one correct way to organise these groups. Nonetheless, to facilitate work, some logical groupings will need to be established. However, these groupings should not be permanent, to avoid hardening of perspectives or bureaucratic constraints. One possible option could be a central Risk Office to coordinate efforts of different groups and ensure alignment with strategic WOG objectives.

CONCLUSION

The ability of ERM to raise issues that cut across organisational boundaries and unify by offering a common platform for analysis and discussion makes it a very useful framework for the WOG strategic planning process, across different levels of organisation and layers of uncertainty. ERM also focuses attention on possible turbulent events: offering a powerful strategic edge to any country that has to navigate an ever more unpredictable and complex world. Singapore, with a nimble, integrated and able Government, can seize this initiative to position itself as a leading country at the global forefront of coping with Turbulence.

NOTES

1. The four levels of uncertainty in Figure 1 are drawn from "Strategy under Uncertainty" by Hugh G. Courtney, Jane Kirkland and S. Patrick Viguerie, McKinsey Quarterly (June 2000). For the purposes of this article, we have aggregated the risks into three classes: "Known Knowns", "Known Unknowns" and "Unknown Unknowns".
2. Blue Ocean thinking, coined by W. Chan Kim and Renee Mauborgne, refers to challenging the norm, moving out of one's comfort zone and exploring uncharted space so as to spur creative and intellectual breakthroughs.