Picture a management meeting. The growth potential of a new service is under discussion. The sales team describes customer interest, the finance team questions the costs. In the end, someone sums up: “Let’s wait until it becomes a bit clearer.” Sometimes this sentence expresses a very sound decision. Sometimes it covers up a postponement for which no one takes responsibility. The difference lies in what we want to learn while we wait, and in whether we have calculated the cost of waiting.
Strategy is a choice about the future
Strategy is a choice about the future. When we allocate resources to a customer group, a capability or a business model, we give up other possibilities – in other words, we pay an opportunity cost. Because the future cannot be fully known, this choice carries risk. Leadership, in turn, requires standing behind the choice, explaining its limits and reassessing it when new information arrives. A strategy discussion that never mentions risk-taking may be leaving out the real cost of its choices.
Yet it is easy to romanticize the call to take risks. When courage replaces calculation, the decision-maker is not the only one who pays the price. Employees, customers and partners also bear the consequences. That is why the question a leader has to answer is this: to gain what, how much loss do we accept, based on what evidence and under what conditions? If this question has no answer, courage has no limits either.
The distinction between certainty and clarity
This is where the distinction between certainty and clarity matters. Certainty is the claim to know what will happen. Clarity is knowing what purpose we are acting for, who will decide and at what development we will change direction. A leader cannot make certain how the market will behave next year. They can, however, explain which customer problem the team will focus on, within which resource limits it will work and when it will assess the first results.
Nor is it right to handle all uncertainty with the same method. The approach to strategy under uncertainty developed by Courtney and his colleagues distinguishes situations in which the future is clear enough from those in which the alternatives, and even the range of possible outcomes, are hard to define. The practical meaning of this distinction is this: where data supports it, we calculate; where we cannot produce a reliable probability, we test scenarios, reduce our commitment and design for learning. Assigning a percentage to every uncertainty does not make it measurable. [1]
Probability, impact and expected loss
In risk assessment, probability and impact are a basic starting point. NIST’s risk assessment guide for information systems considers these elements together with assumptions and uncertainty. We cannot use this guide as a ready-made recipe for the whole of company strategy; but the discipline of making the basis of an estimate visible can be carried over to executive decisions too. If the probability of a disruption occurring within a year is 20 percent, and the average loss if it occurs is 500,000 Turkish lira, the expected loss is 100,000 lira. This amount does not show the upper limit of the loss. If the event occurs, a much larger loss may be incurred. [2]
Let us think about this distinction through an investment decision. Let us define three outcomes for an entirely hypothetical B2B service. Over twelve months, after all relevant costs have been deducted, there is a 30 percent probability of gaining 2 million lira, a 45 percent probability of gaining 400,000 lira, and a 25 percent probability of losing 1.2 million lira. The probability-weighted net result is plus 480,000 lira. These three outcomes form a simplified distribution that is mutually exclusive and, in the example, covers all possibilities. A real investment may have more outcomes and cash flows at different times.
So is a positive expected result enough to invest? If the company has accepted a loss of only 600,000 lira for this decision, the severe scenario in the example reaches twice that limit. While the average looks attractive, the limit the organization has accepted is exceeded. HM Treasury’s Orange Book approach also links risk assessment to an organization’s objectives and the level of risk it is willing to take. The loss an organization can withstand and the loss it chooses to accept for a particular decision are not the same thing. [3]
The Strategic Risk Decision Canvas
At this point, the Strategic Risk Decision Canvas I propose brings six areas to the same table: strategic value, probability and evidence, size of loss, carrying capacity, reversibility and learning conditions. It is an application framework that connects existing risk management principles to executive decisions; it is not a scale whose scientific validity has been tested. Its aim is not to give executives a single magic score but to make the foundations and limits of the decision visible.
The team that fills in the canvas first explains why the opportunity matters. It then examines what data the probabilities are based on, what will happen in the severe negative scenario and how that loss would be covered. In the final stage, it determines the cost of reversal and at which signal it will intervene. It should be able to write “we don’t know” in an area where it does not know the probability. This openness makes it possible to design a customer test or a smaller trial that would fill the gap.
Breaking decisions into stages
Breaking decisions into stages can help here. The distinction between reversible decisions and decisions that are hard to reverse, set out in Amazon’s 2015 letter to shareholders, explains that different commitments may require different decision processes. We cannot say that testing a service with a small number of customers and making a long-term fixed investment in it are the same decision. But a pilot also has a cost and limits. Whether results obtained in a small trial will hold at a large scale needs to be assessed separately. [4]
A significant part of risk grows within the organization’s own structure. Dependence on a single customer, knowledge held by a single person or projects tied to the same supplier can amplify the effect of an external change. That is why, next to the question “What could happen?”, I put the question “If it happens, why would we be affected so much?” We also need to discuss which development could put pressure, at the same time, on decisions that each look acceptable on their own.
The relationship the leader builds with the team
The relationship the leader builds with the team affects the quality of this calculation. If challenging an estimate is seen as dangerous for one’s career, the assessment may remain incomplete even if every cell of the canvas is filled in. Edmondson’s study of 51 teams found a relationship between psychological safety and learning behavior. This finding does not say that every trust-building practice automatically brings success; but it helps us think about why an environment in which people can talk about their concerns and mistakes matters. [5]
In this process, AI can generate counterarguments, separate assumptions and speed up the calculation of different scenarios. We cannot treat a persuasive percentage it produces where there is no data as evidence. The owner of the decision must be the person who verifies the information used and bears responsibility for the results. Updating the assessment when new information arrives is part of the same responsibility.
At the next management meeting
Handling a single decision this way at the next management meeting can be a good start. Let us write down, on the same page, the value we aim to gain, the loss we accept and the signal that would change the decision. If we choose to wait, let us state what we are waiting for and on what date we will decide again. Strategy chooses which risk is worth taking. Leadership sets the limits of that risk and the responsibility for it. As the organization compares its decisions with their results, it develops its own ability to take risks.
Sources
- Courtney, Kirkland and Viguerie. Strategy under uncertainty. Open the source.
- NIST. SP 800-30 Rev. 1, Guide for Conducting Risk Assessments (2012). Open the source.
- HM Treasury. The Orange Book, Management of Risk. Open the source.
- Amazon. 2015 Letter to Shareholders. Open the source.
- Amy Edmondson. Psychological Safety and Learning Behavior in Work Teams (1999). Open the source.