Companies increasingly face the need for transformation in today’s rapidly changing business environment, characterized by major shifts in technology, regulation, and customer behavior. A lack of strategic risk insight and foresightleaves many incumbents insufficiently prepared in the face of such deep uncertainty. We argue that traditional risk management falls short because it predominantly focuses on strategy execution while leaving strategy formulation largely untouched. Moreover, an administrative-heavy risk management process can create strategic inertia and a misleading sense of control. In today’s dynamic business context, companies must not only increase the speed and impact of their strategy execution but also continuously explore the development of new strategies in response to disruptive events or emerging opportunities. Our research shows how leading companies develop a strategic risk management (SRM) capability to increase their resilience and agility in response to deep uncertainty. SRM takes a strategic, forward-looking perspective and focuses on strengthening processes, people, and practices for purposefully integrating risk into the strategy formulation process. This article offers a framework with three proven configurations of content and timing integration, risk management roles, and leading practices that enable effective SRM. # 2018 Kelley School of Business, Indiana University. Published by Elsevier Inc. All rights reserved.

Risk management in a dynamic environment: Need for a new capability

Companies today operate in turbulent times. They deal with a multitude of external and uncontrollable risks such as rapid technological development, shifting customer behavior, new business models, increased regulatory pressure, and competition from unexpected geographies and sectors. Such dynamic business environments are often characterized by high velocity, complexity, ambiguity, and unpredictability (Davis, Eisenhardt, & Bingham, 2009). Companies face many new–—yet sometimes difficultto identify–—opportunities orthreats, and it is not always clear when potential disruption might hit and what to do in response. They experience deep uncertainty, which is characterized by a multitude of unknown unknowns (i.e., they do not know what they do not know; Teece, Peteraf, & Leih, 2016). Because of such deep uncertainty, companies seem to be in need of constant transformation. It comes as no surprise then that many management studies focus on how organizations should become more resilient while building and deploying organizational capabilities to adapt dynamically and constantly reinvent themselves. More specifically, the rate of change and the challenge to foresee what future situations are to be imagined must be embedded in how firms address risk and opportunity. The consequence of these shifts is that traditionalrisk management systems and processes, whether purely operational or enterprise-wide, are no longer considered appropriate for helping companies address risk and uncertainty in this new reality. Examples abound of companies devoting significant resources to state-of-the-art risk management systems while missing key strategic risks that led them into severe difficulties. Examples of corporations failing to anticipate and adequately respond to strategic risks include: Nokia being insufficiently sensitive to the technological evolution in the smartphone industry (Doz & Kosonen, 2011), news corporations such as The New York Times Company initially struggling with online news consumption, fashion retailer Abercrombie & Fitch missing shifting buyer values, and digital music disrupting Universal Music Group and other large music corporations. While advocates argue that efficient risk management practices are an important way to avoid corporate disaster (Stulz, 2008), some skeptics see risk management as part of the problem itself (Power, 2004, 2009). To the extent that the rigorous pursuit of systems and procedures leads managers to believe that their companies are safeguarded against all kinds of risk and uncertainty, traditional risk management may actually blindside them from the threats and opportunities related to deep uncertainty.