STRATEGIC PLANNINGManaging Risks A NewFrameworkby Rob.docx

STRATEGIC PLANNING
Managing Risks: A New
Framework
by Robert S. Kaplan and Anette Mikes
FROM THE JUNE 2012 ISSUE
W
Editors’ Note: Since this issue of HBR went to press, JP
Morgan, whose risk management practices are
highlighted in this article, revealed significant trading losses at
one of its units. The authors provide
their commentary on this turn of events in their contribution to
HBR’s Insight Center on Managing
Risky Behavior.
hen Tony Hayward became CEO of BP, in 2007, he vowed to
make safety his top
priority. Among the new rules he instituted were the
requirements that all
employees use lids on coffee cups while walking and refrain
from texting while
driving. Three years later, on Hayward’s watch, the Deepwater
Horizon oil rig exploded in the Gulf

of Mexico, causing one of the worst man-made disasters in
history. A U.S. investigation commission
attributed the disaster to management failures that crippled “the
ability of individuals involved to
identify the risks they faced and to properly evaluate,
communicate, and address them.” Hayward’s
story reflects a common problem. Despite all the rhetoric and
money invested in it, risk
management is too often treated as a compliance issue that can
be solved by drawing up lots of rules
and making sure that all employees follow them. Many such
rules, of course, are sensible and do
reduce some risks that could severely damage a company. But
rules-based risk management will not
diminish either the likelihood or the impact of a disaster such as
Deepwater Horizon, just as it did
not prevent the failure of many financial institutions during the
2007–2008 credit crisis.
Identifying and Managing
Preventable Risks
In this article, we present a new categorization of risk that
allows executives to tell which risks can

be managed through a rules-based model and which require
alternative approaches. We examine
the individual and organizational challenges inherent in
generating open, constructive discussions
about managing the risks related to strategic choices and argue
that companies need to anchor these
discussions in their strategy formulation and implementation
processes. We conclude by looking at
how organizations can identify and prepare for nonpreventable
risks that arise externally to their
strategy and operations.
Managing Risk: Rules or Dialogue?
The first step in creating an effective risk-management system
is to understand the qualitative
distinctions among the types of risks that organizations face.
Our field research shows that risks fall
into one of three categories. Risk events from any category can
be fatal to a company’s strategy and
even to its survival.
Category I: Preventable risks.
These are internal risks, arising from within the organization,
that are controllable and ought to be
eliminated or avoided. Examples are the risks from employees’
and managers’ unauthorized, illegal,

unethical, incorrect, or inappropriate actions and the risks from
breakdowns in routine operational
processes. To be sure, companies should have a zone of
tolerance for defects or errors that would
not cause severe damage to the enterprise and for which
achieving complete avoidance would be
too costly. But in general, companies should seek to eliminate
these risks since they get no strategic
benefits from taking them on. A rogue trader or an employee
bribing a local official may produce
some short-term profits for the firm, but over time such actions
will diminish the company’s value.
This risk category is best managed through active prevention:
monitoring operational processes and
guiding people’s behaviors and decisions toward desired norms.
Since considerable literature
already exists on the rules-based compliance approach, we refer
interested readers to the sidebar
“Identifying and Managing Preventable Risks” in lieu of a full
discussion of best practices here.
Category II: Strategy risks.
A company voluntarily accepts some risk in order
to generate superior returns from its strategy. A

bank assumes credit risk, for example, when it
Companies cannot anticipate every
circumstance or conflict of interest that an
employee might encounter.
Thus, the first line of defense against
preventable risk events is to provide
guidelines clarifying the company’s goals
and values.
The Mission
A well-crafted mission statement
articulates the organization’s fundamental
purpose, serving as a “true north” for all
employees to follow. The first sentence of
Johnson & Johnson’s renowned credo, for
instance, states, “We believe our first
responsibility is to the doctors, nurses and
patients, to mothers and fathers, and all
others who use our products and
services,” making clear to all employees
whose interests should take precedence in
any situation. Mission statements should
be communicated to and understood by
all employees.
The Values
Companies should articulate the values
that guide employee behavior toward
principal stakeholders, including
customers, suppliers, fellow employees,

communities, and shareholders. Clear
value statements help employees avoid
violating the company’s standards and
putting its reputation and assets at risk.
The Boundaries
A strong corporate culture clarifies what is
not allowed. An explicit definition of
boundaries is an effective way to control
actions. Consider that nine of the Ten
Commandments and nine of the first 10
amendments to the U.S. Constitution
(commonly known as the Bill of Rights) are
written in negative terms. Companies
need corporate codes of business conduct
lends money; many companies take on risks
through their research and development
activities.
Strategy risks are quite different from preventable
risks because they are not inherently undesirable.
A strategy with high expected returns generally
requires the company to take on significant risks,
and managing those risks is a key driver in
capturing the potential gains. BP accepted the
high risks of drilling several miles below the

surface of the Gulf of Mexico because of the high
value of the oil and gas it hoped to extract.
Strategy risks cannot be managed through a rules-
based control model. Instead, you need a risk-
management system designed to reduce the
probability that the assumed risks actually
materialize and to improve the company’s ability
to manage or contain the risk events should they
occur. Such a system would not stop companies
from undertaking risky ventures; to the contrary,
it would enable companies to take on higher-risk,
higher-reward ventures than could competitors
with less effective risk management.
Category III: External risks.
Some risks arise from events outside the company
and are beyond its influence or control. Sources of
these risks include natural and political disasters
and major macroeconomic shifts. External risks

require yet another approach. Because companies
cannot prevent such events from occurring, their
that prescribe behaviors relating to
conflicts of interest, antitrust issues, trade
secrets and confidential information,
bribery, discrimination, and harassment.
Of course, clearly articulated statements
of mission, values, and boundaries don’t
in themselves ensure good behavior. To
counter the day-to-day pressures of
organizational life, top managers must
serve as role models and demonstrate
that they mean what they say. Companies
must institute strong internal control
systems, such as the segregation of duties
and an active whistle-blowing program, to
reduce not only misbehavior but also
temptation. A capable and independent
internal audit department tasked with
continually checking employees’
compliance with internal controls and
standard operating processes also will
deter employees from violating company
procedures and policies and can detect
violations when they do occur.
See also Robert Simons’s article on
managing preventable risks, “How Risky Is
Your Company?” (HBR May 1999), and his
book Levers of Control (Harvard Business
School Press, 1995).

management must focus on identification (they
tend to be obvious in hindsight) and mitigation of
their impact.
Companies should tailor their risk-management
processes to these different categories. While a
compliance-based approach is effective for
managing preventable risks, it is wholly
inadequate for strategy risks or external risks,
which require a fundamentally different approach
based on open and explicit risk discussions. That,
however, is easier said than done; extensive
behavioral and organizational research has shown
that individuals have strong cognitive biases that
discourage them from thinking about and
discussing risk until it’s too late.
Why Risk Is Hard to Talk About
Multiple studies have found that people
overestimate their ability to influence events that,

in fact, are heavily determined by chance. We
tend to be overconfident about the accuracy of our
forecasts and risk assessments and far too narrow
in our assessment of the range of outcomes that
may occur.
We also anchor our estimates to readily available evidence
despite the known danger of making
linear extrapolations from recent history to a highly uncertain
and variable future. We often
compound this problem with a confirmation bias, which drives
us to favor information that supports
our positions (typically successes) and suppress information
that contradicts them (typically
failures). When events depart from our expectations, we tend to
escalate commitment, irrationally
directing even more resources to our failed course of action—
throwing good money after bad.
Organizational biases also inhibit our ability to discuss risk and
failure. In particular, teams facing
uncertain conditions often engage in groupthink: Once a course
of action has gathered support

within a group, those not yet on board tend to suppress their
objections—however valid—and fall in
line. Groupthink is especially likely if the team is led by an
overbearing or overconfident manager
who wants to minimize conflict, delay, and challenges to his or
her authority.
Collectively, these individual and organizational biases explain
why so many companies overlook or
misread ambiguous threats. Rather than mitigating risk, firms
actually incubate risk through the
normalization of deviance,as they learn to tolerate apparently
minor failures and defects and treat
early warning signals as false alarms rather than alerts to
imminent danger.
Effective risk-management processes must counteract those
biases. “Risk mitigation is painful, not
a natural act for humans to perform,” says Gentry Lee, the chief
systems engineer at Jet Propulsion
Laboratory (JPL), a division of the U.S. National Aeronautics
and Space Administration. The rocket
scientists on JPL project teams are top graduates from elite
universities, many of whom have never
experienced failure at school or work. Lee’s biggest challenge
in establishing a new risk culture at

JPL was to get project teams to feel comfortable thinking and
talking about what could go wrong
with their excellent designs.
Rules about what to do and what not to do won’t help here. In
fact, they usually have the opposite
effect, encouraging a checklist mentality that inhibits challenge
and discussion. Managing strategy
risks and external risks requires very different approaches. We
start by examining how to identify
and mitigate strategy risks.
Managing Strategy Risks
Over the past 10 years of study, we’ve come across three
distinct approaches to managing strategy
risks. Which model is appropriate for a given firm depends
largely on the context in which an
organization operates. Each approach requires quite different
structures and roles for a risk-
management function, but all three encourage employees to
challenge existing assumptions and
debate risk information. Our finding that “one size does not fit
all” runs counter to the efforts of
regulatory authorities and professional associations to
standardize the function.

Independent experts.
Some organizations—particularly those like JPL that push the
envelope of technological innovation
—face high intrinsic risk as they pursue long, complex, and
expensive product-development
projects. But since much of the risk arises from coping with
known laws of nature, the risk changes
slowly over time. For these organizations, risk management can
be handled at the project level.
JPL, for example, has established a risk review board made up
of independent technical experts
whose role is to challenge project engineers’ design, risk-
assessment, and risk-mitigation decisions.
The experts ensure that evaluations of risk take place
periodically throughout the product-
development cycle. Because the risks are relatively unchanging,
the review board needs to meet
only once or twice a year, with the project leader and the head
of the review board meeting
quarterly.
The risk review board meetings are intense, creating what
Gentry Lee calls “a culture of intellectual

confrontation.” As board member Chris Lewicki says, “We tear
each other apart, throwing stones
and giving very critical commentary about everything that’s
going on.” In the process, project
engineers see their work from another perspective. “It lifts their
noses away from the grindstone,”
Lewicki adds.
The meetings, both constructive and confrontational, are not
intended to inhibit the project team
from pursuing highly ambitious missions and designs. But they
force engineers to think in advance
about how they will describe and defend their design decisions
and whether they have sufficiently
considered likely failures and defects. The board members,
acting as devil’s advocates,
counterbalance the engineers’ natural overconfidence, helping
to avoid escalation of commitment
to projects with unacceptable levels of risk.
At JPL, the risk review board not only promotes vigorous
debate about project risks but also has
authority over budgets. The board establishes cost and time
reserves to be set aside for each project
component according to its degree of innovativeness. A simple

extension from a prior mission
would require a 10% to 20% financial reserve, for instance,
whereas an entirely new component that
had yet to work on Earth—much less on an unexplored planet—
could require a 50% to 75%
contingency. The reserves ensure that when problems inevitably
arise, the project team has access
to the money and time needed to resolve them without
jeopardizing the launch date. JPL takes the
estimates seriously; projects have been deferred or canceled if
funds were insufficient to cover
recommended reserves.
Facilitators.
Many organizations, such as traditional energy and water
utilities, operate in stable technological
and market environments, with relatively predictable customer
demand. In these situations risks
stem largely from seemingly unrelated operational choices
across a complex organization that
accumulate gradually and can remain hidden for a long time.
Since no single staff group has the knowledge to perform
operational-level risk management across

diverse functions, firms may deploy a relatively small central
risk-management group that collects
information from operating managers. This increases managers’
awareness of the risks that have
been taken on across the organization and provides decision
makers with a full picture of the
company’s risk profile.
We observed this model in action at Hydro One, the Canadian
electricity company. Chief risk officer
John Fraser, with the explicit backing of the CEO, runs dozens
of workshops each year at which
employees from all levels and functions identify and rank the
principal risks they see to the
company’s strategic objectives. Employees use an anonymous
voting technology to rate each risk,
on a scale of 1 to 5, in terms of its impact, the likelihood of
occurrence, and the strength of existing
controls. The rankings are discussed in the workshops, and
employees are empowered to voice and
debate their risk perceptions. The group ultimately develops a
consensus view that gets recorded on
a visual risk map, recommends action plans, and designates an
“owner” for each major risk.
Risk management is painful—not a natural act

for humans to perform.
The danger from embedding risk managers
within the line organization is that they “go
native”—becoming deal makers rather than
deal questioners.
Hydro One strengthens accountability by linking capital
allocation and budgeting decisions to
identified risks. The corporate-level capital-planning process
allocates hundreds of millions of
dollars, principally to projects that reduce risk effectively and
efficiently. The risk group draws upon
technical experts to challenge line engineers’ investment plans
and risk assessments and to provide
independent expert oversight to the resource allocation process.
At the annual capital allocation
meeting, line managers have to defend their proposals in front
of their peers and top executives.
Managers want their projects to attract funding in the risk-based
capital planning process, so they
learn to overcome their bias to hide or minimize the risks in
their areas of accountability.
Embedded experts.
The financial services industry poses a unique challenge
because of the volatile dynamics of asset

markets and the potential impact of decisions made by
decentralized traders and investment
managers. An investment bank’s risk profile can change
dramatically with a single deal or major
market movement. For such companies, risk management
requires embedded experts within the
organization to continuously monitor and influence the
business’s risk profile, working side by side
with the line managers whose activities are generating new
ideas, innovation, and risks—and, if all
goes well, profits.
JP Morgan Private Bank adopted this model in 2007, at the
onset of the global financial crisis. Risk
managers, embedded within the line organization, report to both
line executives and a centralized,
independent risk-management function. The face-to-face contact
with line managers enables the
market-savvy risk managers to continually ask “what if ”
questions, challenging the assumptions of
portfolio managers and forcing them to look at different
scenarios. Risk managers assess how
proposed trades affect the risk of the entire investment
portfolio, not only under normal

circumstances but also under times of extreme stress, when the
correlations of returns across
different asset classes escalate. “Portfolio managers come to me
with three trades, and the [risk]
model may say that all three are adding to the same type of
risk,” explains Gregoriy Zhikarev, a risk
manager at JP Morgan. “Nine times out of 10 a manager will
say, ‘No, that’s not what I want to do.’
Then we can sit down and redesign the trades.”
The chief danger from embedding risk managers within the line
organization is that they “go
native,” aligning themselves with the inner circle of the
business unit’s leadership team—becoming
deal makers rather than deal questioners. Preventing this is the
responsibility of the company’s
Understanding the Three
Categories of Risk
The risks that companies face fall into
three categories, each of which requires a
different risk-management approach.
Preventable risks, arising from within an
organization, are monitored and
controlled through rules, values, and
standard compliance tools. In contrast,
strategy risks and external risks require
distinct processes that encourage

managers to openly discuss risks and find
cost-effective ways to reduce the
likelihood of risk events or mitigate their
consequences.
senior risk officer and—ultimately—the CEO, who sets the tone
for a company’s risk culture.
Avoiding the Function Trap
Even if managers have a system that promotes rich discussions
about risk, a second cognitive-
behavioral trap awaits them. Because many strategy risks (and
some external risks) are quite
predictable—even familiar—companies tend to label and
compartmentalize them, especially along
business function lines. Banks often manage what they label
“credit risk,” “market risk,” and
“operational risk” in separate groups. Other companies
compartmentalize the management of
“brand risk,” “reputation risk,” “supply chain risk,” “human
resources risk,” “IT risk,” and “financial
risk.”
Such organizational silos disperse both
information and responsibility for effective risk
management. They inhibit discussion of how

different risks interact. Good risk discussions
must be not only confrontational but also
integrative. Businesses can be derailed by a
combination of small events that reinforce one
another in unanticipated ways.
Managers can develop a companywide risk
perspective by anchoring their discussions in
strategic planning, the one integrative process
that most well-run companies already have. For
example, Infosys, the Indian IT services company,
generates risk discussions from the Balanced
Scorecard, its management tool for strategy
measurement and communication. “As we asked
ourselves about what risks we should be looking
at,” says M.D. Ranganath, the chief risk officer,
“we gradually zeroed in on risks to business
objectives specified in our corporate scorecard.”

The Risk Event Card The Risk Report Card
In building its Balanced Scorecard, Infosys had
identified “growing client relationships” as a key
objective and selected metrics for measuring
progress, such as the number of global clients
with annual billings in excess of $50 million and
the annual percentage increases in revenues from
large clients. In looking at the goal and the
performance metrics together, management
realized that its strategy had introduced a new
risk factor: client default. When Infosys’s
business was based on numerous small clients, a
single client default would not jeopardize the
company’s strategy. But a default by a $50 million
client would present a major setback. Infosys
began to monitor the credit default swap rate of
every large client as a leading indicator of the
likelihood of default. When a client’s rate

increased, Infosys would accelerate collection of
receivables or request progress payments to
reduce the likelihood or impact of default.
To take another example, consider Volkswagen do Brasil
(subsequently abbreviated as VW), the
Brazilian subsidiary of the German carmaker. VW’s risk-
management unit uses the company’s
strategy map as a starting point for its dialogues about risk. For
each objective on the map, the group
identifies the risk events that could cause VW to fall short of
that objective. The team then generates
a Risk Event Card for each risk on the map, listing the practical
effects of the event on operations,
the probability of occurrence, leading indicators, and potential
actions for mitigation. It also
identifies who has primary accountability for managing the risk.
(See the exhibit “The Risk Event
Card.”) The risk team then presents a high-level summary of
results to senior management. (See
“The Risk Report Card.”)
VW do Brasil uses risk event cards to
assess its strategy risks. First, managers

document the risks associated with
achieving each of the company’s strategic
objectives. For each identified risk,
managers create a risk card that lists the
practical effects of the event’s occurring
on operations. Below is a sample card
looking at the effects of an interruption in
deliveries, which could jeopardize VW’s
strategic objective of achieving a smoothly
functioning supply chain.
VW do Brasil summarizes its strategy risks
on a Risk Report Card organized by
strategic objectives (excerpt below).
Managers can see at a glance how many of
the identified risks for each objective are
critical and require attention or
mitigation. For instance, VW identified 11
risks associated with achieving the goal
“Satisfy the customer’s expectations.”
Four of the risks were critical, but that was
an improvement over the previous
quarter’s assessment. Managers can also
monitor progress on risk management
across the company.
Beyond introducing a systematic process for identifying and
mitigating strategy risks, companies
also need a risk oversight structure. Infosys uses a dual
structure: a central risk team that identifies
general strategy risks and establishes central policy, and
specialized functional teams that design
and monitor policies and controls in consultation with local

business teams. The decentralized
teams have the authority and expertise to help the business lines
respond to threats and changes in
their risk profiles, escalating only the exceptions to the central
risk team for review. For example, if a
client relationship manager wants to give a longer credit period
to a company whose credit risk
parameters are high, the functional risk manager can send the
case to the central team for review.
These examples show that the size and scope of the risk
function are not dictated by the size of the
organization. Hydro One, a large company, has a relatively
small risk group to generate risk
awareness and communication throughout the firm and to advise
the executive team on risk-based
resource allocations. By contrast, relatively small companies or
units, such as JPL or JP Morgan
Private Bank, need multiple project-level review boards or
teams of embedded risk managers to
apply domain expertise to assess the risk of business decisions.
And Infosys, a large company with
broad operational and strategic scope, requires a strong
centralized risk-management function as

well as dispersed risk managers who support local business
decisions and facilitate the exchange of
information with the centralized risk group.
Managing the Uncontrollable
External risks, the third category of risk, cannot typically be
reduced or avoided through the
approaches used for managing preventable and strategy risks.
External risks lie largely outside the
company’s control; companies should focus on identifying
them, assessing their potential impact,
and figuring out how best to mitigate their effects should they
occur.
Some external risk events are sufficiently imminent that
managers can manage them as they do
their strategy risks. For example, during the economic
slowdown after the global financial crisis,
Infosys identified a new risk related to its objective of
developing a global workforce: an upsurge in
protectionism, which could lead to tight restrictions on work
visas and permits for foreign nationals
in several OECD countries where Infosys had large client
engagements. Although protectionist
legislation is technically an external risk since it’s beyond the

company’s control, Infosys treated it
as a strategy risk and created a Risk Event Card for it, which
included a new risk indicator: the
number and percentage of its employees with dual citizenships
or existing work permits outside
India. If this number were to fall owing to staff turnover,
Infosys’s global strategy might be
jeopardized. Infosys therefore put in place recruiting and
retention policies that mitigate the
consequences of this external risk event.
Most external risk events, however, require a different analytic
approach either because their
probability of occurrence is very low or because managers find
it difficult to envision them during
their normal strategy processes. We have identified several
different sources of external risks:
Natural and economic disasters with immediate impact. These
risks are predictable in a general
way, although their timing is usually not (a large earthquake
will hit someday in California, but
there is no telling exactly where or when). They may be
anticipated only by relatively weak
signals. Examples include natural disasters such as the 2010
Icelandic volcano eruption that

closed European airspace for a week and economic disasters
such as the bursting of a major asset
price bubble. When these risks occur, their effects are typically
drastic and immediate, as we saw
in the disruption from the Japanese earthquake and tsunami in
2011.
Geopolitical and environmental changes with long-term impact.
These include political shifts such
as major policy changes, coups, revolutions, and wars; long-
term environmental changes such as
global warming; and depletion of critical natural resources such
as fresh water.
Competitive risks with medium-term impact. These include the
emergence of disruptive
technologies (such as the internet, smartphones, and bar codes)
and radical strategic moves by
industry players (such as the entry of Amazon into book
retailing and Apple into the mobile
phone and consumer electronics industries).
Companies use different analytic approaches for each of the
sources of external risk.
Tail-risk stress tests.

Stress-testing helps companies assess major changes in one or
two specific variables whose effects
would be major and immediate, although the exact timing is not
forecastable. Financial services
firms use stress tests to assess, for example, how an event such
as the tripling of oil prices, a large
swing in exchange or interest rates, or the default of a major
institution or sovereign country would
affect trading positions and investments.
The benefits from stress-testing, however, depend critically on
the assumptions—which may
themselves be biased—about how much the variable in question
will change. The tail-risk stress
tests of many banks in 2007–2008, for example, assumed a
worst-case scenario in which U.S.
housing prices leveled off and remained flat for several periods.
Very few companies thought to test
what would happen if prices began to decline—an excellent
example of the tendency to anchor
estimates in recent and readily available data. Most companies
extrapolated from recent U.S.
housing prices, which had gone several decades without a
general decline, to develop overly
optimistic market assessments.

Scenario planning.
A firm’s ability to weather storms depends on
how seriously executives take risk management
when the sun is shining and no clouds are on
the horizon.
This tool is suited for long-range analysis, typically five to 10
years out. Originally developed at Shell
Oil in the 1960s, scenario analysis is a systematic process for
defining the plausible boundaries of
future states of the world. Participants examine political,
economic, technological, social,
regulatory, and environmental forces and select some number of
drivers—typically four—that would
have the biggest impact on the company. Some companies
explicitly draw on the expertise in their
advisory boards to inform them about significant trends, outside
the company’s and industry’s day-
to-day focus, that should be considered in their scenarios.
For each of the selected drivers, participants estimate maximum
and minimum anticipated values
over five to 10 years. Combining the extreme values for each of
four drivers leads to 16 scenarios.

About half tend to be implausible and are discarded;
participants then assess how their firm’s
strategy would perform in the remaining scenarios. If managers
see that their strategy is contingent
on a generally optimistic view, they can modify it to
accommodate pessimistic scenarios or develop
plans for how they would change their strategy should early
indicators show an increasing
likelihood of events turning against it.
War-gaming.
War-gaming assesses a firm’s vulnerability to disruptive
technologies or changes in competitors’
strategies. In a war-game, the company assigns three or four
teams the task of devising plausible
near-term strategies or actions that existing or potential
competitors might adopt during the next
one or two years—a shorter time horizon than that of scenario
analysis. The teams then meet to
examine how clever competitors could attack the company’s
strategy. The process helps to
overcome the bias of leaders to ignore evidence that runs
counter to their current beliefs, including
the possibility of actions that competitors might take to disrupt
their strategy.

Companies have no influence over the likelihood of risk events
identified through methods such as
tail-risk testing, scenario planning, and war-gaming. But
managers can take specific actions to
mitigate their impact. Since moral hazard does not arise for
nonpreventable events, companies can
use insurance or hedging to mitigate some risks, as an airline
does when it protects itself against
sharp increases in fuel prices by using financial derivatives.
Another option is for firms to make
investments now to avoid much higher costs later. For instance,
a manufacturer with facilities in
earthquake-prone areas can increase its construction costs to
protect critical facilities against severe
quakes. Also, companies exposed to different but comparable
risks can cooperate to mitigate them.
For example, the IT data centers of a university in North
Carolina would be vulnerable to hurricane
risk while those of a comparable university on the San Andreas
Fault in California would be
vulnerable to earthquakes. The likelihood that both disasters
would happen on the same day is
small enough that the two universities might choose to mitigate

their risks by backing up each
other’s systems every night.
The Leadership Challenge
Managing risk is very different from managing strategy. Risk
management focuses on the negative—
threats and failures rather than opportunities and successes. It
runs exactly counter to the “can do”
culture most leadership teams try to foster when implementing
strategy. And many leaders have a
tendency to discount the future; they’re reluctant to spend time
and money now to avoid an
uncertain future problem that might occur down the road, on
someone else’s watch. Moreover,
mitigating risk typically involves dispersing resources and
diversifying investments, just the
opposite of the intense focus of a successful strategy. Managers
may find it antithetical to their
culture to champion processes that identify the risks to the
strategies they helped to formulate.
For those reasons, most companies need a separate function to
handle strategy- and external-risk
management. The risk function’s size will vary from company
to company, but the group must

report directly to the top team. Indeed, nurturing a close
relationship with senior leadership will
arguably be its most critical task; a company’s ability to
weather storms depends very much on how
seriously executives take their risk-management function when
the sun is shining and no clouds are
on the horizon.
That was what separated the banks that failed in the financial
crisis from those that survived. The
failed companies had relegated risk management to a
compliance function; their risk managers had
limited access to senior management and their boards of
directors. Further, executives routinely
ignored risk managers’ warnings about highly leveraged and
concentrated positions. By contrast,
Goldman Sachs and JPMorgan Chase, two firms that weathered
the financial crisis well, had strong
internal risk-management functions and leadership teams that
understood and managed the
companies’ multiple risk exposures. Barry Zubrow, chief risk
officer at JP Morgan Chase, told us, “I
may have the title, but [CEO] Jamie Dimon is the chief risk
officer of the company.” Risk
management is nonintuitive; it runs counter to many individual

and organizational biases. Rules
and compliance can mitigate some critical risks but not all of
them. Active and cost-effective risk
management requires managers to think systematically about the
multiple categories of risks they
face so that they can institute appropriate processes for each.
These processes will neutralize their
managerial bias of seeing the world as they would like it to be
rather than as it actually is or could
possibly become.
A version of this article appeared in the June 2012 issue of Harv
ard Business Review.
Robert S. Kaplan is a senior fellow and the Marvin Bower Profe
ssor of Leadership
Development, Emeritus, at Harvard Business School. He is a co
author, with Michael E. Porter, of “How
to Solve the Cost Crisis in Health Care” (HBR, September 2011
).
Anette Mikes is an assistant professor in the accounting and ma
nagement unit at Harvard
Business School.
Related Topics: RISK MANAGEMENT | STRATEGY

This article is about STRATEGIC PLANNING
� FOLLOW THIS TOPIC
Comments
Leave a Comment
P O S T
1 COMMENTS
REPLY 0 � 0 -
Michael Ellegood, P.E. 6 months ago
An interesting article, but one that I am having difficulty in tran
slating into the practice of public project delivery.
Most public projects (roads, bridges, public infrastructure) are d
elivered late and over budget. There are a variety of
causes one of which is poor or nonexistent risk recognition, anal
ysis and management. Yet when you consider the
causes of project failure they usually boil down to one or more
of five very common causes (ROW, utilities, public
acceptance, underground surprises, permitting). I also take issue
with the "non-intuitive" comment, if the
organizational culture promotes risk awareness, then it becomes
very intuitive. As an example, take some flying

lessons, your instructor will make risk awareness and manageme
nt very intuitive.
POSTING GUIDELINES
We hope the conversations that take place on HBR.org will be e
nergetic, constructive, and thought-
provoking. To comment, readers must sign in or
register. And to ensure the quality of the discussion, our modera
ting team will review all comments and may edit them for clarit
y, length, and relevance.
Comments that are overly promotional, mean-spirited, or off-
topic may be deleted per the moderators' judgment. All postings
become the property of
Harvard Business Publishing.
& JOIN THE CONVERSATION
10/30/2019
2
In the U.S. wild west, the eternal battle between the law and the
outlaws keeps
heating up. Suddenly, a rain of arrows darken the sky: It's an
Indian attack!
Are you bold enough to keep up with the Indians?
Do you have the courage to challenge your fate?

Can you expose and defeat the ruthless gunmen around you?
Take one arrow before you can reroll
You cannot reroll this dice. With 3 you lose one point of life,
No more rerolls, if any is left in this turn.
Yet, you can resolve other symbols to finish your turn.
You can shot once the next person , to the right or to the left
With 3 of these you can, use the Gatling gun to shot
everyone once,
and then, dispose of any arrows.
You can shot once the second person to the right or to the
left
If there are only 3 person left, this is the same as Bull’s eye
1.
You can or someone you choose recovers one point of life.
• By turn each players roll the 5 dices.
• You can reroll two times the dices you
do not want to keep.
• Resolve the result of the final roll to
finish your turn.
• Remember your character specific
exceptions to the rules of the dice.
• Be careful with Arrows and Dynamite.
THE DICES

10/30/2019
3
This is you!
No rerolls,
Take two arrows!
Finish your turn!
This is you!
Take one arrow
If you choose to no reroll,
You must shot four times,
Finishing your turn
10/30/2019
4
This is you!
Take one arrow
If you choose to no reroll,
You must shot four times,
Finishing your turn
This is you!

On First Roll - Take one arrow
Reroll Arrow, Bull’s eye 1 & 2
Use Gatling Gun, Shoot everyone,
Drop your arrows
Take to beers to heal yourself or
someone else
10/30/2019
5
NAME
LIFE POINTS
SPECIAL ABILITY
THE
CHARACTERS
Their life points
ranges
from 7 to 9 bullets
Each player has a role that define its goal card:
• Sheriff: must eliminate all Outlaws and the Renegade(s);
• Outlaws: must eliminate the Sheriff;
• Deputies: must help and protect the Sheriff;
• Renegade: must be the last character in play.
Roles present in game per number of participants.

4 players: 1 Sheriff, 1 Renegade, 2 Outlaws;
5 players: 1 Sheriff, 1 Renegade, 2 Outlaws, 1 Deputy;
6 players: 1 Sheriff, 1 Renegade, 3 Outlaws, 1 Deputy;
7 players: 1 Sheriff, 1 Renegade, 3 Outlaws, 2 Deputies;
8 players: 1 Sheriff, 2 Renegades, 3 Outlaws, 2 Deputies
10/30/2019
6
Let’s play!
• The game begins with the Sherriff revealing his role (this
player get two additional life points) taking its turn rolling the
dice
• After his turn, the game continues with the next player
clockwise.
• The roles of the other participants in the game remain a secret
until the moment they are eliminated.
• Complete rules of BANG! The Dice Game a
http://www.dvgiochi.net/bang_the_dice_game/BANG!_dice_ga
me-rules.pdf
Project - Part 1
• Code in C Language a mechanism to include the different
participants
in a game of Bang!
• The program would assign life points & roles, rolls dice,
perform
shooting and healing using random numbers.

• The program simulates the game of Bang and provides proper
output
to the console as the game unfolds. Showing the results of the
dices,
their interpretation and other decisions done by each player.
• Once a player is eliminating his/her role is revealed.
10/30/2019
7
Project - Part 2
• Expand the program done in Part 1, to adapt its strategy for
selecting
people to received beers or shoots, every time a player is
eliminated,
and the player’s role is revealed.
• What changes would you do?
• What Data Structures would you choose for your solution?
• Document everything, submit a weekly report of everything
done to
develop further the project.
• Attempt the coding of your design to improve upon the version
developed in Part 1.
Deliverables
• A working program for part 1 (TBA)
• Weekly reports of planning, research, brain storming,

decision,
design to be implemented. (TBA)
• A working program for part 2, showing the changes done to
improve
program from part 1,based on the design and/or research done.
(TBA)
ECONOMY
Managing Demographic Risk
by Rainer Strack, Jens Baier, and Anders Fahlander
FROM THE FEBRUARY 2008 ISSUE
Most executives in developed nations are vaguely aware that a
major demographic shiftis about to transform their societies and
their companies—and assume there is littlethey can do about
such a monumental change. They’re right in the first instance,
wrong in the second.
The statistics are compelling. In most developed economies, the
workforce is steadily aging, a
reflection of declining birth rates and the graying of the baby
boom generation. The percentage of
the U.S. workforce between the ages of 55 and 64, for example,
is growing faster than any other age
group.

The situation is particularly acute in certain industries. In the
U.S. energy sector, more than a third
of the workforce already is over 50 years old, and that age
group is expected to grow by more than
25% by 2020. The number of workers over the age of 50 in the
Japanese financial services sector is
projected to rise by 61% between now and then. Indeed, even in
an emerging economy like China’s,
the number of manufacturing workers aged 50 or older will
more than double in the next 15 years.
But national and even industry statistics like these serve mainly
to put managers on notice of a
general problem. The important issue is the demographic risk
your own firm faces. As employees
get older and retire, businesses can face significant losses of
critical knowledge and skills, as well as
decreased productivity. The demographic trend has been
exacerbated by the relentless focus on cost
reduction that’s become the business norm. In their zeal to
become lean, organizations continue to
have round after round of layoffs—without realizing that in just
a few years they may confront
severe labor shortages or, if they’ve shed mostly younger

workers, be left with a relatively old
workforce. In some cases, a company’s ability to conduct
business may even be hindered: When
people begin retiring in droves, there may be no one left who
knows how to operate crucial
equipment or manage important customer relationships.
We offer here a systematic approach to analyzing future
workforce supply and demand under
different growth scenarios and on a job-by-job basis. It enables
companies to determine how many
employees they are likely to need, which qualifications they
should have, and when they will need
them. With that information, they can set up a tailored
retention, recruitment, and talent
management strategy for the job functions at greatest risk of a
labor shortage. Such an initiative
must be launched long before things reach a crisis stage,
because the remedies may need years to
take effect. Companies that act early not only will minimize the
risk but also will gain an important
advantage over their rivals.
The Nature of the Risk
In coming years, corporations will face two categories of

demographic risk: risks having to do with
retiring employees and risks having to do with aging employees.
Both require creative forethought
and active management.
Retiring employees.
When a worker retires, you lose someone to do a job and the
accumulated knowledge and expertise
that this person takes out the door with him. If many people are
retiring and they’re difficult to
replace, your organization faces what we call capacity risk—a
potentially diminished ability to carry
out the company’s business of making a product or offering a
service.
Take RWE, Europe’s third-largest energy utility, a company
we’ve worked with on assessing and
managing demographic risk. The publicly traded German utility,
which in 2006 had annual sales of
€44 billion and more than 70,000 employees, restructured
several times over the past decade. The
power generation and mining division, RWE Power, for
example, basically cut its workforce in half
between 1992 and today. Until recently, the company was
encouraging older workers to leave under
large-scale early retirement schemes.

When the Problem Is Growth
As veterans of “talent wars” know, rapid
growth can create labor shortages. In
India, for example, where labor is thought
to be plentiful and the workforce is
relatively young, we’re already seeing
early signs of severe scarcities of workers
in certain specialized jobs. Our approach
to demographic risk—systematically
assessing and managing the risk by job
function—can also be used in industries
or countries where economic growth
threatens to outstrip growth in the
workforce.
Take the example of an Eastern European
bank that was losing workers not to
retirement but to attrition, as competitors

fought to attract talent in an industry that
was burgeoning while capitalism took hold
in the formerly Communist market. By
analyzing future workforce supply and
demand under different growth scenarios
and on a job-by-job basis, the bank
But an analysis of retirement trends and future labor demand at
the company—over time horizons of
five, 10, and 15 years—revealed that today’s workforce surplus
would in several years turn into a
shortfall in many parts of the business. And the loss of talent
due to retirement would occur just as
the recruitment of new employees for critical positions at the
company became more difficult.
In many developed economies, there already is a mismatch
between labor supply and demand.
Germany today faces an immediate shortage of qualified
engineering graduates. In 2006 the country
had a deficit of approximately 48,000 engineers, and that figure
is expected to grow significantly in
coming years. At the same time, the country has too many
unskilled workers: The unemployment

rate of unskilled labor is more than six times higher than that of
university graduates. Most
industrialized countries face similar situations. (Some
developing economies also face a skill
shortage, at least in certain industries, a problem discussed in
the sidebar “When the Problem Is
Growth.”)
Aging employees.
Even before older workers start retiring in large
numbers, they can pose distinct management
challenges. Of course, age brings experience and
wisdom that make employees extremely valuable
in all kinds of ways. However, in certain settings,
productivity may suffer. For example, older
workers may not have the robustness needed in
physically demanding manufacturing jobs. They
may lack up-to-date skills owing to technological
changes. In certain situations, they may become
less motivated because they see fewer career
opportunities ahead of them. They may also be

susceptible to health problems that increase
absenteeism or force them into reduced work
roles. Thus, although age and experience can
make workers more effective in many positions,
in certain jobs an aging workforce can create a
productivity risk.
determined how many employees it was
likely to need, what qualifications they
should have, and when it would need
them. With that information, the bank set
up a tailored retention, recruitment, and
talent management strategy for the job
functions at greatest risk of a labor
shortage.
A Looming Challenge
An aging workforce will have implications
for most developed economies, but
managers need to examine the particular
effect it will have on their own companies
by looking at the age distribution of their
employee base. When RWE Power, the
power generation and mining division of a
European utility, examined the
demographics of its workforce, it saw that
if current trends continued, in 10 years a
large percentage of its workers would be
at or near retirement.

The importance of effectively addressing demographic changes
can be seen at a business like RWE
Power. Today, some 20% of the division’s workforce is over the
age of 50. Projections indicate that
this age group will make up more than half the workforce by
2011—and close to 80% by 2018. (See
the exhibit “A Looming Challenge.”)
Some of the issues raised by an aging workforce
may not be immediately evident. For example,
several thousand employees work in a three-shift
environment at RWE Power, but many won’t have
the stamina—or their doctors’ permission—to
work in rotating shifts as they grow older. So RWE
Power will have to find not only new positions for
the three-shift workers who can’t function in
their jobs any longer but also replacements for
them. Although the problem of finding a new job
for an employee no longer able to work in a three-
shift environment is less likely to arise in the

United States, which lacks the job protection laws
common in Europe, political or other
considerations may create similar constraints.
When calculating both kinds of demographic risk
—capacity risk and productivity risk—it’s
important to use the right metrics. For example, a
Workers over age 50
will make up more
than half the
workforce of the
business by 2011—
and close to 80% by
2018.
relatively high average age among employees
doesn’t necessarily signify a serious risk of losing
crucial talent to retirement. The distribution of
ages—that is, whether a large percentage of your
employees are clustered within a relatively
narrow age band—is the real sign that you’ll
encounter this problem. If a skewed distribution

in the age structure does exist, however, the
average age of employees will let you know when
you’ll face it.
Assessing the Risk
Capacity risk and productivity risk are assessed
differently. In the case of capacity risk, you
determine the gap between your organization’s
future demand for workers and anticipated
workforce levels, and then figure out how difficult
it will be to close that gap by hiring from outside
the company. In the case of productivity risk, you
determine how many workers will fall into older
age cohorts in coming years and what
implications that will have.
Calculating the risks at a companywide level doesn’t provide an
accurate picture of the problem.
Drilling down to the level of individual locations or business
units is more useful. But in the end you
need to figure out how age trends will affect three different
categories of jobs: relatively broad job

groups, narrower job families within each of those groups, and
more specific job functions within
each of the families.
Bringing the analysis down to these levels will almost certainly
reveal an anticipated surplus of
people in certain job groups, families, and functions and a
shortfall in others. Managing the risk will
require addressing the problem at these levels as well. Indeed,
using uniform remedies across an
entire company would be ineffective and probably
counterproductive, especially for productivity
risk, which varies significantly by job category.
Let’s look at what’s involved in this progressively granular
analysis, focusing in detail on the
problem of retiring workers and capacity risk.
Run a quick check to identify where potential challenges lie.
The first step is to do a relatively simple analysis of your
company’s situation, one that draws on
easily available company data. The aim is to determine, by
location and business unit, future
workforce levels and age distribution, based on anticipated
retirement and attrition rates. Much of

the information—for example, the number of employees and
their respective ages—can be pulled
from existing HR data systems and fed into a simple simulation
tool that forecasts what will happen
under a number of scenarios over the next five to 15 years.
Historical data on such things as attrition
and recruiting can be used to generate projections, but these
need to be enriched with management
discussions of future trends. RWE Power’s historic annual
attrition rate of less than 1%, for instance,
could rise as demand for specialized workers grows in the labor
market.
This first analytical cut quickly provides a good idea of which
locations and business units are likely
to have the steepest age distribution and most dramatic capacity
losses. In units or locations with
the highest problems, companies can then do a more detailed
analysis.
Create a job taxonomy to refine your assessment.
You’ll need to continue the analysis at the level of the three job
categories: groups, families, and
functions. Employees within each category share similar skills
and can transfer within them, but the
amount of time it takes to successfully transition to a new job

varies with each category.
Within a job function, employees can get up to speed in new
positions in less than three months,
with relatively little training. Within a job family, it takes
employees changing roles less than 18
months to acquire the necessary skills. Within a job group, a
transfer may require up to 36 months
and significant training.
Creating a Job Taxonomy for
Your Company
Companies can mitigate critical worker
shortages by transferring employees into
open jobs. So the first step in assessing
demographic risk is to evaluate how easily
you can shift employees among positions.
You can do this by categorizing jobs in the
company on three levels: functions,
families, and groups.
Job functions comprise jobs that are
essentially the same, but in different

locations, or similar enough to require the
same sets of skills. In the hypothetical
example below, all system controllers are
in the same job function because they all
have detailed knowledge about the
operation of power-plant control systems.
Workers transferring within a function can
get up to speed in less than three months,
with relatively little training.
Job functions that require closely related
but somewhat different knowledge and
skills belong to the same job family. Here,
system controllers and power electronics
electricians are in the same family
because both are skilled electricians who
have deep knowledge about operational
processes but who work on different
electronic systems. Employees can
successfully transition to new roles within

a family in less than 18 months, with the
right training.
Where Will You Face Talent
Gaps?
To identify where your greatest challenges
will lie as workers retire or leave, you need
to forecast what your workforce needs will
be in each job function—or, as a first cut,
in each job family—at different points in
the future. This forecast requires two
inputs: internal workforce supply (that is,
your company’s anticipated workforce
levels, given assumptions about
retirement age, early retirement
programs, and attrition rates) and
workforce demand (based on strategic
RWE Power held workshops at which operational managers
categorized jobs based on this notion of
exchangeability. Then the job function, family, and group that
each employee belonged to were

entered in the company’s employee data system. (The exhibit
“Creating a Job Taxonomy for Your
Company” shows how certain jobs might be classified.)
Categorizing employees based on their skills and
the exchangeability of those skills is crucial to the
systematic evaluation and management of
demographic risk. That’s because the more time it
takes to train someone to do another job, the
more it will cost to prevent a shortage of workers
as people retire.
Pinpoint potential capacity problems.
Having developed this taxonomy of job
categories, you can begin identifying what your
organization’s greatest capacity challenges will be
as workers retire. (The exhibit “Where Will You
Face Talent Gaps?” lays out a multistep approach
to assessing your capacity risk.)
Similar job families are part of the same

job group. This illustrative chart shows
that system controllers and electrical
planners belong to the electrician job
group. Shifting from system controller to
electrical planner, however, would require
an employee to learn new planning
processes, planning standards, and
planning software. Workers transferring to
new positions outside their job family but
within their job group require up to 36
months of training.
If you enter each employee’s job function,
family, and group in your employee
database, you can easily identify transfers
that could eliminate future labor shortfalls
in particular jobs—and determine how
long it would take to provide the training
needed for employees to make the switch.
assumptions about such things as growth
targets, emerging business models,
productivity increases, and new
technologies).
These forecasts—which can range in
sophistication from back-of-the-envelope
approximations to numbers produced by
computer simulation of different scenarios
—will yield estimates of anticipated
internal shortfalls (or surpluses) in each
job function over time.
The chart below shows a relatively simple
five-year forecast for one job function,
electrical planner.

To get a read on your overall internal
capacity risk, determine for each function
the extent of the risk (that is, the size of a
potential shortfall over time) and the
immediacy of the risk (how soon you are
likely to face a serious problem). Note that
here internal capacity risk will be
particularly acute in the case of the
system controllers, high-voltage
electricians, and electrical planners, who
will be in seriously short supply in a few
years.
Next, assess the external marketplace
risk, to see how difficult it will be to
alleviate shortfalls by hiring people from
outside the company when your need for
people is greatest. You should take into
account both the availability of workers
with the requisite skills and the intensity
of competition to hire those workers.
Combining your analyses of your internal
situation and the labor market will
highlight the job functions facing the
greatest threat (here, system controller
and high-voltage electrician) and those
that give little cause for concern (low-
voltage electrician). While there will be an
internal shortage of electrical planners,
those workers are expected to be in
plentiful supply in the labor market.

Start by estimating future workforce supply—that is, how many
available workers you will have for
each particular job function over the next five to 15 years. You
can calculate these anticipated
workforce levels by extending to individual jobs the analysis of
retirement and historical attrition
rates you did in the demographic quick check at the division and
location level.
Then calculate future workforce demand for each job function
by identifying what within your
strategy will drive personnel requirements, again taking into
account various scenarios. At RWE
Power, the demand for staff is tied both to anticipated growth—
for example, when planned power
plants will come on line—and to productivity gains. In more
volatile industries, like auto
manufacturing or banking, forecasting future staff needs by job
function is more challenging,
Safeguarding Knowledge
Retirement represents the loss of a worker
with the skills needed to perform a
specific job. It may also represent the loss
requiring the development of an array of scenarios. But an

assessment of even worst-case growth
scenarios in these industries will inevitably reveal the need for
immediate action in certain job
functions.
Combining these estimates of future workforce supply and
demand allows you to determine your
internal capacity risk. For each job function, you should be able
to tell both the extent of the risk
(the size of a potential shortfall—or, in some cases, a surplus)
and its immediacy (if a shortfall will
happen, when it is likely to occur.)
Using your categorization of jobs by functions, families, and
groups, you’ll be able to see how
difficult it will be to replace retiring workers with someone else
from within the company. A serious
internal capacity risk exists when there will be a significant
shortfall in the workers required for key
job functions in the short to medium term.
The analysis should also take into account that specialized jobs
may require a lengthy training and
certification period. In Germany, for example, it takes a three-
year apprenticeship to become an
electrician. Then it can require another two years to specialize

as a maintenance expert, and two
more to become an electrical master technician. So a company
needs to identify a shortfall in
electrical master technicians seven years before it occurs,
especially if it will be difficult to fill those
jobs with outside hires. In addition, depending on the degree of
off-the-job training required, it
might be necessary to have a surplus of workers for the jobs at
each of these stages so that some can
receive the training needed to advance to the next level before
the actual gap occurs. A traditional
three-year planning cycle won’t identify those risks in time to
respond to them.
Keep in mind, as well, that companies may face a shortfall not
simply of workers with needed skills
but of employees with crucial experience and knowledge—
particularly specialized knowledge about
the company and its practices. (To learn how U.S. truck maker
Freightliner addressed this risk, see
the sidebar “Safeguarding Knowledge.”)
The difficulty of closing a gap depends on the
availability of workers with the skills you need in
the labor market. Consequently, after

determining your internal capacity risk, you
of crucial knowledge whose value to the
organization extends far beyond the
worker’s individual position.
Freightliner, a large truck manufacturer
based in Portland, Oregon, has
anticipated this dual risk. The company (a
division of Daimler that recently changed
its name to Daimler Trucks North America)
saw that the imminent retirement of a
large cohort of its aging workforce
threatened the specialized technical skills
and deep knowledge of customer needs
required to produce the highly customized
trucks it was known for. Previously,
significant layoffs, voluntary severance
programs, and limited external recruiting

had resulted in a relatively old workforce.
In certain functions 30% to 50% of
Freightliner’s workforce would be eligible
for retirement by 2010. The cyclical nature
of its business made the staffing equation
even more difficult.
Once Freightliner recognized it faced a
serious potential problem, it set about
assessing the extent and severity of the
risk, focusing on employees who were key
knowledge holders. The challenge was to
identify these workers as a subset of the
workforce; to segment them based on
whether their knowledge was held by
them alone, by a few employees, or by
many employees; and to transfer their
knowledge so that it wouldn’t be lost to
the organization when they retired.

Using an in-depth survey of 5,000
employees, Freightliner classified
employees by the type of knowledge they
had. Across the company, about 20% of
the population emerged as “key
knowledge holders,” 9% as “unique key
knowledge holders,” and 3% as “at-risk,
unique key knowledge holders” (those
who were eligible to retire within five
should assess the external labor market risk,
again by job family and function. The extent of
the risk will be determined by the availability of
qualified workers and by the competition from
other companies to hire them.
The final step in determining capacity risk
involves combining the assessments of your
internal situation and of the external labor
market, to highlight which job functions will pose

the greatest threat. When it analyzed its
workforce trends, RWE Power found that it would
face a shortage within the company of certain
kinds of highly specialized engineers, that
relatively few of these engineers would be
entering the job market in coming years, and that
competition to hire them would be fierce among
the few large utility companies—creating a
capacity challenge for this job function.
Pinpoint potential productivity losses.
A similar approach, if a somewhat more
straightforward process, is used to gauge the risk
of lower productivity and other costs—such as
absenteeism and retraining costs—that can be
related to an aging workforce in certain job
categories. Again, the risk must be assessed at the
level of job group, family, and function, a process
that begins with looking at the age distribution of

employees in each category and how it will
change over time.
years). The risk posed by the departure of
this latter group varied significantly
among different functions. Segmenting
this crucial human resource by function
helped the company set up targeted
knowledge management systems, tandem
staffing arrangements, job rotations, and
other means to capture what these people
knew before they left the company.
Six Ways to Close the Talent
Gap
Having identified where you are likely to
face the greatest capacity risk, you need
to take steps to minimize it, particularly in
Then you’ll need to determine which job
functions are at risk—because of employees’ ages

and because of the nature of the work—for age-
related productivity losses. At the least, you’ll
want to differentiate between physically
demanding jobs, in which aging can lead to
reduced productivity, and experience-based jobs,
in which aging can lead to higher productivity.
Keep in mind that the implications of employee
aging will vary widely from job to job. Companies
need to understand those differences and develop specific
strategies for each job group.
The process of assessing your company’s capacity and
productivity risks by location, business unit,
and job category can reveal some daunting challenges—say, a
serious shortage of talent in an area
targeted for growth. The key is to identify such a problem far
enough in advance to be able to
address it and, in doing so, gain an advantage over your
competitors.
Managing the Risk
With detailed information about the demographic risk you face,
you’re in a position to

systematically employ an array of measures to manage both
capacity risk and productivity risk.
Take steps now to prevent talent shortages.
Future shortfalls in a critical job family or function, when
spotted early enough, can be mitigated in
two basic ways: by reducing the demand for workers in those
jobs and by increasing the supply of
people able to perform them. We’ll look at six methods for
closing the gap between workforce
supply and demand, beginning with two aimed at reducing
workforce requirements. (See the
sidebar “Six Ways to Close the Talent Gap.”)
An obvious but potentially overlooked method is
productivity improvement, achieved through
process enhancements, for instance, or technical
innovations. Most companies constantly seek to
positions critical to the organization’s
future success. This can be done by job
category, using a combination of
measures. They fall into two general
categories:
Reduce your future demand
for labor

increase productivity
outsource work
Increase your future supply
of qualified workers
transfer employees
train employees
increase employee retention
recruit more workers
improve productivity. But the potential for a
serious labor shortage in a particular job family or
function can focus those efforts.
Companies can also prioritize outsourcing in job
categories in which a labor shortage is looming—
particularly if the shortage looks temporary or if it
involves work that is of limited strategic
importance. Bear in mind, however, that if you
have problems recruiting in certain job categories,
your outsourcer probably faces the same

constraints, so outsourcing may provide only a
partial solution.
Maintaining an adequate supply of talent is
another key to managing potential gaps.
Companies that have categorized their jobs by
functions, families, and groups will have a good
read on the feasibility of job transfers. They can
tap a surplus in a job function or family at one
location or business unit to fill a gap in the same
function or family at another location or business unit—
provided they’ve laid the necessary
groundwork for transfers. RWE Power is considering how it can
help workers prepare for a potential
transfer to a similar but different job or to the same job at a
different power plant as the
organization’s production strategy changes.
Training programs play a key role in such preparations. The
capacity risk analysis enabled RWE
Power to spot, for instance, cross-training opportunities
between its different operations: After a
short learning period, a high-voltage electrician working on

large mining equipment can undertake
high-voltage tasks at a power plant, and vice versa. The ability
to map the potential for transfers and
training across job categories, business units, and locations
gives RWE Power a capability most large
companies lack. (See the exhibit “Sizing Up Your Transfer and
Training Options” for a simple
illustration of how training and transfers can be combined to
address gaps.)
Sizing Up Your Transfer and
Training Options
If you anticipate a shortfall in one job
function at one location in a given year (in
this simplified example, the deficit of 35
low-voltage electricians at Location 1), you
might be able to alleviate that problem by
training people from another job function,
in the same job family and at the same
location, in which there will be an
oversupply (the surplus of 26 high-voltage
electricians in Location 1). Although their
training might take up to 18 months, you
could begin it before the shortfall
materializes, because you have spotted
the problem early.
Alternatively, if you have identified a

surplus of workers in the same job
function at another location (the surplus
of 12 low-voltage technicians at Location
2), you could transfer some of them to fill
the shortage.
As we see here, the shortfall of low-
voltage electricians at Location 1 and the
shortfall of high-voltage electricians at
Location 2 would be eased through a
combination of training and transfers—
though there would still be a deficit of 19
workers. That would have to be addressed
through other measures, including hiring
from outside the company.
To ensure that attrition doesn’t exacerbate a
capacity shortfall, it is important to create
sophisticated retention programs targeted at
people in job functions at greatest risk of a talent
shortage. Initiatives include training, career
planning programs, and job rotation programs, as
well as more conventional long-term incentives.
At the minimum, you need to monitor employee
satisfaction and strive to increase it in job
categories facing a serious capacity risk. RWE

Power, for example, has carefully analyzed its
remuneration structure for certain types of
engineers.
Finally, having taken steps to minimize workforce
demand in crucial job categories and to
strengthen the supply of workers from within the
company, you must look outside the organization
for workers to fill any remaining gap. For many
companies, this fundamental business activity—
recruitment—has been a low priority during the
relentless downsizing of recent years. But
because of the major demographic shift now
occurring, developing sophisticated recruiting
programs—that focus not just on hiring more
people but on such things as the careful
positioning of the company brand with
prospective employees—are a top priority.
Companies must learn to target their recruiting

efforts by, for example, identifying specialized
schools that will turn out workers with the skills
required for jobs in at-risk categories. They need
to think ahead, beginning to recruit employees
whose skills may not be in demand today but will
be tomorrow, when shortages emerge. Companies
that anticipate their future needs and act now will
gain a clear competitive advantage over rivals that
are still focused on reducing head count.
This will require a radical change in mind-set for
companies that have been in a prolonged
downsizing mode. For RWE Power, it became
clear that, while it had the financial capital to
construct new power plants, human capital, in
the form of specialized engineers, was the scarce
resource. Consequently, the company launched
an intense effort to close the gap in the short term

—with, for example, focused recruiting drives at
certain universities—and developed a long-term recruitment
strategy for these positions. Other
possible responses to such a gap include reactivating retirees or
acquiring small companies that
have the sought-after talent.
Ensure that aging workers remain assets.
Initiatives focused on the needs of older workers can help
address the implications an aging
workforce has for productivity. A systematic review of current
HR policies and processes will reveal
adjustments you can make in a variety of areas to turn age-
related risks into competitive
opportunities. The key is to tailor these measures to each job
function or family, keeping in mind
that the experience that comes with age may increase
productivity in certain jobs, such as
engineering or sales positions.
The most obvious moves involve training programs that help
older workers update their skills and
leverage their experience. At RWE Power, the operational
technology at power plants has changed
significantly since older workers began at the company, and
continuing professional development

programs are crucial in maintaining these workers’ production
knowledge. A danger is that older
workers will be placed in one-age-fits-all courses that aren’t
geared to their particular needs,
knowledge, and strengths. For example, older manufacturing
employees’ lack of familiarity with the
internet may make typical web-based training programs
unappealing to them. Training older
employees in mixed-age groups can also reduce the value of
such programs: They may be
embarrassed to ask questions that younger employees might
scoff at. (It should be noted that the
reverse may also be true.)
Another obvious area for productivity enhancement is health
care management. On average, older
employees don’t become ill more often than younger employees,
they just are ill for longer periods.
Proactive measures, designed to prevent sickness and injury,
can reduce the problem significantly.
Such measures should be targeted at employees with a high risk
of health problems and tailored to
the jobs they do. They also need to include incentives to

encourage participation—say, the offer of
additional vacation days to employees who regularly engage in
exercise, which has been shown to
reduce illness-related absences among older workers.
In many cases, workplace accommodations designed to help
older workers on the job can increase
productivity. With manual work, companies may focus on
enhancing workplace design or revising
employees’ duties—say, by rotating them during the course of a
day among tasks that are more and
less physically demanding. RWE Power, which has found that
aging could reduce productivity in
production-related job families, is exploring the possibility of
personalized work schedules, with
shift lengths tailored to employees’ abilities, and of “lifetime
working programs,” in which
employees can accumulate early in their careers credit for
overtime hours that can be used to reduce
work hours when they are older.
In a twist on the outsourcing that accompanies most downsizing
initiatives, companies might also
consider the strategic “insourcing” of certain jobs as a way to
accommodate the abilities of older

workers. That is, less physically demanding tasks currently
performed by outside contractors could
be brought back into the company and assigned to older workers
who are guaranteed employment
by their contract or by job protection laws but may no longer
perform well in their current positions.
Initiatives may also involve developing new compensation
structures. The traditional link between
pay and length of service (and hence age) may need to be
loosened, and compensation—for certain
activities, at least—more closely linked to performance.
Although under such a system, some older
workers may be compensated less than they would have been
under the existing system, note again
that, in many job categories, knowledge and experience may in
fact lead to superior performance
and higher pay.
While some older workers become more engaged with their jobs
(say, after their children have left
home and their domestic responsibilities lessen), others become
less motivated because they
perceive they have fewer career opportunities. To counter a
potential loss of motivation as workers

approach retirement, companies can try creative age-related
performance incentives. For example,
older workers might serve as mentors to new workers, which
can increase motivation and
performance. Employees with critical knowledge might be
offered the chance to return to the
company and work on special projects on a freelance basis after
they’ve retired. This latter approach
has multiple benefits: reducing capacity shortfalls in a crucial
job category and keeping valuable
knowledge in the company, as well as motivating employees
near retirement to perform well so that
they will be considered for this post-retirement opportunity.
Addressing Tomorrow’s Problem Today
The demographic shift looming on the horizon will radically
reshape our workforces. As its impact
becomes more obvious, many companies will realize that they
must undertake a monumental,
multiyear change-management program—one that represents an
opportunity as well as a response
to a significant challenge.
As we’ve noted, actively addressing demographic risk to retain
the skills and know-how needed to

ensure future viability can give companies a competitive
advantage over rivals. That means
demographic risk management must be an integral part of yearly
strategy setting. Furthermore,
because demographic risk management is not a onetime
initiative but an ongoing part of strategy
and risk discussions, the HR department will need to become a
true strategic partner of top
management—a role that HR should have assumed long ago, in
any case.
Retirees with critical knowledge might be
offered the chance to return to the company
and work on special projects.
There is no time to waste: Recall the seven-year lead required to
train the German master electrical
technician. Companies must adopt a demographic risk
management approach now—before their
competitors do and before it is too late to effectively respond to
the changes that lie ahead.
A version of this article appeared in the February 2008 issue of
Harvard Business Review.
Rainer Strack ([email protected]) is a partner and managing dire
ctor,

Jens Baier ([email protected]) is a principal, and
Anders Fahlander ([email protected]) is a senior partner and ma
naging director of the Boston Consulting Group.
Strack, a coauthor of “The Surprising Economics of a ‘People B
usiness’” (HBR June 2005), and Baier are based in
Düsseldorf, Germany; Fahlander is based in San Francisco.
Related Topics: HUMAN RESOURCE MANAGEMENT |
EMPLOYEE RETENTION | DEMOGRAPHICS
This article is about ECONOMY
� FOLLOW THIS TOPIC
Comments
Leave a Comment
P O S T
0 COMMENTS
& JOIN THE CONVERSATION
POSTING GUIDELINES
We hope the conversations that take place on HBR.org will be e
nergetic, constructive, and thought-
provoking. To comment, readers must sign in or

register. And to ensure the quality of the discussion, our modera
ting team will review all comments and may edit them for clarit
y, length, and relevance.
Comments that are overly promotional, mean-spirited, or off-
topic may be deleted per the moderators' judgment. All postings
become the property of
Harvard Business Publishing.

STRATEGIC PLANNINGManaging Risks A NewFrameworkby Rob.docx

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Ähnlich wie STRATEGIC PLANNINGManaging Risks A NewFrameworkby Rob.docx

Ähnlich wie STRATEGIC PLANNINGManaging Risks A NewFrameworkby Rob.docx (20)

Mehr von susanschei

Mehr von susanschei (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

STRATEGIC PLANNINGManaging Risks A NewFrameworkby Rob.docx