Uncertainties lie at the heart of business decision making in many different kinds of corporations. Should we take on a new product or business line? Will customers like the idea of using WAP-enabled phones to buy our products? Will the regulators allow us to take control of our biggest competitor? Should we distribute our products directly or trust an intermediary? Will ethical, regulatory or political changes blow a hole in one of our critical assumptions?

This kind of mission-critical question can rarely be answered with a definite "yes" or "no", so executives learn to base their decisions on shifting sands. But not all business uncertainties are created equal. Some destroy while others merely damage. Some can be avoided, reduced or transferred, while others must be recognised as an inevitable part of a business activity - and risk managed at an enterprise-wide level by diversifying lines of business, or setting aside reserves or risk capital.

Sorting out the most appropriate way to think about, communicate and treat these different sorts of business risk is a big problem in modern risk management - as the stakeholders of Equitable Life, the oldest UK life assurance society, know only too well.

The Equitable was obliged to close for new business in late 2000 after failing to manage the interest rate risk built into guarantees it offered certain of its customers. But, as the button below recounts, the calamity did not really arise from poor identification of market risk or asset/liability gaps. Instead, it arose from Equitable's business strategy and its vision of itself, which led to the institution side-lining rather than risk managing a key legal threat over an extended period of time.

As this suggests, a "business risk" can be thought of as the risk of a destructive shift in the assumptions, parameters and targets that underpin a business initiative. Strategic risk is much the same animal at a different level: it raises questions such as whether a company should remain within an industry, or whether it should approach its marketplace under a completely different set of assumptions.

Strategic business decisions often drive the risk profile of an institution in fundamental ways that over-ride or distort specific risk management decisions. When this happens, it's often because those setting up the business have severed the link between risk and reward, as our first Expert Witness explains with reference to the insurance industry.

While some business and strategy risks are obvious and "front-loaded" in terms of their cash-flow implications, others burn so slowly or are buried so deep within a business that their importance remains unrecognised by principal stakeholders.

These slow-burning risks give rise to a time differential between the pay-off from assuming a risk and the cost of the eventual liabilities - an asymmetry that can be exploited by unscrupulous managers. Even when the risks gamed by managers in this way are straightforward insurance and credit risks, the mismanagement of the risks often takes place under the cloak of a wider business model or strategy.

The same time differential allows executives to remain in a state of denial if they make an honest mistake about their business model, and can tempt them into gambling their way out of the mess by taking on even more risk - a top executive's version of the rogue trader phenomenon. The button above explores this idea in more detail and suggests that for certain kinds of business risk, it might be important to find a formal and independent way to identify and track risky assumptions and variables in terms of their exposure, severity and risk interactions.

Business risk - a problem in two parts
From the perspective of a financial institution, the problem of business risk management falls into two parts.

The most complicated of these is how a financial institution approaches its own business risks, as defined opposite in our Business Risk Spectrum. In particular, does it make sense for a bank and its stakeholders to manage some business risks as part of its formal risk management process, or do most of these decisions boil down to business instinct?

The answer to this lies more in the severity of the risk than in the nature of the risk. So if the destructive capacity of business or strategic risks increase, institutions will find themselves under pressure to explain how their approach to business risk "fits" with their management of other key risks such as credit, market and operational risk.

The second part of the problem is wider. Should a corporation of any kind use risk transfer and financing tools to manage business risks that lie outside the traditional insurance, market and credit risk management markets? It's an important question because if the answer is yes, it will open up many new risk management markets and expose some institutions to new kinds of risk portfolios.

If it makes sense to manage actively such business risks - demand fluctuations, new product launches, brand valuations, asset prices, residual assets and liabilities, patent risks, political and weather risks, and so on - where should the "risk management" stop and plain old management start? Our second Expert Witness says that an analogy with how the reinsurance industry thinks through the sharing of risks might help sort out this conceptual tangle.

The rise and rise of business risk
The need for formal business risk management is driven by the rate of change in a business environment. In a stable environment, well-established firms can deal with their business risks through the personal experience and skills of managers and through tried and tested routines. Business risk management skills are a product of a firm's successful evolution and are built into its DNA.

In a world of change and expansion, critical business risks are much harder to spot, communicate and manage efficiently. Risk analysts say the relative importance of business risk is rising in the financial industry for three big reasons.

First, as the wholesale risk and investment markets become more efficient conduits for the sale and transfer of classic risks, banks are finding that the margins they are paid for retaining these risks are falling. Meanwhile, banks are trying to stabilise their revenues by promoting fee-based services and by widening their range of products, improving quality of service, branding, product mix, and the depth of the customer relationship. All these activities attract business risks or oblige institutions to make risky assumptions that lie outside their traditional areas of expertise.

The rise and fall of auto-leasing as a bank business line over the last few years shows how important this can be. Auto-leasing is a credit business in which market share can be bought by altering a key but difficult-to-forecast variable in the business model: the residual value of used automobiles. Most banks have learnt to be wary of buying market share by altering assumptions in risks they understand such as credit risk or interest rate risk. But as the button below recounts, there will always be a temptation to alter the least understood variable in any business model.

Second, the nature of bank decision-making over how their financial products are marketed and delivered is changing. From internet technology to call centres and partnership strategies, managers are being forced to take risky "yes or no" decisions about distribution and technology strategies. These often mean making a massively expensive investment or, increasingly, a risky reliance on partners or other third parties.

Third, the erosion of regulatory and technology barriers between the various financial sectors is increasing competitive risks and encouraging institutions to buy or build businesses outside their natural areas of expertise. In the US, for example, the Gramm-Leach-Bliley Act has given banks the green light to enter the insurance sector. At the same time, in bank and insurance company markets around the world, there is a general trend towards consolidation. These are slow-burning changes, but they mean that business risk in the form of mergers and acquisitions decisions, and business line selection, will be high on the agenda for the next few years.

The relative importance of business risk varies from institution to institution. Historically, the stability of many financial institutions has depended on their skill in accessing, selecting and managing portfolios of credit, market and insurance risk. Managing these risks and liabilities has dominated formal risk management in financial institutions - not least because these risks are the focus of interest for regulatory authorities worried about risks to the wider financial system.

But in some business lines - those that offer services to their customers for a fee, or that act as distributors and brokers rather than assuming risk - business risks have always been as important as market and credit risk.

In an individual institution, the relative weight of business risk in the risk makeup of a bank depends upon the mix of the business lines, as well as on the institution's risk retention strategy. For example, a study of Bank of America some years ago showed that the bank's risk profile was dominated by credit risk, business risk and operational risk - accounting for some 75% of the risk capital the bank reserved against unwelcome events. The bank incurred significant market risk, but had a policy of hedging this away.

Tension in the ranks: from regulatory to economic capital
The rapid pace of change in the financial industries has led to some tension in the field of institutional risk management over the last few years. How easy is it to make a distinction between the strategic business decisions that senior managers and equity analysts see as their territory, and the credit and market risk decisions that are refereed by a wider group of stakeholders such as regulators, ratings agencies, creditors, depositors and policy-holders?

This question took on a sharper edge after the international regulator of banking, the Basle Committee on Banking Supervision, said in 2000 that it intended to ask banks to reserve capital against business and strategic risks under its new rules on capital adequacy - due to come into force in 2005. After protests from the banking industry, the regulators agreed that they would calculate a specific regulatory capital charge only for operational risks and legal risks, and exclude more general business risks. But that doesn't mean that business risk is off the regulatory agenda.

Leading thinkers in bank regulation pointed out in Spring 2001 that, "innovative businesses or those involving massive technology investments can engender what some analysts call strategic risk. Failure in such ventures may be highly visible and thus likely to have spillover effects on other businesses through the cost of capital, the cost of funding, and revenue effects through the loss of customer approval" (Cumming & Hirtle, 2001).

So while regulators might not make business and strategic risk an issue in regulatory capital, they will continue to press institutions to make sure these risks are properly managed. They are also likely to increase capital charges through their supervisory review powers if they think that a bank's business strategy has put it in peril. Regulators naturally take into account the general quality of a bank's management and its streams of revenue when assessing its capacity to honour obligations.

The problem of business risk and risk capital isn't only a regulatory concern. Financial institutions have many other stakeholders, from depositors to institutional counterparties, who do not like the idea of their institution taking "make or break" business decisions. But there are various strategies banks already use to buffer themselves against unexpected business risks.

In the interview button below, the chief risk officer of a major US bank, First Union, describes a difficult period in his bank's recent history as the institution altered its business mix and closed down some loss-making business lines.

As he explains, along with event risk, First Union's operational risk capital also includes a "business risk" category, which is there to cover shifts in the business environment that leave the company in the red. The bank's business risk capital was called into action during 2000 to cushion the impact of closing The Money Store - part of the bank's business that offered credit in the subprime sector. The closure meant a very significant one-time restructuring expense of around $2.8 billion. The chief risk officer explains that his bank feels it needs to maintain capital against such unexpected eventualities in order to protect shareholders and to maintain the solvency of the company.

Bank mergers and acquisitions, and changes in business lines, inevitably affect bank risk management and risk capital strategies in that they always involve unpredictable risks. But these strategies are also sometimes part of a conscious decision to embrace more volatile revenue streams. In the PDF feature button below, an expert in bank investment says he feels that over time financial institutions have become more expert in assessing the effect of adding fee-based business lines with volatile revenues to their business mix.

The same expert says that, while a key question might seem whether a new business will grow in value, a bank has to be appropriately capitalised if any change in revenue volatility is not to affect its cost of financing. That's because the chance of unexpected mishaps, on either the cost or revenue side of a business, is a key part of the bigger question of finding an optimal debt-to-equity capital structure and gearing for a corporation.

Risk capital and financial engineering isn't the only defence. Some major banks also actively diversify their portfolio of business lines to protect themselves against the ups and downs of business risk and business volumes. Citibank is one famous example of an institution that has used diversification as a key argument for its mergers and acquisitions strategy over the years.

There's also now a trend at leading banks to include some elements of business risk in the calculations that are used to assign economic risk capital to a particular business activity. Not doing so, after all, distorts any comparison between the risk-adjusted returns of business lines that are highly risky in terms of business risks but relatively unrisky in terms of, say, credit risk.

So as well as being controlled through hands-on management, many business risks are already being mitigated through classic risk management mechanisms of capital reserves, diversification, risk-sensitive investment strategies and, as we'll see below, risk transfer to third parties. But the process isn't by any means as transparent or formal as in the world of credit, market and operational risk management.

A line in the sand: separating business risks from other risks
One complication is that it's not always easy to draw a line between business risks and other kinds of risk. A falling equity market is most obviously a market risk, in terms of any exposures the bank has in its equity portfolio. But if the bank owns a major brokerage, the financial impact might be greatest in terms of the fall in transaction volumes and revenues - and the threat this poses to its business plan and to returns on technology investments.

This ambiguity runs deep. When a senior executive asks for a risk analysis of the firm's credit portfolio, for example, the analysis takes into account the credit risk arising from the bank's existing positions and obligations, and perhaps its future potential exposures from derivatives contracts and the like. But what of the risk that arises from a sudden shift in the behaviour of its customers, such as those that make up its sub-prime business or those that have been found through non-traditional means such as the Internet? The truth is that most business models depend upon some risky assumptions.

Some of these risks are so critical in certain business lines that their management has already become a part of formal risk management. For example, the behaviour of householders in prepaying their mortgages and taking out a similar product at a lower rate - prepayment risk - is recognised as a key factor in the risk management of a mortgage business. This demand estimation risk has become the subject of formal risk management because it is a critical risk that is linked to a transparent market variable: interest rates.

But most business risks are not so easily defined, quantified or transferred. For this reason some banks look at the bundle of business risks in a particular business line in terms of the implied financial exposure. For example, if the business is a derivatives trading business, how much might it cost the bank to pay-off the bulk of the staff, keep on a skeleton crew to manage down outstanding positions, and fulfil residual commitments to customers?

Conversely, how risky is it to expand a business quickly if business volumes are potentially volatile? That's a problem that Charles Schwab and many other brokerages encountered in the first years of the millennium as retail share dealing first rose exponentially - leading them to take on staff, make significant technology investments, and compete by cutting margins - before falling away rapidly at the end of the internet investment boom.

This kind of analysis of sunk future expenses, often called "operating leverage" analysis, is really a way of looking at a bank activity as a special kind of financial exposure. It can be revealing about the relative cost of failure in different banking lines, but it has a key deficiency.

Operating leverage analysis tends to assume that the bank will have freedom of action in divesting itself of an activity and that the risk a business line poses to the bank can mainly be thought of in terms of transparent costs rather than in terms of incurred liabilities. It also assumes that the bank, and its executives, can survive the inevitable reappraisal by equity and credit analysts that is prompted by closing a business line. These are big assumptions.

Meanwhile, the trend to manage credit and other risks more actively as part of a strategy of risk/reward optimisation is blurring the distinction between traditional credit risk management activity and business decisions. For example, in a few leading-edge institutions, centralised portfolio managers now assume responsibility for making "buy/sell/hedge" decisions about the composition of the institution's credit risk portfolio; in others, a central risk function pumps out information about incremental economic capital to business lines and desks to help them make decisions. Increasingly, it's difficult to draw a clear line between the assumption of classic banking risks and the business risk aspects of a bank's activities.

The fuzzy end of the business risk spectrum
So far, we've largely been thinking of business risk in terms of relatively "hard" risks such as residual values and demand estimation risks. But as our Business Risk Spectrum showed, the fuzzy or "soft" side of business risk can be equally critical.

For example, most major corporations now recognise that their intellectual property is one of their most important assets and must be protected. But as businesses develop, it's easy for firms simply not to see the value in the unique tool or process that they have developed and to risk losing control of that asset.

The button below takes a closer look at the risk and reward inherent in the intellectual property of financial institutions, from software to the patenting of complex business processes.

Another kind of "fuzzy" risk is the threat to many business plans from swings in social perceptions - a risk source that doesn't form a natural part of the risk manager's lexicon. One example is the growing importance of the ethical behaviour of companies to investors, regulators and consumers.

There are already a number of ethical indices competing for investor attention, such as that launched in 2001 by FTSE International, publisher of the FTSE family of equity indices. These indexes are helping to make the behaviour of firms, including financial firms, much more transparent to a wide audience. Business groups such as the Confederation of British Industry in the UK said during 2001 that they are worried about the effect. That's because firms can get left out of such indices, and suffer reputational damage, simply because they have not taken a proactive ethical stance or published certain data.

Meanwhile, US banks that specialise in lending to customers with poor credit histories have been given an object lesson in the power of ethical controversies. During 2001, cities and states in the US began trying to curb "predatory lending" - the entrapment of vulnerable sections of the community into transactions with unreasonable charges and penalties - by passing new laws that, lenders claimed, also penalized legitimate businesses. The button below describes the situation at the point of greatest uncertainty around July 2001.

Ethical risk also manifests itself as campaigns against individual institutions - and physical attacks on their staff. The button below takes a closer look at how banks are having to face up to risk managing direct action by ethical activists.

So far banks have tended to take the attitude that such risks are beyond their control and have dealt with them as a fire-fighting exercise as and when they occur. But perhaps one reason such risks are not risk managed in a serious manner is that they tend to affect the more intangible assets of a firm - assets that are traditionally too nebulous to make it onto the balance sheet.

Over half of bank assets by value are now classed as intangible, as the button below discusses. As financial institutions wake up to the fact that, for example, brand values alone might be worth perhaps 10 per cent of total equity value, the idea of risk managing intangibles is likely to prove more attractive.

But there's a reason banks have been slow to risk manage their intangible assets. The problem for financial institutions is that managing their reputations, brands and goodwill is deeply interwoven with the problem of managing bank culture, staff attitudes, complex processes, and business direction. It's a more complex problem than, for example, risk managing the intangible assets of a consumer product business.

Managing these deep, dynamic drivers of a bank's reputation is not something that most bankers think a public relations company, or brand manager, is up to - and they're probably right.
Instead, risk managing financial institution intangibles is likely to be successful only if this is embedded within an enterprise risk management strategy.

Looking for business risks - from scenario building to worst-case analysis
How can institutions begin to think more formally about the business and strategic risks that they face? In an ERisk interview, our next Expert Witness says he thinks that it might be wrong to begin by trying to isolate the types of risk that might affect a business strategy. He also stresses that communicating the risks of a business strategy to stakeholders is a form of risk management in itself.

He argues that managers tend to define their areas of enquiry too narrowly, and that also managers of financial institutions sometimes focus too much on risks that can be quantified. Instead, he says that it's better to begin with a wide-ranging discussion of where a business might be heading and which business scenarios are likely to prove most disconcerting.

This kind of qualitative thinking about business risks and risky business environments or scenarios does not seem to fit comfortably with the more scientific approach of the financial risk manager. But recent developments in financial risk methodology have begun to break down the borders between the kinds of risks normally thought to be best dealt with by statistical risk measures, and those that are generally left to "business sense".

These developments began with the recognition that formal statistical attempts to capture market and credit risk exposures using approaches such as the value at risk methodology were not sufficient. They didn't allow managers to take account of unusual market conditions, or the risk that markets might swing between different structural states.

Credit and market risk managers began to supplement their statistical value at risk calculations with analyses of the likely effect on the company of a selection of "worst-case scenarios" - an approach that experts admit is as much an art as a science. Scenario analysis often employs sophisticated quantitative techniques to simulate the effects of a worst-case event on complex portfolios of financial positions, but the selection of each scenario and its parameters is essentially qualitative.

This kind of analysis cannot tell a manager how likely a risk event or scenario is to occur. But it can reveal the severity of the impact on the institution, and how risk variables interact within the firm to produce losses. It's a way of thinking about risk that seems to offer a bridge between financial risk analyses that depend on transparent market parameters and historical data, and qualitative risk analyses that have the capacity to be more forward looking - and which look rather more like traditional analyses of the resilience of business plans.

Business risk as a real options problem
We mentioned earlier that mortgage businesses incur a special kind of risk - that their customers will exercise their right or option to pay down mortgage debt if interest rates fall. In this case, the option lies with the customer.

But many key business strategy decisions also have the characteristics of an options contract. That's because the investments that a firm makes in implementing a business strategy open up certain choices, or options, that an executive can then exercise in the battle to increase profitability.

At a small scale, this is true of almost any decision made in a business. But it takes on more obvious and profound implications in the context of industries that are both very risky and very capital intensive such as the energy and pharmaceuticals businesses. Many of the decisions here are binary decisions that are difficult to revoke. Should we build a new power station, or invest in a new line of drugs, given that market structures and regulatory structures might change radically by the time these investments come on line?

Experts say that there are a couple of steps in framing an investment or business decision in terms of a real option. The first is to redescribe a business problem in terms of a series of defined events with more or less certain outcomes - events that might be linked to one another in a complex way. The second is to work out the sequence of decisions over time that give rise to the most optimal outcome.

This makes real options calculations sound rather simple. In fact, straight-forward sounding business decisions often contain within them a level of optionality - spread options, basket options, compound options - that stretches state-of-the-art valuation techniques for financial options. It's also a struggle to tie the necessarily simplified description of the option to the realities of decision-making on the ground.

Even so, the real options approach to business risk and reward optimisation has been applied to make clear the implications of investment decisions such as whether to build a power plant given the uncertain prices available in the marketplace. And it has also been used to try to work out the risks and opportunities of business decisions once the power plant is up and running - for example, whether it makes sense to decommission an ageing power plant, or whether to switch it to a different kind of fuel.

How does this all relate to financial and other industries where decisions about business direction are often not tied to a physical asset such as a power station? In an ERisk interview, our next Expert Witness talks us through the relationship between business strategy, decision theory and real options analysis.

He argues that real options analysis offers managers a way to bring together certain aspects of qualitative and quantitative approaches so that risky strategic decisions can be taken more appropriately. In banking, as in other areas, he says that real options analysis is as much a question of making sure that investment and risk decisions are clarified and given the right priority as it is of assigning absolute values.

This is an area of risk analysis that touches on an exciting new area in risk management in banking that is only just beginning to be addressed in any formal sense: the problem of valuing and managing the risk to any particular banking franchise, as the button above explores.

Transferring business risk - the cutting edge of risk management
After business risks are identified and assessed, they can then be thought of in terms of core business risks that it makes sense for the business to retain and non-core risks that the business is likely to want to transfer. This is as true for manufacturing corporations as it is for financial institutions.

The process of isolating and then transferring business risks has created most of the classic risk management markets that financial institutions depend upon today - and it's still underway. The endlessly shifting borders of risk transfer markets can be tracked by keeping an eye on innovations in the derivative markets, the specialty insurance markets and the market known as "alternative risk transfer".

As an example, let's take a look first at a particular deal that transferred a risky residual liability embedded within a company's marketing strategy.

Rolls-Royce is one of the world's most successful aerospace manufacturers. As part of its business strategy, the firm has for some years offered guarantees to certain customers covering a portion of the future value of aircraft powered by its engines, which in turn has helped customers arrange cheaper finance for purchasing Rolls-Royce powered products.

As time went on, the risks associated with these guarantees accumulated into a considerable financial exposure. Rolls-Royce realised that if it wanted to continue the practice, it would have to manage that risk. In one of the larger transactions of its kind, in February 2001, Rolls-Royce entered into an insurance agreement with XL Capital Ltd, that limited the aerospace company's exposure to Boeing and Airbus aircraft values. It was an innovative deal, but not unique. The technical risk advisors, Boston based RISC, said at the time they'd also acted as lead technical advisor to BAE Systems in 1998 in a $3.77 billion financial risk insurance program, and to SAAB on its November 2000 $1.3 billion financial risk insurance program.

These deals are a segment of a much wider and larger risk management market for managing the residual values of assets that businesses either own, or are financially exposed to by some part of their strategy. All of a sudden, risks that had for decades seemed an unavoidable part of doing business have become "manageable" - at a price.

But what of business risks that can't be related to tangible assets or liabilities? Let's take two notorious examples: weather and politics.

The weather risk transfer market began life as a segment of the energy risk management market. Energy companies had a problem in that their financial exposures depended not only on the price of energy supplies - which could be risk managed using derivative contracts based on energy prices - but also on capacity fluctuations in supply and demand caused by changes in the weather. One of the answers the industry found to this dilemma was the development of contracts that paid out money depending on changes in the temperature and precipitation, as the button below describes.

So far, the take-up of "weather derivatives" outside the energy industry has been limited. But early in 2001 the first weather risk management contract for a restaurant was arranged with risk management provider Enron by Speedwell Weather Derivatives Limited, on behalf of The Rock Garden. This transaction was intended to protect the restaurant business from loss of revenues due to a colder than normal summer. This was a small transaction, and there's no certainty that a more general market in financial umbrellas will mature. But it's a vivid example of how a risk that seems to be an inextricable part of a business in one decade can become transferrable by the next.

Political risk is something that affects many businesses, particularly firms that invest or do business in the emerging markets. It's a risk that is, to some extent, reflected in currency values and in the interest rate spreads connected with government and corporate debt. But it's always been a complicated task for many companies to separate out the political risk element of their risk portfolio and to make sure that it does not rise too high or become too concentrated.

As the button below discusses, a recent survey showed that few risk managers in major companies thought they had achieved any systematic political risk assessment, even though 80 per cent said they considered it a very important goal. It's a problem that is only going to get more urgent as the process of globalisation proceeds.

Where might all these developments lead? A survey in the year 2000 asked 30 organisations involved in novel insurance techniques what kind of innovative business risk transfer deals they had been approached about. Most respondents cited approaches that risk managed novel sorts of liabilities (30%), followed by techniques that helped to smooth out earnings results, and that injected capital into a firm when a specific risk event occurred - contingent capital.

But firms also said they had been approached about core entrepreneurial risks such as the risk from product launches, loss of market share, price fluctuations in final product markets, and the risks of research and development.

These risks sound like a roll call for risk-taking entrepreneurial capitalism. But whether retaining them makes sense really depends on how a business defines its core strengths and strategic direction.

There is one brake on the market, however. Experts agree that it makes little sense for a firm to try to offload the volatility of its complete portfolio of business risks. That, after all, is the risk that a shareholder assumes. If there are advantages to dampening out revenue volatilities that arise from the whole business risk spectrum, experts say it's likely that it will make more sense for a business to employ "balance-sheet smoothing" transactions.

Under this approach, a firm retains its exposures, but uses some funding mechanism to spread the losses out over an extended period. It's a process that staggers the impact of a risk event rather than transferring the costs of that event.

Conclusion
In some ways, business and strategy risks are the most difficult of risk types to define. What begins as a fuzzy or unquestioned business decision or assumption often evolves into a more sharply focused legal, credit or price risk shortly before it damages or destroys the company. The business decision or assumption is sometimes so fundamental to the business that it drives all other risk management functions in the firm.

That's why, at the time business or strategic risks are assumed, most are not easily dealt with in terms of the classic areas of risk management. They are too novel, or too intricately wrapped up in the business idea itself, to be separated out. They are also often too integral to the aims and ambitions of senior managers.

This makes the risk management of potentially lethal business and strategy risks a very special problem for risk managers. And it suggests that some way must be found of tying business and strategic risk management firmly into enterprise-wide approaches to risk management and corporate governance.