An article in the Harvard Business Review titled “Managing Unpredictable Risks: What to Do When There Are No Precedents” by Robert S. Kaplan, Herman B. “Dutch” Leonard, and Anette Mikes addresses emerging risks and some techniques for responding to them in ways that can help mitigate their impact. Organizations handle common operational risks, but standard policies fail when confronted with unforeseen or complex events. New risks arise from unexpected combinations or large-scale events. Relying on routine management practices can create a false sense of security, while real risks grow. A Risk Management team must act swiftly, making adaptable decisions with awareness of uncertainty, as not all actions will be successful.

Among the techniques mentioned is the OODA loop, originally developed for military purposes, which has proven to be an extremely versatile tool, also applicable to the business world, particularly in the context of risk management. The OODA loop, an acronym for Observe, Orient, Decide, Act, provides a structured framework for dealing with dynamic and complex situations, such as those typical of corporate risk management. Here’s how each phase integrates into this process:

OBSERVE
The first step involves information gathering, which consists of identifying and continuously monitoring potential internal and external risks to the company, followed by data analysis, using analytical tools and techniques to understand the nature, probability, and potential impact of each risk. A constant monitoring of the environment is essential to quickly detect changes in the competitive, regulatory, and technological landscape that may influence the risk profile.

ORIENT
The initial classification of risks based on their severity and priority allows for an accurate risk assessment and the definition of risk tolerance, which is the level of risk acceptable for the organization. The final step is linking the risks to strategic objectives and understanding how these risks may affect the company’s ability to achieve its goals.

DECIDE
Developing a response plan is the first decision-making phase that outlines the actions to mitigate, transfer, or accept the identified risks. This phase is necessary but insufficient on its own without assigning responsibility for the implementation and monitoring of the response plans and allocating the necessary resources to carry out the risk management measures.

ACT
This phase involves the implementation of mitigation measures, executing the actions designed to reduce the risk impact, monitoring their effectiveness, making adjustments as needed, and communicating with all stakeholders about the risks and the actions taken.

The advantages of using the OODA loop in Risk Management include a faster response to changes and new threats, a focus on the most critical areas, support for data-driven and analytical decision-making, and continuous improvement, thanks to the iterative approach to risk management.

In conclusion, the OODA loop provides a robust and flexible framework for managing complex business risks. By applying this cycle, organizations can enhance their ability to identify, assess, and mitigate risks, thus increasing their resilience and capacity to achieve their objectives.

Let’s now consider an example of Risk Management applied to the complexity and dynamism of the modern Supply Chain, evaluating risks related to suppliers, developing business continuity plans, and monitoring supplier performance.

For instance, a health crisis requires: observing the evolving situation, orienting towards potential supply chain disruptions, deciding to diversify suppliers, and implementing employee safety measures. Or, the introduction of a new product might involve monitoring customer demand, assessing potential production and distribution difficulties, deciding to invest in new production capacities, and executing a market launch plan.

OBSERVE

• Monitoring suppliers, continuously assessing their performance, identifying potential risks (such as production disruptions, delivery delays, quality issues), and tracking their key performance indicators (KPIs);
• Analyzing market data, such as monitoring demand trends, market trends, raw material prices, and exchange rate fluctuations;
• Detecting unforeseen external events like natural disasters, geopolitical conflicts, regulatory changes, and health crises that can impact the supply chain.

ORIENT

• Assessing the potential impact of each identified risk on the supply chain, considering the likelihood of occurrence and economic consequences;
• Defining future scenarios to simulate different risk combinations and assess the resilience of the supply chain;
• Aligning with strategic objectives, evaluating how risks may influence the company’s goals, such as cost reduction, customer service improvement, and profitability increase.

DECIDE

• Developing continuity plans to ensure operational continuity in case of supply chain disruption, identifying alternative suppliers, transportation routes, and emergency procedures;
• Defining service levels expected by customers and the actions necessary to ensure satisfaction even in uncertain conditions;
• Allocating the resources needed to implement risk response plans, such as investing in supply chain traceability technologies.

ACT

• Implementing concrete mitigation measures to reduce the risk impact, such as diversifying suppliers, creating safety stocks, and setting up early warning systems;
• Continuously monitoring the effectiveness of the adopted measures and updating response plans based on results;
• Transparent and timely communication with customers, suppliers, and other stakeholders about potential risks and actions taken.

Finally, the OODA loop can be integrated with other risk management frameworks, such as ISO 31000, to provide a more comprehensive and robust approach to threat mitigation. By integrating these frameworks, the OODA loop can be used for rapid risk assessment, while ISO 31000 offers a structured and documented risk management policy.

For Risk Management support for your organization, contact us at info@kriptia.com.