A risk-based approach to strategy
execution
Norman T. Sheehan
Norman T. Sheehan is
Associate Professor at the
Edwards School of
Business, University of
Saskatchewan, Saskatoon,
Canada
The author wishes to thank
Hanno Roberts and
Ganesh Vaidyanathan as well
as those who provided
comments at the Strategic
Management Societys Annual
Conference in Washington.
He also wishes to express
thanks for comments from
managers at the AICPA
Controller Workshop in Las
Vegas and the CMA/CAM-I
Summit in Calgary. The author
would also like to thank
managers in BI Norwegian
School of Managements EMBA
and MBA programs for their
encouragement and feedback.
DOI 10.1108/02756661011076291
1. A four-step framework to risk-based strategy execution
One of the key lessons from the recent recession is that firms that take on risk without being
adequately reimbursed for these risks will suffer poor performance, and in the worst case
become insolvent. If firms are to survive, and even thrive, in a post-recession world, they
need to adopt a risk-based approach to executing their strategies. Kaplan and Nortons
(2008) most recent work, The Execution Premium, lays out a practical framework for
improving strategic execution. While Kaplan and Nortons framework improves the firms
capability to capture the profitable opportunities envisioned by its strategies, their
framework does not explicitly address how to manage risk. The risk-based execution
framework proposed in this paper extends Kaplan and Nortons (1996, 2001, 2004, 2008)
work by explicitly integrating risk management principles within a comprehensive
management control system. The framework outlined herein can be used on a
stand-alone basis, but also complements Kaplan and Nortons body of work.
The primary benefit of a risk-based approach to strategic execution is that it allows
managers to focus on the opportunities outlined in their firms strategic plans, while at the
same minimize the potential impact of any threats. A risk-based management control system
allows managers to quickly and confidently react to opportunities (or threats) (Berinato,
2004), for example by purchasing a struggling rival. Another notable advantage of
systematically integrating risk into the management control system is that firms achieve
higher stock prices if its managers effectively demonstrate to financial analysts that they
understand risk and are managing it (Kersnar, 2009).
There are four steps in risk-based strategy execution: The first step is to use Kaplan and
Nortons (2004) strategy mapping tool to visually represent the firms strategy. Given the
firms strategy drives its risk exposure, the second step uses the firms strategy map to
identify and assess key organizational risks. Management control systems increase the
alignment between the activities outlined in the firms strategic plan with those undertaken by
its employees (Simons, 2000). The third step outlines how managers can design
management control systems to manage the risks identified. The fourth and final step
involves monitoring risk on an ongoing basis. Each of the four steps is illustrated using a
stylized example from a chain of coffee shops.
The Coffee Pot consists of a small chain of coffee shops located within shopping malls in a
North American university town. The founder was a charismatic guy who was very involved in
the day-to-day business. He worked hard to instil the values of honestly brewed coffee and
quality service in a friendly atmosphere. Unfortunately, the founder recently passed on and
his daughter, a bio-chemical engineer, has moved back home to become the CEO on a
part-time basis. She quickly discovered the chain was losing money, and has considerable
bank debt. In attempt to turn the tide, she introduces a limited assortment of fresh-baked
goods, and borrows additional funds to produce a new line of coffee machines which
VOL. 31 NO. 5 2010, pp. 25-37, Q Emerald Group Publishing Limited, ISSN 0275-6668 j JOURNAL OF BUSINESS STRATEGY j PAGE 25
 increase the yield from the coffee beans, without sacrificing coffee taste. The new coffee
machines allow The Coffee Pot to offer lower cost coffee to shoppers in malls, who then will
hopefully purchase higher margin baked goods.

2. Mapping the strategy

As managers cannot implement strategies that they do not understand, the first step in
risk-based strategy execution is to clearly map what the firm is trying to accomplish, in terms
of its mission, vision, and strategy (Kaplan and Norton, 2008). A firms mission outlines what
the firm is selling, where it is selling, who it is selling to, and its values. Typical of a smaller
entrepreneurial firm, the founder of The Coffee Pot had not formalized a mission statement
for his business. Implicitly, the mission of The Coffee Pot was to sell coffee to shoppers in
malls. Its values of honestly brewed quality coffee and good service in an inviting
atmosphere were embodied by the founder, however, once he passed on, these values
slowly died out as the new CEO, his daughter, was not actively involved in the business. The
vision outlines the owners future aspirations for the firm. The vision for The Coffee Pot was
never formalized, however, if you had asked the founder, he might have stated it was a place
where friends meet to have coffee. A firms strategy outlines how it will achieve superior
performance by using its resources/activities to offer a unique, compelling value proposition
to its target market. The Coffee Pots value proposition is offering value-priced coffee and
fresh-baked goods. It plans to achieve superior performance by luring customers into its
shops with low price coffee and then tempting them to buy higher margin baked goods. The
new CEO is also considering whether the firm should expand its offerings to include the sale
of wine and beer to customers.
One tool that clearly and concisely describes a firms strategy is a strategy map (Kaplan and
Norton, 2004). While a firms strategic plan outlines where it wants to go, a strategy map is a
one-page illustration which outlines how it will get there. A strategy map shows what the firm
hopes to accomplish in terms of customer, financial and societal goals, and how it will
achieve these results using its processes and resources (Kaplan and Norton, 2004). It
communicates key initiatives that need to be successfully executed if the organization is to
achieve its desired outcomes (see Figure 1).
The underlying logic of a strategy map for profit-seeking firms is as follows: Firms enable its
employees to effectively and efficiently complete key processes through training, enhancing
its culture, and support employees with information processes which improve their decision
making. Since the firm has the right employees who are well-supported when completing

Figure 1 Generic strategy map

Vision Long term aspiration for the organization

Mission Who, what, where, and how the organization will create value for its stakeholders
Learning &
Process Customer Financial
Growth

Describes Describes Describes

how the how the how much
Describes the
organization organization value the
organizations
will enable its will effectively organization
customer
employees to and efficiently needs to
value
perform the deliver the create for its
proposition
strategic customer share/
processes value stakeholders
proposition

We enable our To deliver the That provide satisfying That meet our
people strategic processes customer experiences stakeholder expectations

j j
PAGE 26 JOURNAL OF BUSINESS STRATEGY VOL. 31 NO. 5 2010
their work, they successfully complete the processes which deliver value to the customer,
such as customer service, innovation, production, and regulatory and compliance activities.
Successfully completing these processes means higher productivity and happy customers.
Happy customers are more likely to buy more each visit and make more visits, which should
lead to increased revenues and lower cost. And lower cost and higher revenues ensure the
firms meets its shareholders financial expectations.
A strategy map starts with the Financial perspective, which defines how much and what
type of value the organization needs to create to satisfy its shareholders and stakeholders.
Typically, an organizations financial objectives include increasing revenues, reducing cost,
and increasing asset productivity (see Figure 2). Given its past poor performance and debt,
The Coffee Pots new owner wants to increase profitability by maximizing revenues, while
minimizing costs and increasing cash flows (see Figure 3).
The strategy map moves next to the Customer perspective which describes the value
proposition the firm promises to deliver to its customers. The value proposition succinctly

Figure 2 Generic strategy map processes

Vision Long term aspiration for the organization

Mission Who, what, where, and how the organization will create value for its stakeholders
Learning &
Process Customer Financial
Growth
Common Three Increase
Types of Processes: Customer Revenues
Customer Value
Capital:
Processes Propositions:
Human Operational Decrease
Capital Customer
Processes Costs
Organization Intimacy
Innovation
Capital Product
Processes
Information Leadership Increase
Regulatory
Capital Operational Productivity
& Social
Excellence
Processes
We enable our To deliver the That provide satisfying That meet our
people strategic processes customer experiences stakeholder expectations

Figure 3 The Coffee Pots strategy map

Vision Place where people meet for coffee

Mission Quality, low priced coffee to shoppers in Malls
Learning &
Process Customer Financial
Growth
Make & Serve Satisfy
Recuit & Train
Coffee customers by Higher
Employees
offering good Revenues
New Offerings
Enhance tasting coffee
culture Procure at low prices Lower Cost
Supplies along with
Develop Increase
baked goods
Operating Compliance & Cash Flows
and great
Procedures & Social service
Controls Processes
We enable our To deliver the That provide satisfying That meet our
people strategic processes customer experiences stakeholder expectations

j j
VOL. 31 NO. 5 2010 JOURNAL OF BUSINESS STRATEGY PAGE 27
 answers why customers should buy from the firm rather than its rivals. Firms can offer a
combination of three customer value propositions (Kaplan and Norton, 2008):
1. product leadership;
2. customer intimacy; and
3. operational excellence (see Figure 2).
Product leadership entails being first to market with products that are widely-considered to
be the best in terms of quality, features, usability, service, etc. BMWs 5 Series automobiles
and Apples products are examples of successful product leadership strategies. Customer
intimacy involves offering the best total solution through customizing the product and buying
experience to fully meet the customers needs. Operational excellence involves consistently
producing offerings with reasonable quality and selling these at the lower end of the price
range, such as McDonalds food and many of Wal-Marts products. Given The Coffee Pot
aims to satisfy customers by offering good tasting coffee at low prices along with
fresh-baked goods and great service, its customer value proposition is anchored in
operational excellence, while still aiming to provide an acceptable level of customer service
and product quality (see Figure 3).
The Process perspective describes how the organization will efficiently and effectively
deliver the value promised to its customers. Key processes include:
B customer;
B operational;
B innovation; and
B regulatory and social processes (see Figure 2).
Customer processes involve increasing demand for the firms offerings by marketing to
current and future consumers, and managing relationships with current customers.
Customer process activities include formulating sales campaigns, making sales calls, and
improving the firms branding. Operational processes include all the activities necessary to
produce the offerings to be sold. Operational process activities include purchasing raw
materials, negotiating with suppliers, assembling the offerings, shipping the goods, and
after-sales service. Innovation processes include developing new offerings to sell and
improving the firms production processes. Regulatory and social processes include
ensuring employees are compliant with the jurisdictions laws and regulations as well as
undertaking activities which improve firms standing in the eyes of its stakeholders, such as
sponsoring childrens summer camps or reducing their environmental footprint. The Coffee
Pots key processes are making and serving coffee, developing new product offerings,
ensuring efficient operations, which include maintaining high coffee yields, and ensuring
employee comply with health, safety and food regulations (see Figure 3).
The last perspective, Learning and growth, describes the resources that enable the
organizations employees to effectively and efficiently perform the internal processes
described above:
B human capital;
B organizational capital; and
B information capital.

[. . .] that firms achieve higher stock prices if its managers

effectively demonstrate to financial analysts that they
understand risk and are managing it.

j j
PAGE 28 JOURNAL OF BUSINESS STRATEGY VOL. 31 NO. 5 2010
 Happy customers are more likely to buy more each visit and
make more visits, which should lead to increased revenues
and lower cost. And lower cost and higher revenues ensure
the firms meets its shareholders financial expectations.

Human capital involves improving the organizations capabilities by hiring and retaining the
right employees, and then enhancing their competencies through training. Organizational
capital aims to align the employees activities with the firms mission/vision by enhancing its
culture, teamwork, and leadership. Information capital is the IT systems which make
employees more efficient by assisting with transaction processing activities, such as payroll
or data entry, or more effective by providing decision making guidance, such as
management control systems, standard operating procedures, or customer relationship
management systems (see Figure 2). While the resources needed in this perspective are
largely intangible, and thus not accurately reflected in a firms financial statement, these
resources provide the foundation for a firms strategy execution. If the firm does not
effectively manage its human, organizational, and information resources over the longer
term, its performance is not sustainable.
The Coffee Pots learning and growth activities focus on recruiting and training the right staff,
enhancing the firms culture and developing standard operating procedures to ensure that
the coffee is made properly, and that labor, food and safety regulations are followed (see
Figure 3).
The underlying logic of Coffee Pots strategy map is as follows:
The Coffee Pot enhances its culture and trains its employees to properly complete the key
processes, such as customer service, cleaning tables, and making coffee and baked goods.
Properly completing these key processes makes its customers happy, and happy customers are
more likely to buy more coffee and baked goods per visit as well as make more visits to Coffee
Pots, which should lead to better financial performance.

A firms strategy map outlines how it plans to achieve the best possible outcomes for its
shareholders/stakeholders, but how can managers ensure all goes according to the
organizations strategic plan? In order to keep the firm on track for success, managers also
need to anticipate what could go wrong and then use its management control system to
prevent/reduce the impact and/or probability of these events occuring.

3. Identifying risks using a strategy map

Risks are internal and external events that will increase the firms costs or decrease its
revenues, and hence negatively impact its financial performance. Since the firms strategy
map describes all the initiatives that the firm must successfully complete if it is to achieve the
financial outcomes expected by its shareholders, we can use its strategy map to help
identify all potential risks the firm faces.

3.1. Customer perspective risks

What external events may decrease the attractiveness of the firms value proposition in the
eyes of current and potential consumers? There are two strategy tools, PESTE and Porters
(2008) Competitive Forces, which managers can use to identify external events that may
decrease the attractiveness of its value proposition (and hence hurt its revenues). Political,
Economic, Socio-Demographic, Technological, Environmental (PESTE) risks include
changing consumer tastes, shifting demographics (i.e. aging baby boomers), declining
consumer spending due to the recession, and restricted access to consumer credit. The

j j
VOL. 31 NO. 5 2010 JOURNAL OF BUSINESS STRATEGY PAGE 29
 Coffee Pot faces PESTE risks from a shift in demand from coffee/tea to caffeinated energy
drinks, such as Red Bull, and fewer mall shoppers due to the recession. Competitive forces
(suppliers, buyers, substitutes, rivalry and new entrants) risks to the customer value
proposition include competitors who introduce new products, and/or buyers who merge in
an effort to enhance their abilities to negotiate lower prices. The Coffee Pot faces competitive
forces risk from new entrants who add additional capacity and reduce revenues as well as
substitutes to coffee shops, such as in-home espresso machines, which may become more
attractive to consumers due to an increased ease of use, improved taste, and lower cost per
serving.

3.2. Process perspective risks

Process perspective risks are those events that may prevent the firm from creating the value
it promises to deliver to consumers. For example, if the firm promises good service, then
there is a risk that employees may fail to deliver good service or make quality coffee. There
are four types of process perspective risks:
1. customer;
2. operational;
3. innovation; and
4. regulatory and social.
Customer process perspective risks include branding and marketing campaigns that fail to
deliver the promised results or a sales force that is unable to generate new sales.
Operational process perspective risks are events with increase cost or decrease operational
effectiveness. Given The Coffee Pot is following a low price strategy, controlling cost is
critical to its success. Thus a key operational process risk is excessive waste due to
inefficient scheduling of employees or excessive use of raw materials. For help identifying
events which may increase its operational costs, managers can use PESTE and Porters
Competitive Forces. Political, Economic, Socio-Demographic, Technological, Environmental
(PESTE) risks include increases in commodity prices, restricted access to credit, increases
in interest and foreign exchange rates, new governmental regulations, and calls to reduce
firms environmental footprints. The Coffee Pot faces PESTE risks from increasing cost of raw
materials, such as coffee beans. Competitive forces (suppliers, buyers, substitutes, rivalry
and new entrants) risks include suppliers who use their bargaining power to increase prices.
For example, The Coffee Pots suppliers, such as mall owners, who use their bargaining
power to force the firm to accept rent increases.
Key innovation process perspective risks are the failure to successfully develop new
offerings or to continually improve production methods. The Coffee Pot needs to keep up
with new product innovations introduced by rivals, such as iced coffee drinks, if it is to
succeed over the longer term. The last category of process perspective risks is Regulatory
and social. Regulatory risk stems from employees, who knowingly or unknowingly break
internal or external rules and regulations. Examples include bribing officials to win sales
contracts, or knowingly breaching health, safety or environmental laws to reduce cost. The
Coffee Pot employees need to comply with health, food and safety regulations, such as
cleaning their hands and maintaining hygienic facilities. Financial reporting risk is the threat
the firms financial statements do not accurately reflect its actual performance. Financial
reporting risks can stem from unqualified accounting staff, or poor internal control over
company assets which leads to these being misused by employees. The Coffee Pot is not
required to have an audit, nor does it employ a professionally qualified accountant.

3.3. Learning and growth perspective risks

The last category of risk involves events which impair one or more of the intangible human,
organizational and information resources the firm relies on to successful complete its internal
processes. Any event which reduces the firms knowledge base, destroys its culture, or
incapacitates the information system used to support its employees decision making will
negatively impact the firms profitability. For example, The Coffee Pot may hire wrong

j j
PAGE 30 JOURNAL OF BUSINESS STRATEGY VOL. 31 NO. 5 2010
individuals, or may fail to train or retain the right employees. Its culture is also at risk since her
father was the one who kept it alive by walking around and its new CEO only works part-time.
Currently, the employees do not see the link from their daily activities to The Coffee Pots
mission and vision, which increase the risk of a bad service event. The Coffee Pot also needs
to invest in information systems to help run the business. While her father managed by
walking around and thus did not need a formal information systems, the new CEO, works
only part-time and thus needs a good financial reporting system and standard operating
procedures to help manage the business effectively.

4. Assessing risks
The next step is to rank each risk according to its financial impact and likelihood of
occurring, and then place each within the Risk response matrix (see Figure 3). Depending
on where a risk event is placed in the matrix, it is assigned one of four generic risk responses:
mitigate, avoid, transfer and accept (COSO, 2004) (see Figure 4).

4.1. Mitigate risk

For activities with a high likelihood of occurring, but where the financial impact of each event
is small, the best risk response is to use the firms management control systems to reduce
the potential for loss. For example, a bad service event (i.e. an employee delivers poor
customer service or poor quality coffee) has a low financial impact, but high likelihood of
occurrence. Given this, the risk of bad service events should be mitigated. Other risks that
need to be mitigated include waste of raw materials or overstaffing relative to number of
customers, increases in prices of raw materials, and the failure of staff to comply with health,
food and safety regulations.

4.2. Avoid risk

For activities that involve a high probability of losses of a large financial magnitude, the best
risk response is to avoid the activity. Given that beer and wine sales may attract a clientele
which may alienate The Coffee Pots current customer base, its management should avoid
the risk and not sell beer and wine.

4.3. Transfer risk

For activities that have a low probability of occurring, but the financial impact of each event
would be of a large magnitude, the best risk response is to transfer a portion or all of the risk
to a third party either by purchasing insurance, hedging, outsourcing or entering into
partnerships. Rather than bear the full risk of selling freshly baked goods, The Coffee Pot
should partner with a local bakery. Both parties should share the benefits and risks involved
with offering fresh-baked goods in The Coffee Pot. The Coffee Pot should purchase
insurance to transfer business interruption risk (e.g. due to fire) to an insurance company.

Figure 4 Risk response matrix

Financial Impact

LO HI

HI Mitigate Risk Avoid Risk

Likelihood

LO Accept Risk Transfer Risk

j j
VOL. 31 NO. 5 2010 JOURNAL OF BUSINESS STRATEGY PAGE 31
 4.4. Accept risk
If a cost-benefit analysis determines the cost to mitigate the risk is greater than the cost
ascribed to bearing the risk itself, then the best risk response is to accept the risk. The firm
should not take any action, other than to acknowledge the risk and monitor it. The Coffee
Pots managers should accept the following risks: the risk that mall owners may increase
their lease costs, consumer tastes may shift away from coffee/tea, the economic recession
reduces the amount of shoppers in malls, and the threat of new competitors entering its
trading area (see Figure 5).
By first identifying which events pose the greatest threat to the firm, managers can employ its
management control system to its maximum benefit. It allows managers to design the
management control system to align the firms risk exposure with the board of directors risk
appetite. The next section first outlines a comprehensive management control system, and
then explains how the managers of The Coffee Pot can use these controls to manage the
risks identified. The aim of the management control system is to reduce the risk to the point
that it meets the firms risk exposure target (Sheehan, 2009).

5. Designing a risk-based management control system

Simons (2000) Levers of control is a comprehensive framework which managers can
employ to enhance the execution of their firms strategies. There are five controls in Simons
framework (note the fifth, Interactive controls, is discussed in Section 6) that managers
can employ to manage risk (Sheehan, 2006):

5.1. Diagnostic controls

Diagnostic controls communicate to employees what activities lead to strategy execution
and then report whether they were successfully completed. This is managing by the
numbers; management communicates its expectations to employees by setting targets for
each activity, provides resources and outlines initiatives to achieve these, then regularly
monitors if they are achieved, and rewards employees if they are. Examples of diagnostic
controls include budgets, cash forecasts, and balanced scorecards. JetBlue is a low cost
airline which manages its operations using two key metrics:
1. Breakeven load factor (BELF) measures how many passengers they need to break even
for each flight.

Figure 5 Assessing The Coffee Pots risks

Financial Impact
LO HI
Mitigate Risk Avoid Risk
Bad service event Management decides not to
Waste of raw materials sell beer and wine
HI Overstaffing of the coffee shops
Increases in raw material prices
Failure to comply with Health,
Likelihood Food and Safety regulations
Accept Risk Transfer Risk
Increase in lease costs Offering fresh-baked goods in
LO Tastes changing to energy the coffee shops
drinks Fire destroys a coffee shop
Less shoppers in malls
Threat of new coffee shops

j j
PAGE 32 JOURNAL OF BUSINESS STRATEGY VOL. 31 NO. 5 2010
 Beliefs outline what the firm stands for and serve to inspire
and motivate employees to make a difference. Employees who
have bought into the firms beliefs are excited to come to work
and find new ways to enhance the firms value proposition.

2. Cost per available seat mile (CASM), which measures how much its costs to fly per seat
mile. JetBlue has a target of having the lowest CASM in the industry and has introduced
several initiatives to achieve this goal.
In the second quarter of 2009, JetBlues CASM was 8.9 cents, Southwests was 9.8 cents,
while the remainder of the large carriers were over 10 cents.

5.2. Boundary controls

Boundary controls, such as employee codes of conduct and standard operating
procedures, are intended to constrain employee activities. They make it clear to
employees which actions are unacceptable and eliminate ignorance as a defence.
Examples of boundary controls include rules regarding the use of company property,
sharing of proprietary information, conflicts of interest, and payments to government
officials. Fluor competes in the global construction industry where bribery is a major issue for
all construction firms. Fluors CEO, Alan Boeckmann, implemented an award-winning
program to reduce incidents of bribery and corruption. Each of Fluors employees receives
online training and workers who directly interface with government officials receive
face-to-face training. To drive the training home, Fluor appointed a Head of Compliance, has
an open-door policy for reporting potential violations of its corruption policies, and has a zero
tolerance for violators of the policy. In recognition of its efforts to reduce incidences of
bribery, Fluor has been named the Worlds most admired engineering company.

5.3. Belief controls

While performance measures and boundaries seek to align employees activities with the
firms strategy by appealing to their rational side, belief controls seek align behavior by
appealing to employees emotional side. Beliefs outline what the firm stands for and serve to
inspire and motivate employees to make a difference. Employees who have bought into the
firms beliefs are excited to come to work and find new ways to enhance the firms value
proposition. While the companys beliefs are manifested in its corporate culture, examples of
formal belief controls include company value statements and corporate credos. Zappos is
an online seller of shoes. Its CEO, Tony Hsieh, consciously invested in belief controls in order
to gain an advantage over its many Internet rivals, who in many cases sold the same shoes at
similar prices. Zappos competes on customer service so its belief controls reinforce the
importance of delivering the best service. Zappos formalized its values into a value
statement and publishes employee interpretations of these in an annual publication which
distributed to all employees. The firm works hard to attract and keep the right individuals. For
example, Zappos offers to pay $2000 to any new recruit if he or she leaves the company at
the end of their two week training period. It reinforces the importance of beliefs by basing
half of each employees merit pay on how well they are judged to be living Zappos beliefs.
The investment in beliefs means Zappos can grant its customer service reps full authority to
do anything to satisfy a customer, a trust that is paid back by employees who offer the best
service in the industry. Hsiehs strategy of having the best service paid off as Zappos was
bought by Amazon in November 2009 for $1.2 billion.

j j
VOL. 31 NO. 5 2010 JOURNAL OF BUSINESS STRATEGY PAGE 33
 5.4. Internal controls
Internal controls ensure accurate record keeping, safeguard the firms assets, and enhance
compliance with all applicable laws and regulations. These include having qualified
accounting staff, forced staff vacations, authorizations, physical safeguards, IT security,
segregation of duties, etc. The next section discusses how managers can use Simons
management control levers to manage risk.

5.5. Using levers to control to manage risk

The Coffee Pots managers need to customize their use of Simons Levers to ensure they are
adequately mitigating, avoiding, and transferring the risks identified above.
Mitigate risk. Managers can reduce risk using diagnostic controls to communicate
expectations, monitor progress, and then reward employees for providing good service,
decreasing waste, and keeping the premises clean. In order to manage the risk of
increasing cost of inputs, The Coffee Pots managers can reward the purchasing manager
for managing input costs by maintaining relations with several buyers, while preserving
quality.
Managers can use boundary controls to decrease risk by clearly delineating which
behaviours are to be avoided, such as failing to properly wash hands. For example, The
Coffee Pots managers can write the boundary control as thou shall not leave the bathroom
without washing hands. Standard operating procedures, such as those which clearly
describe the way to make a batch of coffee, also reduce the risk of a bad service event. Like
Fluor, some firms have increased the effectiveness of their boundary controls systems by
offering compliance training, introducing compliance managers, confidential employee
compliance surveys, independent compliance audits, compliance hotline, and having exit
interviews which discuss any incidences of non-compliance the employee may have
witnessed. While many of these initiatives may not be appropriate for smaller firms, such as
The Coffee Pot, it may consider adding the responsibility of compliance to one of its
managers to ensure it is not overlooked.
The belief controls mitigates risk as they help to recruit and retain the best employees, which
in turn, are less likely to commit service errors. Hiring only employees that buy in to the firm
values, ensures they are less likely to harm the firm (Heskett et al., 2008). Beliefs also may
come alive through peer pressure, which helps encourage employees to perform to
activities that are beneficial the firm. Once firms have formalized their beliefs, there are a
several tactics managers can use to enhance its efficacy:
B Hire only employees who fit with the firms belief system.
B Managers not only talk about beliefs, they must also walk the walk.
B Reward behaviours which are in line with beliefs (and severely punish those who are not).
B Inculcate the desired values during orientation and subsequent training.
B Tell and re-tell stories about employees who were seen to be living the firms values.
Avoid risk. Managers can use boundary controls to avoid risk by placing risky activities off
limits. For example, The Coffee Pot should not to sell beer and wine. The Coffee Pot can
make this strategic boundary clear by formalizing a mission statement and then
communicating it to all managers which states we sell only coffee and baked goods to
mall shoppers. Another way to effectively ensure employees avoid certain activities is to
actively use belief systems. As outlined above, hiring individuals that buy into the firm what
the firm is trying to accomplish, and developing a positive culture will reduce the risk that
employees undertake harmful activities.
Transfer risk. Managers can use controls to protect the firms assets by share risks to third
parties, such as transferring the risk of business interruption due to fire to an insurance
provider. For example, The Coffee Pot can use diagnostic controls to transfer risk from the
owner to its managers by offering its managers low fixed salaries and large variable bonuses
for meeting performance targets. The Coffee Pot can seek an alliance with a bakery to

j j
PAGE 34 JOURNAL OF BUSINESS STRATEGY VOL. 31 NO. 5 2010
 Managers need to monitor the appropriateness of their firms
strategy in light of environmental changes. A starting point is
to pay close attention to those risks that pose the greatest
threat to its strategy.

provide fresh-baked goods to each of its branches on a daily basis. Management can then
manage the alliance risk by monitoring its partners performance on a regular basis.
Accept risk. Risks such as the popularity of coffee declining, fewer shoppers visiting malls,
and new entrants should be accepted and monitored. We will discuss the monitoring of risks
in the next section.

6. Monitoring risks using interactive controls

The interactive monitoring process has a number of components: First, management needs
to regularly monitor the risks listed above to ensure that the management control system is
working. Is the management control system reducing the risks to the extent anticipated? Is
the risk exposure in line with the firms risk appetite? If things are not going as planned, do we
need to revisit the way we use controls to manage risk or do we need to change our strategy?
Managers need to monitor the appropriateness of their firms strategy in light of
environmental changes. A starting point is to pay close attention to those risks that pose
the greatest threat to its strategy. These risks become the focus of its interactive control
system. The interactive control system monitors the validity of the firms strategy as the
external environment changes to ensure it is still being adequately compensated for the risks
it is assuming. Dell and Mattel are examples of firms that appear to be lacking
well-functioning interactive control systems as they both lost a significant amount of market
value due to a mis-match between their strategies and environments. In the period
2005-2009, the Dell direct model lost its edge to lower cost producers, such as Acer and HP,
as well as Apples faster and hipper machines at the higher end. Given this, Dells market
capitalization took a large hit. In 2005, Dells market capitalization ($100 billion) was double
that of Apple ($28 billion) and HP ($63 billion) combined. In October 2009, Dell market
capitalization was $30 billion, while HPs was $109 billion and Apples was $162 billion.
Mattels Barbie lost its edge to newer, hipper dolls such as Spin Masters line of Liv dolls, as
well as electronic games, such as Nintendos Wii and DSi handheld game. Barbies sales
have dropped 28 percent since 2002 and its market share has been reduced from 80
percent to 50 percent in the period from 2000 to 2009.
As part of its interactive controls system, senior managers need to continually gather
information about and debate how environmental changes may impact the firms ability to
achieve its strategy, and then make any necessary adjustments to the strategy. A successful
interactive system generates dialog and debate about the key risks throughout the
organization and one that allows the discussion to reach the ears of the senior management
team. Senior managers need to ensure that if a salesperson hears of a rivals impending
product introduction, this information reaches them. If the firms management team wants to
be informed of relevant signals from the market it needs to ensure all employees:
B Have a common understanding of the firms strategy map.
B Understand how they can contribute their thoughts and findings.
B Feel that the firms value system emphasizes (and rewards) information sharing.

j j
VOL. 31 NO. 5 2010 JOURNAL OF BUSINESS STRATEGY PAGE 35
 If a cost-benefit analysis determines the cost to mitigate the
risk is greater than the cost ascribed to bearing the risk itself,
then the best risk response is to accept the risk.

After struggling in the wake of the telecom crash in 2001, Corning saw its sales fall from $7
billion to $3 billion in less than 18 months and its number of employees fall from 43,000
workers to 21,000 workers. Given this, Corning is now vigilantly working to avoid another
debacle. The first step Corning took to develop its interactive control processes was to
improve its environmental sensing abilities. Rather than solely rely on its buyers for market
forecast information, Corning now also actively seeks and uses market forecast information
from its customers customers when developing its strategies.
For the management of The Coffee Pot, a key risk that may be the focus of the interactive
control is the growing trend of buying coffee at drive-thrus (The Coffee Pot offers only walk-in
service at the mall) and the amount of shoppers in malls. If drive thrus become more popular
while mall shopping decreases, The Coffee Pot must amend its strategy of selling only to
mall shoppers. A key opportunity that may warrant further evaluation, is offering yerba mate
tea which is a stimulant like caffeine without many of the drawbacks (see Figure 6).

7. Conclusion
Keywords:
Strategic management, Firms that fail to be reimbursed for risk or firms that do not identify and manage their risk
Risk management, exposure will suffer. Managers need to improve their strategic execution capabilities by fully
Risk assessment, integrating strategy mapping with control, compliance, and risk management activities. In
Strategic planning, times with mounting uncertainty, a risk-based control system enhances managers ability to
Performance management competently steer their firms towards good things and away from bad things.

Figure 6 Managing The Coffee Pots risks with levers of control

Financial Impact
LO HI
Mitigate Risk Avoid Risk
Bad service event diagnostic, Management decides not to
boundary, and beliefs controls sell beer and wine and
Waste of raw materials updates mission statement to
HI
diagnostic and boundary clarify its purpose boundary
controls controls
Overstaffing of coffee shops
diagnostic controls
Increases in raw material prices
Likelihood diagnostic controls
Failure to comply with Health,
Food and Safety regulations
boundary and beliefs controls
Accept Risk Transfer Risk
Tastes changing to energy Offering fresh-baked goods in
drinks monitor with Interactive the coffee shops share risk
LO
system with a Bakery
Amount of shoppers frequenting Fire destroys a coffee shop
malls monitor with Interactive transfer risk to an insurance
system company

j j
PAGE 36 JOURNAL OF BUSINESS STRATEGY VOL. 31 NO. 5 2010
References
Berinato, S. (2004), Risks rewards: are you on board with enterprise risk management? You had better
be its the future of how businesses will be run, CIO, Vol. 22 No. 3, pp. 1-10.

COSO (2004), Enterprise Risk Management Integrated Framework: Executive Summary,

The Committee of the Sponsoring Organizations of the Treadway Commission.

Heskett, J.L., Sasser, W.E. and Wheeler, J. (2008), The Ownership Quotient: Putting the Service Profit
Chain to Work for Unbeatable Competitive Advantage, Harvard Business Publishing, Boston, MA.

Kaplan, R.S. and Norton, D.P. (1996), The Balanced Scorecard, Harvard Business Publishing, Boston,
MA.

Kaplan, R.S. and Norton, D.P. (2001), The Strategy Focused Organization, Harvard Business Press,
Boston, MA.

Kaplan, R.S. and Norton, D.P. (2004), Strategy Maps, Harvard Business Publishing, Boston, MA.

Kaplan, R.S. and Norton, D.P. (2008), The Execution Premium, Harvard Business Publishing, Boston,
MA.

Kersnar, J. (2009), Warning signs: why risk management is letting down companies and what to do
about it, CFO Europe Magazine, 2 February, pp. 25-30.

Porter, M.E. (2008), The five competitive forces that shape strategy, Harvard Business Review, Vol. 86
No. 1, pp. 78-93.

Sheehan, N.T. (2006), Want to improve strategy execution? Simons says Levers, Journal of Business
Strategy, Vol. 27 No. 6, pp. 56-64.

Sheehan, N.T. (2009), Making risk pay: the boards role, Journal of Business Strategy, Vol. 30 No. 1,
pp. 33-9.

Simons, R. (2000), Performance Measurement and Control Systems for Implementing Strategy,
Prentice-Hall, Upper Saddle River, NJ.

About the author

Norman T. Sheehan is an Associate Professor at the Edwards School of Business, University
of Saskatchewan. He teaches, publishes, and consults in the areas of strategy formulation,
strategy implementation and risk management. Norman T. Sheehan can be contacted at:
Sheehan@Edwards.usask.ca

To purchase reprints of this article please e-mail: reprints@emeraldinsight.com

Or visit our web site for further details: www.emeraldinsight.com/reprints

j j
VOL. 31 NO. 5 2010 JOURNAL OF BUSINESS STRATEGY PAGE 37