Another significant reference is the COSO ERM (Enterprise Risk Management) framework, developed by the Committee of Sponsoring Organizations of the Treadway Commission.
This paper addresses strategic risk management as an essential discipline for the sustainability of large corporations in an environment marked by increasing uncertainties and rapid transformations. Through a historical and evolutionary analysis, it explores the development of the risk concept from its origins in maritime trade and the Industrial Revolution to its contemporary consolidation as a core component of strategic planning. The paper distinguishes strategic risks from other types of organizational risks due to their low predictability and high impact, emphasizing their relevance in formulating resilient corporate policies. Fundamental concepts such as cause, event, and impact are discussed, along with both qualitative and quantitative approaches to risk analysis. Practical examples illustrate historical failures and best practices in risk management, reinforcing the importance of technology, governance, and organizational culture. Finally, the role of regulatory frameworks, such as ISO 31000 and COSO ERM, and emerging challenges like digital transformation, climate change, and cyber risks are highlighted. The paper concludes that strategic risk management should be integrated into the decision-making core of organizations, not only as a defense mechanism but as a tool for generating value and competitive advantage.
Introduction
In a corporate world characterized by increasing uncertainties, rapid technological transformations, and unstable socioeconomic dynamics, strategic risk management has become an essential competence for the survival and sustainable development of large organizations. Unlike traditional risk management, which focuses on operational or short-term financial aspects, strategic risks involve systemic elements, often external to the company’s direct control, with the potential to profoundly impact its future trajectory.
Related Articles
The COVID-19 pandemic, recent geopolitical conflicts, environmental crises, and rapid regulatory changes are examples of phenomena that have highlighted the need for a more robust and integrated approach to risk management. Therefore, protecting the corporate future requires not only identifying and responding to emerging risks but also developing a resilient organizational culture capable of anticipating complex scenarios and adapting quickly to disruptive transformations.
This paper proposes a historical, technical, and evolutionary approach to strategic risk management, discussing its conceptual origins and its application in contemporary corporations. Through a structured analysis, it aims to understand how companies can incorporate risk management as a central tool in the decision-making process, ensuring their longevity in a volatile global environment.
1. Origin and Conceptual Evolution of Risk Management
The notion of risk as a component of economic activity dates back to ancient times, but it was only with the advent of maritime trade in the 17th and 18th centuries that structured forms of managing risk began to emerge. Maritime insurance and financial protection contracts marked the first steps in a rudimentary risk mitigation system. During this period, the primary focus was on protection against tangible, physical losses, such as shipwrecks, piracy, and accidents.
With the Industrial Revolution, the increasing operational complexity and the rising value of physical assets drove the development of more systematic risk management practices. Companies began to adopt preventive measures against fires, mechanical failures, and workplace accidents, usually within the fields of engineering and industrial safety. Although these risks remained predominantly operational, risk management started to take on a more technical and organizational character.
The development of economic and statistical theories in the 20th century, particularly from the 1950s onward, introduced a new approach to risk management: the financial approach. With the emergence of Modern Portfolio Theory (Markowitz, 1952), risk began to be quantified, modeled, and managed through mathematical instruments. This evolution solidified the use of metrics such as Value at Risk (VaR) and fostered the creation of sophisticated derivative markets, but with a restricted focus on financial stability, leaving strategic risks on the periphery.
1.1 – Conceptual Foundations of Risk
The concept of risk, despite being widely used in various contexts, carries complex nuances that have deepened over time. Traditionally, it is understood as the possibility of an adverse event occurring, often associated with potential losses or damages. However, this simplified definition does not capture the multiplicity of possible interpretations, especially when applied to the corporate and financial context. Bernstein (1997), tracing the etymological origin of the word, observes that "risk" derives from the archaic Italian risicare, meaning "to dare," suggesting that risk should be understood as a deliberate choice rather than a mere chance. This perspective broadens the understanding of risk as something manageable and tied to decision-making, rather than being treated exclusively as an inevitable threat.
Authors such as Gastineau and Kritzman (1999) contribute to this development by pointing out that risk can be understood, in a broader sense, as exposure to uncertain variations, and more narrowly, as exposure to unfavorable variations. From a more contemporary and applied approach, Nunes (2009) defines risk as the possibility of a potential negative impact on assets or valuable characteristics, resulting from future events, whether internal or external to the organization. In the financial sector, risk is frequently associated with the variability of expected returns from an asset, with volatility being a key indicator of this uncertainty, as highlighted by authors such as Gitman (2004) and Jorion (2003). Moreover, there is a general consensus that the higher the assumed risk, the greater the expected return— the well-known risk-return trade-off, widely accepted in finance.
The analytical framework of risk includes three fundamental elements: cause, event, and impact. Every risk situation presupposes the existence of a causal factor (such as an operational failure, regulatory change, or market vulnerability), an event of materialization (the realization of the risk), and a corresponding impact, which could translate into financial losses, reputational damage, or even opportunities for gain. Smith and Merritt (2002) emphasize that a risk is only effectively manageable when it encompasses three dimensions: uncertainty (probability of occurrence less than 100%), impact (magnitude of the outcome), and time (period of exposure to the risk). Using this framework, risk analysis models can combine these vectors to assess the severity and prioritize responses. Nunes (2009) synthesizes this understanding by stating that risk represents the combination of the probability of an event occurring and its impact on organizational objectives.
Crouhy, Galai, and Mark (2008) further contribute to the discussion by reminding us that risk, in essence, is not new to business. Every organization is subject to traditional risks—such as variations in the business environment, competitive fluctuations, technological transformations, and changes in supplier relationships. Risk is, therefore, a constant in business operations, functioning as an "inevitable partner," as noted by Assi (2012). This omnipresence does not only imply losses: risks can also represent strategic opportunities, thus being ambivalent in nature. To measure them, qualitative analysis relies on the subjective estimation of expected losses and the likelihood of event occurrences. On the other hand, the quantitative approach allows the use of specific methodologies to estimate frequency and severity, assigning measurable values to risks and enabling their integration into mathematical and financial decision-making models.
Thus, the concept of risk evolves from a simplistic and subjective understanding into a sophisticated analytical construct, essential for formulating organizational strategies. Understanding its composition, dimensions, and manifestations enables not only the avoidance of losses but also the creation of value in challenging and highly competitive environments. Therefore, risk, far from being just an obstacle, becomes a key factor for innovation, adaptation, and the prosperity of modern corporations.
2. Emergence of Strategic Risks in the Corporate Landscape
Starting in the 1990s, events such as economic globalization, process digitalization, and the increasing interdependence between markets highlighted the limitations of traditional risk management models. Systemic crises, corporate scandals, and environmental disasters demonstrated that threats to business sustainability were not confined to the financial realm. Thus, the concept of strategic risk emerged, associated with events that are low in predictability but high in impact, directly affecting long-term objectives and the viability of the business model.
Unlike operational risks, which are generally more predictable and controllable, strategic risks involve political, regulatory, social, and technological variables. The bankruptcy of Enron, the 2008 financial collapse, and global climate challenges are examples of events that fell outside traditional models and required companies to adopt a more comprehensive approach, based on integrated governance and forward-looking analysis.
In this context, strategic risk management began to be incorporated into the highest levels of decision-making, such as boards of directors and executive leadership. Tools like scenario mapping, trend analysis, and stress testing started to be used more frequently, directly connecting risk to the process of formulating and reviewing organizational strategy. The understanding that risks not only threaten but also create opportunities contributed to the integration of this discipline at the core of business decisions.
3. Key Elements of Strategic Risk Management
Strategic risk management involves a set of integrated practices that go beyond merely mitigating threats. Among the central elements, robust corporate governance, an organizational culture focused on risk anticipation, and the use of technologies for predictive analysis stand out. The first aspect refers to the need for direct involvement from senior leadership in identifying and addressing risks that could jeopardize strategic objectives.
Another essential factor is the integration of risk management with strategic planning. Instead of being considered in isolated moments, risks should be analyzed from the stage of defining organizational goals to the execution and evaluation of results. This integration allows companies to have a holistic view of their competitive environment and take preventive measures based on data and simulations.
Furthermore, the use of technology, especially big data tools, artificial intelligence, and analytics, has revolutionized the way risks are identified and assessed. Digital platforms enable real-time analysis of external variables, facilitating the anticipation of trends and early detection of emerging threats. This adaptive intelligence is particularly important for organizations operating in dynamic contexts and subject to rapid transformations.
4. Practical Cases: Failures and Successes in Strategic Risk Management
Several examples in business history highlight the impact of poor strategic risk management. Kodak, for instance, had access to digital technology before its competitors but failed to recognize the disruptive potential of this new model. This resistance to change led to market loss and the brand’s irrelevance. Another striking example is Blockbuster, which ignored shifts in consumer behavior and the rise of streaming platforms like Netflix, resulting in its disappearance from the market.
On the other hand, companies that successfully adapted their management models and integrated strategic risk into their governance have stood out in adverse scenarios. Microsoft is an example of this: recognizing the centrality of cloud computing and the risks associated with reliance on local software, it redirected its strategy toward subscription-based services and digital storage, ensuring competitive renewal. Nestlé, for its part, anticipated environmental risks in its supply chain and adopted sustainable policies that strengthened its image and operational resilience.
These examples demonstrate that strategic risk is not merely a latent threat but a decisive element in the long-term creation or destruction of value. Companies that internalize this reality and act proactively are more likely to remain competitive in highly unpredictable markets.
5. Regulatory Frameworks and Support Structures
The consolidation of strategic risk management in the corporate environment has been strongly influenced by the creation of international regulatory frameworks and guidelines aimed at organizational governance. These standards seek to standardize practices, elevate institutional maturity, and ensure that strategic risks are addressed systematically, transparently, and integrated into the decision-making process. In this context, the ISO 31000 standard, initially published in 2009 and revised in 2018, stands out. It establishes broad principles and guidelines applicable to any organization, regardless of size or industry.
ISO 31000 promotes an integrated view of risk management by recommending that it be incorporated into organizational culture and strategic planning, rather than being treated as an isolated process. Its distinctive feature is adaptability: while providing a general framework, it allows each organization to customize its application according to its operational environment, objectives, and exposure to risk. This model favors the transversal application of risk management, facilitating its use in both public and private contexts.
Another significant reference is the COSO ERM (Enterprise Risk Management) framework, developed by the Committee of Sponsoring Organizations of the Treadway Commission. COSO ERM provides an integrated structure that links risks to strategic objectives and corporate performance, placing executive leadership as directly responsible for the active management of organizational risks. The framework also emphasizes the importance of elements such as ethical culture, effective internal communication, and alignment between risk appetite and decision-making, raising the level of responsibility and managerial maturity.
In addition to the normative guidelines, there has been an increase in regulatory pressure from both national and international bodies. Agencies such as the Securities and Exchange Commission (SEC) in the United States and the European Union, through specific regulations, have been requiring greater transparency in disclosing the key risks faced by companies. This mandatory reporting (disclosure) encourages corporate accountability practices, forcing organizations to adopt more robust methodologies for assessing, mitigating, and monitoring strategic risks. Non-compliance with these requirements can result in legal sanctions, loss of market value, and significant reputational damage.
6. Contemporary Challenges and Future Perspectives
The increasing complexity of the risks faced by organizations demands a dynamic, adaptive, and multidisciplinary approach. Climate change, digital transformations, geopolitical instability, and socio-environmental pressures are among the main drivers of strategic risk in the 21st century. These factors, often interconnected, require a systemic analysis that goes beyond traditional risk management methods.
Moreover, the advancement of exponential technologies presents unprecedented ethical and operational challenges. The large-scale collection and use of data, cyber vulnerability, and the automation of decision-making processes require constant updates to risk assessment and mitigation models. In this scenario, the formation of leaders with a systemic vision and the promotion of a resilient organizational culture will be critical factors for success.
Finally, the future of strategic risk management points to its complete integration into corporate strategy. Rather than being an isolated function restricted to technical or compliance areas, risk management will become an intrinsic part of the organizational architecture, accompanying the company in all of its key decisions. This movement represents not only a structural change but also a new way of thinking about the role of organizations in a world marked by uncertainty.
About the Author: With a senior professional profile and an impressive career at Banco Bradesco S/A, Adriano Assem dos Santos is a specialist in driving innovation and efficiency. His experience as a Product Manager and Senior Data Analyst demonstrates his ability to conceive and implement strategic solutions. Certified in SAFE® 4 Scrum Master, Adriano combines his knowledge of agile methodologies with a global perspective to lead high-performance teams and define strategies that generate significant results for the organization.
This article has been peer reviewed by Mr. Manoel P. de Lima Junior.
References
- ASSI, A. M. Risk Management: A Guide to Implementing Corporate Risk Management Processes. São Paulo: Atlas, 2012.
- BERNSTEIN, P. L. Against the Gods: The Remarkable Story of Risk. São Paulo: Campus, 1997.
- CROUHY, M.; GALAI, D.; MARK, R. The Essentials of Risk Management. 2nd ed. New York: McGraw-Hill, 2008.
- GASTINEAU, G. L.; KRITZMAN, M. Dictionary of Financial Risk Management. New York: Wiley, 1999.
- GITMAN, L. J. Principles of Financial Management. 10th ed. São Paulo: Pearson Education, 2004.
- JORION, P. Value at Risk: The New Benchmark for Managing Financial Risk. 3rd ed. New York: McGraw-Hill, 2003.
- MARKOWITZ, H. Portfolio Selection. The Journal of Finance, v. 7, n. 1, p. 77–91, 1952.
- NUNES, V. A. Risk Management: A Practical and Conceptual Approach. Rio de Janeiro: Elsevier, 2009.
- SMITH, D.; MERRITT, M. Proactive Risk Management: Controlling Uncertainty in Product Development. New York: Productivity Press, 2002.
