War Gaming and Scenario Planning
Even when GM decisions do not affect the decisions of other players – as often is the case with long-term product or technology strategies – it can be valuable to think through how other players will act, since that can give a more accurate and unbiased assessment of the risks and opportunities. War gaming workshops often start with known information on the strategies, strengths, weaknesses, and plans of key players. The key trend or issue that is the focus of the war game is explained; for example, there may be tighter fuel economy regulations scheduled to go into effect in some country in a few years. Then participants put themselves in the shoes of the other players and predict their responses to the trend or issue. Implications for GM's strategy and opportunities to mitigate risks are then identified.
When events are highly uncertain or even have low probability, like an economic crisis or oil shock, it can still add value to assess how external actors would respond if the event were to occur. This helps to stress test the contingency plans and can identify potential opportunities or risks to mitigate. By adding external players to the scenario planning, the need to bring in additional functions becomes apparent. If and when the event occurs, the action or crisis team will have a broader perspective and connection to important expertise, and information will be easier to access. The ERM staff can facilitate this type of contingency planning and the cross-organization connections through the risk officer network.
Thinking through how an event can spread or become a crisis makes the organization more sensitive to signals and triggers for more intense planning and preparation. A tool that GM has used in contingency planning is "DefCon" level, an idea borrowed from the U.S. Defense Department. When a risk with high impact but low likelihood is identified, it may not make sense to spend time and resources on detailed plans and preparations, particularly if there is likely to be significant notice or more urgent signals prior to the event. Instead, there can be a "plan to plan" with only preliminary analysis done at an early stage but commitment made for further analysis and action if particular indicators or signals are seen. The leadership group decides whether the event likelihood has reached a more serious DefCon level, triggering the appropriate preparations and actions.
External risks are difficult for any organization to understand and manage, particularly if the risks are only emerging or rare, or involve parties not at the table. By going beyond risk identification to helping decision makers achieve a 360 degree understanding of the external environment and players, ERM can aid good decision making. By using their unique perspective and a broad array of tools, ERM staff can frame the risks and opportunities and make actionable recommendations, thereby making the good decisions more likely and more robust.
-  DefCon is short for defense condition and is used by the U.S. military to describe the desired state of readiness. Wikipedia has a good description and history.