Capability Risk: When the Strategy Outruns the Organisation

Risk registers are full of external events: a recession, a new competitor, a supplier failure, a cyber attack. They rarely list the risk that sinks more strategies than any of them: the organisation cannot do what the plan requires. A five-year plan that doubles digital sales, enters two new countries and completes an acquisition assumes capabilities in data, pricing, market entry and integration that the company may not have, and nobody has put a number on the gap.

Capability risk is the probability that the strategy fails because of how the company works, not because of what happens outside it. It is uncomfortable to assess, because it means grading ourselves, but it can be measured with the same rigour as any financial risk.

Map what the strategy requires against what exists

Start from the strategic plan, not from the organisation chart. For each initiative, list the capabilities it depends on: a capability is a combination of people, process, data and technology that produces a result repeatedly. Then score each one on a simple maturity scale, from 1 (ad hoc, dependent on individuals) to 5 (systematic, measured, improving), today and at the level the plan needs.

The picture is typical of a company whose plan has moved faster than its organisation. The traditional strengths, cost management and project delivery, are where they need to be. The gaps are all in the capabilities the new strategy depends on most, and the largest one, digital sales, supports the initiative that carries the biggest share of planned growth.

Translate the gap into value at risk

A maturity gap becomes a financial risk when it is linked to the value of the initiatives that depend on it. If 40% of the planned EBITDA growth comes from digital sales and the company has never built a capability from level 1.5 to 4 in three years, the honest forecast applies a probability to that growth, or adds the time and cost of building the capability to the plan. Either way, the board sees the strategy's real risk-adjusted value.

• Key-person dependence: a capability at level 1 or 2 often lives in one or two people. Their departure is a risk event with a probability and an impact, and it belongs in the register.
• Concurrency: each gap may be manageable alone. The risk multiplies when the same few leaders must close four gaps at once while running the business.
• Build time: capabilities take longer to build than budgets assume. Hiring a team takes months; making it effective takes years.

Four ways to close a gap

1. Build: hire, train and invest in process and systems. The cheapest option in the long run and the slowest.
2. Buy: acquire a company that has the capability. Fast, but it requires the integration capability that is itself often a gap.
3. Borrow: partners, outsourcing, advisers. Quick and flexible, but the capability does not stay in the company.
4. Re-sequence: change the order of the strategy so that the initiatives needing the weakest capabilities start later, after they have been built.