Risk is driven by extrinsic change (current and future) and intrinsic vulnerability. Change can't always be avoided or mitigated, but vulnerability can be. The opposite of vulnerability is resilience, the process of building and maintaining the capacities to absorb shocks, incrementally adapt to change that is already happening and transform in response to severe impacts.

7 min read | Last updated 9 March 2021

Risk is a product of intrinsic vulnerability to change and extrinsic likelihood of change, ie it depends on the qualities of both the organisation and the change. Vulnerability is the potential impact of a change on an organisation due to its exposure and sensitivity, ameliorated by its capacity to adapt to the change. The likelihood of any change will depend on numerous drivers.

The framework below explains how, for instance, a business’s climate risk is the product of its vulnerability to climate change and the likelihood of climate change. Vulnerability to climate change can be reduced by decreasing exposure or sensitivity, or by increasing adaptive capacity. The likelihood of climate change must be tackled through collective mitigation.

The WEF Global Risks Perception Survey maps the likelihood and potential impact of a wide range of major global risks, as perceived by business people worldwide.

The survey depicted in the chart below was conducted pre COVID-19, towards the end of 2019. At that time, infectious disease was considered a global risk of potentially high impact, but less likely than many other global risks (see the red diamond, middle of upper left quadrant).

Many businesses, though they may have been conscious of the impact a pandemic could have had on their business, would have thought it unlikely to occur and would therefore have neglected to reduce their vulnerability. As the pandemic unfolded, businesses were unprepared. They had to absorb some initial shocks and then figure out how to adapt to ongoing economic and social change.

WEF survey respondents were asked about the global risks they were most concerned about for doing business in their country within the next decade. Their answers varied by nation because, for each global risk, respondents would have taken into account the likelihood of local change as well as assessing the magnitude of impact based on local exposures, sensitivities and adaptive capacities.

  • British, Canadian, French, German, Italian and Americans were most concerned about cyber attacks
  • Australians were most concerned about energy price shocks
  • Indians and Ethiopians feared water crises
  • Vietnamese were worried about asset bubbles and failures in urban planning
  • Russians feared conflict and instability
  • Brazilians were concerned about a failure of national governance
  • Kenyans and South Africans were worried about unemployment
  • Japanese and New Zealanders were most concerned about natural catastrophes
  • Chinese fears were fairly evenly spread across all risks

Change is the extrinsic driver of risk. It can be real (change that is happening) or potential (future change). It can be acute (eg a disaster event) or chronic (eg climate-related change).

Humanity’s political, economic, social, technological, legal and environmental systems are constantly changing, spinning off trends that grow and merge, fostering more change. Examples of systemic changes include artificial intelligence, crowd sourcing, partnership models, the sharing economy, globalisation and the internet of things. Systemic changes sometimes combine to create macro trends – these are structural shifts that are long term in nature.

Examples of macro trends, categorised by the pillars of sustainable development:

  • Peace and partnerships – geopolitical instability, technomic cold war, polarization and radicalism on the rise, erosion of governance, hyper / peak globalisation, the rise of Asia, generational handover
  • Planet – climate change and decarbonisation, de-materialisation, microbiomes, synthetic biology, local pollution, degradation, resource scarcity impetus for innovation
  • People – rapid urbanisation, demographic and social change, empowerment, hyperconnectivity, disengagement, aging, displacement, population growth in Asia and Africa, culture wars
  • Prosperity – automation, datafication, accelerated innovation, synthetic media, work and life unbounded, behavioural economy, short term crisis – long term slowdown, post-materialism

(PwC / Blackrock; EY; Deloitte (pdf); HP; WBCSD (pdf))

Vulnerability is the intrinsic element of risk, something that a business can change about itself. It is the propensity or predisposition to be adversely impacted by a change. It stems from exposure and sensitivity to the change, and can be modified by resilience, such as adaptive capacity.

  • Exposure is a result of simply being present in settings where a change occurs.
  • Sensitivity is the degree to which the business could be affected when the change occurs.

The diagram below shows how building adaptive capacity (one of three types of resilience) reduces the potential impact of a hazard.

Case Study

The Vulnerability of Kraft Heinz

Kraft Heinz (KH) is the world’s fourth largest food and beverage company. The food and beverage industry is exposed and sensitive to customers’ changing preferences toward more sustainable and healthier products. Through the 2010s, some of KH’s key competitors demonstrated adaptive capacity by incrementally adopting more sustainable ways of doing business. KH did not demonstrate this adaptive capacity, maintaining notably poor sustainability practices due to a lack of board expertise on sustainability and other problems (Edie, 2020).

For example:

  • A 2019 report on deforestation risks faced by consumer goods manufacturers and retailers (due to forest risk commodities, such as palm oil, soybean and cattle, playing a major role in their product formulations) placed KH 20th out of 22 companies analysed. The report concludes that KH faces considerable physicals risks in its raw material supply chain, displays poor foresight in identifying and acting on opportunities relating to sustainable consumption and production, and has poor deforestation-related governance and strategic frameworks through the strength of its board level expertise, risk management policies, commitments, implementation, reporting, targets and delivery (CDP, 2019 (pdf)).
  • Greenpeace asked 12 members of the Consumer Goods Forum to disclose the mills that produce their palm oil. KH was one of four that refused to do so (Greenpeace, 2018 (pdf)).
  • KHz scores very poorly on the Access to Nutrition Index. Of 22 companies analysed, it places 20th on governance, 18th on products, 17th on accessibility, 13th on marketing, 21st on wellness outcomes, 19th on labelling and 18th on engagement.
  • NGO As You Sow analysed the plastics pledges and actions of 50 of the largest consumer-facing goods businesses across six key areas: product design; reusable packaging; recycled content; packaging data transparency; supporting recycling and producer responsibility. KH was one of 22 firms that scored D (a further 15 scored F).
  • Investor coalition FAIRR has seen a tenfold increase in the four years up to 2020 in the plant-based food-related assets that its cohort manages. FAIRR’s analysis shows that KH had not produced adequate information on innovation within its portfolio and had not grown its plant-based offering in the 2016-2020 period.

As its competitors reduced their vulnerability, KH’s vulnerability grew, leading to a US$19.5 billion impairment on assets in 2019 and 2020 (WSJ, 2019 and 2020).

The company has had to respond by building its capacity to adapt to changing preferences for sustainable products. KH produced its first ESG report in 2020, stating goals to reduce its emissions, energy use, waste and water use per metric tonne of product, and the chief executive has been given ESG-linked KPIs for the first time, along with more than 130 other senior members of staff (Edie, 2020).

Resilience is not a state that is achieved but a continual process of building and maintaining absorptive, adaptive and transformative capacities as means of achieving organisational goals (Oxfam, 2017 (pdf)). For instance, most businesses are (or should be) in the process of building their capacity to adapt to current and future climate-related change – so that they can continue with their purpose and goals. Global best practice guidance is provided in the Recommendations of the Taskforce on Climate-related Financial Disclosures (TCFD, 2017 (pdf)).

Absorptive capacity brings stability through an organisational capacity to absorb mild shocks and stresses.

Adaptive capacity brings flexibility through an organisational capacity to adapt incrementally to uncertain moderate to severe impacts.

Transformative capacity brings transformation through an organisational capacity to transform systems in response to severe impacts.

Absorptive Capacity

Absorptive capacity is an organisation’s ability to bounce back after a shock, including from severe weather events, natural disasters, conflict, cyberattacks and other forced shutdowns. Absorptive capacity is improved through preventing or limiting the negative impact of shock on the business.

Absorptive capacity indicators for severe weather and natural disasters, for example, include:

  • early warning systems about storm surges, tsunamis, cyclones and droughts, enabling appropriate action to be taken to reduce their impact
  • structures and systems that protect physical assets, ie roads, buildings, water supplies and fire systems
  • insurance
  • disaster reduction policies
  • well-resourced contingency plans, personnel who are informed, enabled and empowered to act according to plans and established lines of communication with authorities
  • drills, preferably multi-party
  • a wellbeing programme that helps individuals build personal resilience
Adaptive Capacity

Adaptive capacity is the ability to learn, innovate and make continuous adjustments to provide future flexibility to respond to unpredictable change. A key aspect of adaptive capacity is acceptance that change is happening. Businesses everywhere are urged to improve, in particular, their adaptive capacity to respond to climate and nature change. The Taskforce on Climate-related Financial Risk Disclosure (TCFD) and the nascent Taskforce on Nature-related Financial Risk Disclosure (TNFD) are two global initiatives to help businesses assess, manage and disclose their exposure and vulnerability to environmental change-related business risks and to build adequate adaptation plans.

Adaptive capacity indicators include:

  • sustainable use of resources
  • inclusive access to resources
  • collaborative platforms in place, enabling forward looking ideas and experiments
  • diverse participation and knowledge informing decision making at all levels
  • incremental technological and social innovations being adopted
  • policy frameworks in place that encourage adaptation

Clearly, governance is a crucial enabler (or constraint) on adaptive capacity. Building it up may require a shift in the prevailing beliefs of a business’s key decision makers. They may dig in on long-held views even as they find their experience of how business works best being confronted by external change. An approach that has found some success with decision-making teams is a focus on the factors that influence decision making. A practical framework is Values-Rules-Knowledge (VRK), which emphasises keeping options open to solutions that aren’t ‘normal’, recognises the social and political constraints on new options and reveals the change needed in the decision making team in order to bring about change, including around mission, group rules and shared understandings (Colloff et al, 2018).

Transformative Capacity

Transformation is deep, structural non linear change. Transformative capacity is the ability of an organisation to make deliberate changes to itself and society that will stop or reduce risk, or ensure an equitable sharing of risk. It is the ability to create a fundamentally new system (World Bank, 2017 (pdf)). Transformative impact is impact that is durable and can be scaled up (Dias, 2019).

During transformation, a social system is expected to experience changes in its rules, practices, norms, values and beliefs and disruptions in its power, authority and resources. Organisations attempting this require a strong understanding of the issues, a developed sense of agency and conscious engagement in long-term change processes.

Transformative capacity is indicated by (Glaas et al, 2019):

  • fostering new forms of governance and leadership
  • engaging and empowering stakeholders
  • creating shared visions
  • developing a system overview
  • facilitating experimentation and innovation
  • spurring reflexivity and monitoring progress
  • scaling-up and embedding implementation