Fortress risk

Avid readers of our blog will be familiar with our concept of Fortress Strategy: the idea that clients have mentally erected thick walls around the major strategy firms that prevent other firms entering their space, but which equally trap strategy firms in a business model that doesn’t necessarily suit current market conditions.

In a similar vein, we’d now like to introduce the concept of Fortress Risk. This is a different kind of edifice; fewer Disney-esque turrets, for starters. Inside the walls are the Big Four firms, kept there by clients who’ve historically thought knowledge of regulation and a relationship with the regulator are the defining characteristics of a top-flight risk firm. As with the strategy firms, what keeps the firms inside the castle safe (those big walls) also prevents them from entering new markets; what drives their success in one area constrains their growth in others. Client perceptions, together with price point, make it hard for strategy firms to win work in more operational areas. In the risk market, the walls of perception keep out other players who don’t have such strong relationships with the regulators but they may also—we’d argue—hamper the way in which the Big Four adapt to a changing market.

And, boy, is it changing. In a relatively short space of time risk has gone from being a minority interest—administered by managers with boxes to check and protocols to follow—to a strategic issue, worthy of discussion in the uppermost organisational echelons. Risk isn’t just about regulation, but reputation. It’s what’s at stake when you find you’re employing child labourers in rickety factories; or forcing your suppliers to cut critical corners in order to save on cost; or not protecting your systems from incursions. Risk is no longer the preserve of a specialist business unit, but the responsibility of all—but it’s also what can hobble your stride when you’re trying to expand.

The Big Four have plenty to say about this new world of risk, but we’re not sure how well clients are hearing it. Instead our data suggests that they’re losing out to technology firms (where cybersecurity is concerned) and strategy firms (for reputational risk). They’re still winning the regulatory-related risk war, but that’s because the only people that are fighting for it are themselves. The other wars—the ones about technology and reputation—are being fought outside the castle walls. If we look at our client perceptions data, strategy firms and technology firms are preferred to the Big Four.

Fortress Risk isn’t being besieged; it’s increasingly being ignored.