Risk Management in Strategic Planning (MNG3701): UNISA Exam Notes and Study Guide

Risk management is one of the most important ideas in strategic planning because strategy is never created in a stable, perfectly predictable environment. In the UNISA MNG3701 context, the topic is especially relevant because strategic decisions must be assessed not only for opportunity but also for uncertainty, loss exposure, compliance, and long-term resilience. A strong exam answer shows how risk management supports strategic intent, protects value, improves decision quality, and aligns with governance expectations in South African organisations.

1. Strategic Planning and Risk Management: Core Concepts and UNISA MNG3701 Relevance

Strategic planning is the process through which an organisation defines where it wants to go, how it intends to compete, and what capabilities it must build to remain viable over time. Risk management, by contrast, is the disciplined process of identifying, analysing, evaluating, treating, monitoring, and communicating risks that could affect those strategic aims. In MNG3701, these two areas should not be treated as separate technical functions. They are deeply connected because every meaningful strategic choice involves uncertainty, and every uncertainty creates the possibility of both threat and opportunity.

A common exam mistake is to treat risk management as something that happens only after a strategy has already been chosen. In practice, risk thinking should begin at the earliest stage of environmental scanning and continue through strategy formulation, implementation, review, and revision. When an organisation explores market expansion, digital transformation, mergers, outsourcing, or new product launches, risk management helps answer critical questions: What could go wrong? What could go right? Which risks are acceptable? Which risks are too severe? Which risk responses are affordable and realistic? These questions improve strategic judgement and help leaders avoid overconfidence.

1.1 What is strategic planning?

Strategic planning is a formal and systematic approach to deciding on an organisation’s future direction. It usually includes the following activities:

Analysing the internal and external environment.
Identifying strengths, weaknesses, opportunities, and threats.
Setting long-term objectives.
Selecting strategies to achieve those objectives.
Allocating resources.
Monitoring performance and adapting when circumstances change.

A strategy is more than a plan. It is a pattern of choices that shapes how the organisation competes, grows, differentiates itself, and uses resources. Strategic planning therefore involves trade-offs. An organisation cannot pursue every opportunity simultaneously. It must decide what to prioritise and what to reject. Risk management adds discipline to these trade-offs by making the consequences of different choices more visible.

1.2 What is risk management?

Risk management is the coordinated process of identifying, assessing, treating, and monitoring risk. Risk is generally understood as the effect of uncertainty on objectives. This definition is important because it includes both negative and positive effects. Many students assume risk means only danger, but strategic management recognises that uncertainty can also produce upside opportunities. For example, a new technology may threaten an existing business model, but it may also create a chance to enter a more profitable market.

A practical risk management cycle includes:

Risk identification: recognising events or conditions that could affect objectives.
Risk analysis: understanding the likelihood and impact of those events.
Risk evaluation: deciding which risks require action.
Risk treatment: selecting responses such as avoiding, reducing, transferring, accepting, or exploiting risk.
Monitoring and review: checking whether risks have changed.
Communication and consultation: ensuring that stakeholders understand the risks and the decisions being made.

This cycle should be continuous, not a once-off exercise.

1.3 Why risk management matters in strategic planning

Strategic planning without risk management is incomplete because strategies are executed under uncertainty. A well-designed strategy may fail if the organisation ignores political instability, supply chain disruption, cyber threats, regulatory change, or financial volatility. Risk management improves strategic planning in several ways:

It increases awareness of external and internal threats.
It improves the realism of objectives.
It supports better allocation of scarce resources.
It strengthens governance and accountability.
It helps leaders prioritise resilience, not only growth.
It protects the organisation’s reputation and long-term sustainability.

Risk management is also closely linked to performance. A strategy that delivers high returns but exposes the organisation to uncontrolled risks may not be sustainable. In contrast, a strategy that appears conservative but deliberately manages uncertainty may create more stable value over time.

1.4 The South African strategic context

For South African organisations, strategic planning and risk management are shaped by a distinctive environment. Firms and public institutions must consider factors such as:

electricity supply instability,
labour relations,
inflation and interest-rate changes,
exchange-rate volatility,
digital inequality,
corruption and governance concerns,
regulatory requirements,
infrastructure limitations,
socio-economic inequality,
transformation and inclusion pressures.

These realities make risk management essential in strategic planning. For example, a logistics company in Gauteng may want to expand operations nationally, but it must assess fuel price volatility, route disruptions, theft risk, and power-related disruptions at warehouses. A university may plan to increase online learning services, but it must evaluate cyber risk, data privacy risk, connectivity barriers, and staff capability constraints.

1.5 Key strategic management linkages

Risk management connects to major strategic planning questions:

Vision and mission: What future is the organisation trying to create, and what risks threaten that future?
Environmental scanning: What uncertainties arise from the macro-environment, industry, and competitive environment?
Strategy formulation: Which strategic options create the best balance of reward and risk?
Implementation: What operational controls are needed to execute the chosen strategy safely?
Evaluation: Are risk indicators showing that the strategy remains viable?

An organisation that integrates these questions is more likely to survive shocks and exploit opportunities.

2. The Risk Management Process in Strategic Planning

A strong MNG3701 answer must explain risk management as a process, not just a list of concepts. The process usually begins with identifying uncertainties, then analysing their significance, deciding how to respond, and finally monitoring outcomes. In strategy, this process must be aligned with organisational goals. Risks that matter most are those that could affect strategic objectives, not only those that are easiest to measure.

2.1 Risk identification

Risk identification is the process of finding and describing events, conditions, or circumstances that could influence objectives. Strategic risks may arise from both the external environment and the organisation itself.

Common sources of strategic risk include:

market demand shifts,
competitor actions,
technological change,
legal and regulatory developments,
political uncertainty,
supplier failure,
human resource shortages,
fraud and unethical conduct,
environmental shocks,
reputational damage,
project failure,
weak leadership or poor coordination.

Useful techniques for risk identification include brainstorming, interviews, workshops, document review, scenario analysis, SWOT analysis, PESTLE analysis, process mapping, and lessons learned from previous failures. In strategic planning, environmental scanning is particularly important because it broadens attention beyond routine operational problems.

A useful exam phrase is that risk identification should be systematic, comprehensive, and context-specific. It should not be based on intuition alone.

2.2 Risk analysis

After identifying a risk, the next step is to analyse it. Risk analysis asks two main questions:

How likely is the risk to occur?
What would be the impact if it occurred?

These dimensions may be qualitative or quantitative. A simple risk matrix can classify risks as low, medium, or high based on probability and impact. More advanced analysis may use expected monetary value, sensitivity analysis, scenario modelling, or decision trees.

In strategic planning, the impact of a risk must be assessed in relation to strategic objectives. A risk that seems small at an operational level may be severe strategically. For example, a one-week delay in a product launch might seem minor, but if it causes the organisation to miss a key seasonal sales window, the strategic impact may be significant.

2.3 Risk evaluation

Risk evaluation compares analysed risks against risk criteria to decide what action is needed. Not every risk needs the same response. Some risks may be accepted because the cost of treatment is too high or the risk is within tolerance. Other risks may require immediate action because they threaten core objectives or legal compliance.

Risk evaluation often considers:

risk appetite,
risk tolerance,
strategic importance,
cost-benefit implications,
stakeholder expectations,
legal and ethical requirements.

A risk appetite is the amount and type of risk an organisation is willing to pursue or retain in pursuit of value. Risk tolerance is the acceptable variation around objectives. Risk appetite is more strategic; tolerance is more operational. For example, an organisation may have a moderate appetite for market expansion risk but a very low tolerance for compliance breaches.

2.4 Risk treatment options

Risk treatment means deciding how to address a risk. The main responses are:

Avoidance: stopping the activity that creates the risk.
Reduction/mitigation: lowering likelihood or impact through controls.
Transfer/share: shifting part of the risk to another party, such as through insurance or outsourcing.
Acceptance/retention: consciously retaining the risk when it falls within appetite.
Exploitation/enhancement: for positive risks, taking action to increase the probability or benefit of an opportunity.

Strategic planning often requires a combination of these responses. For example, a bank launching a digital app may mitigate cyber risk through encryption and multi-factor authentication, transfer some financial losses through insurance, and accept residual risk after controls are in place.

2.5 Risk monitoring and review

Risk management is never finished. Conditions change, assumptions fail, and new risks emerge. Monitoring and review ensure that risk controls remain effective and that strategic leaders receive timely information. This often involves:

key risk indicators,
periodic reviews,
internal audits,
incident reporting,
dashboard tracking,
board or executive oversight.

Monitoring is essential because risks evolve. A low-probability risk may become more likely if the environment changes. For example, a supplier risk may seem manageable until geopolitical events disrupt import routes or increase costs.

2.6 Communication and consultation

Risk management must involve communication with stakeholders. Strategic decisions often affect shareholders, employees, customers, regulators, communities, and partners. If these stakeholders do not understand the risks and responses, implementation may fail.

Communication should be clear, timely, and tailored to the audience. Senior leaders need a strategic summary, while operational managers may need detailed control instructions. Poor communication creates confusion, resistance, and weak accountability.

2.7 The role of documentation

Documenting risk processes is vital. A risk register, for example, typically records:

the risk description,
the cause,
the event,
the possible consequence,
the likelihood rating,
the impact rating,
the overall risk score,
the risk owner,
existing controls,
planned treatments,
review dates.

Documentation supports continuity, accountability, and auditability. In exam answers, risk registers are often mentioned as practical tools that convert abstract risk thinking into manageable action.

3. Tools, Frameworks, and Analytical Techniques for Exam Success

To answer MNG3701 questions well, it is not enough to define risk and strategy. Students must show that they understand the tools used to integrate the two. Frameworks such as SWOT, PESTLE, scenario planning, and risk matrices help strategic managers identify uncertainty and make informed choices. Governance frameworks also matter because they provide structure and accountability around risk.

3.1 SWOT analysis and risk

SWOT analysis is one of the most accessible tools in strategic planning. It assesses:

Strengths
Weaknesses
Opportunities
Threats

Risk is closely linked to the threats and weaknesses sides of SWOT, but it also interacts with opportunities. A strength can reduce risk, while a weakness can increase exposure. For example, a company with a strong IT team may better manage cyber risk. A company with weak cash flow may be more exposed to interest-rate risk.

A useful strategic approach is to convert SWOT into action:

Strengths can be used to exploit opportunities.
Weaknesses should be reduced to limit vulnerability.
Opportunities should be assessed for associated risks.
Threats should be prioritised according to likelihood and impact.

3.2 PESTLE analysis

PESTLE helps identify macro-environmental uncertainties:

Political
Economic
Social
Technological
Legal
Environmental

This tool is especially important in South Africa because strategic risk often emerges from macro-level instability. For example:

Political uncertainty may affect investor confidence.
Economic conditions may influence consumer spending and borrowing.
Social issues may affect labour stability and demand patterns.
Technological disruption may reshape competitive advantage.
Legal change may alter compliance requirements.
Environmental pressures may affect resource availability and sustainability costs.

PESTLE is valuable because it broadens risk thinking beyond the organisation’s immediate control. It helps managers identify systemic risks early.

3.3 Scenario planning

Scenario planning is one of the most powerful tools in strategic risk management. It involves imagining different plausible futures and assessing how the organisation would perform in each one. Unlike forecasting, scenario planning does not assume one probable future. It prepares leaders for multiple possibilities.

Typical scenarios may include:

a high-growth, stable economy,
a recessionary environment,
a disruptive technology shock,
a severe regulatory tightening,
a supply chain crisis,
a climate-related disruption.

Scenario planning is especially useful for long-term strategy because it reveals vulnerabilities and opportunities that static analysis may miss. It encourages flexibility and resilience.

3.4 Risk matrices

A risk matrix plots likelihood against impact. Risks with high likelihood and high impact are treated as priority risks. This visual tool is useful for communicating with managers and boards. However, it has limitations. Risk matrices can oversimplify complex interdependent risks and may create false certainty if scoring is not carefully justified.

Even so, for exam purposes, risk matrices remain important because they show how organisations prioritise. A common five-by-five matrix may categorise risks as:

very low,
low,
moderate,
high,
extreme.

The matrix supports ranking and treatment planning.

3.5 Decision trees and expected value

Decision trees are useful where strategic options involve uncertainty and different possible outcomes. They help compare the expected consequences of alternative choices. Expected monetary value is often calculated by multiplying each outcome by its probability and summing the results.

For example, suppose a firm has two strategic options:

Option A: expand into a new market with a 60% chance of earning R10 million and a 40% chance of earning R2 million.
Option B: remain in the current market with a certain return of R5 million.

The expected value of Option A is:

(0.6 × R10 million) + (0.4 × R2 million)
= R6 million + R0.8 million
= R6.8 million

Option A appears more attractive financially, but a complete strategic assessment would also consider strategic fit, risk tolerance, capital needs, and downside exposure. This example shows how quantitative risk analysis supports better planning.

3.6 Contingency planning

Contingency planning prepares the organisation for disruptions that may occur even when prevention efforts are in place. It answers the question: What will we do if the risk materialises?

A good contingency plan includes:

trigger points,
response actions,
responsible persons,
communication protocols,
resource requirements,
recovery priorities.

Contingency planning is essential in strategic implementation. It protects continuity and reduces the cost of surprises.

3.7 Governance and assurance frameworks

Governance frameworks provide oversight and discipline for risk management. In many organisations, the board, audit committee, executive management, and internal audit function each play a role. Governance frameworks ensure that risk is not treated as an isolated compliance exercise but as part of strategic leadership.

Important governance principles include:

accountability,
transparency,
fairness,
responsibility,
ethical conduct,
stakeholder orientation.

In the South African context, governance expectations are strongly influenced by the King codes of corporate governance, which emphasise integrated thinking, ethics, risk, and performance. While students do not need to reproduce every detail of those frameworks, they should understand that sound governance gives strategic risk management structure and credibility.

4. Strategic Risk Categories and Realistic Organisational Applications

A full study guide must move beyond abstract definitions and show how risk appears in real organisational settings. Strategic risks differ from operational risks because they affect the long-term direction, competitive position, or survival of the organisation. In MNG3701, it is useful to classify risks by type and then connect them to examples.

4.1 Categories of strategic risk

The most important strategic risk categories include:

Financial risk: interest-rate changes, currency fluctuations, liquidity problems, cost overruns.
Operational risk: process failures, supply disruptions, equipment breakdowns, human error.
Market risk: changes in demand, competition, customer preferences, pricing pressure.
Compliance and legal risk: regulatory breaches, fines, litigation, policy changes.
Reputational risk: negative publicity, ethical failures, customer distrust.
Technological risk: cyberattacks, system failures, obsolescence, implementation failure.
Political and country risk: instability, policy uncertainty, corruption, institutional weakness.
Environmental and climate risk: floods, droughts, extreme weather, sustainability pressures.
Strategic change risk: acquisition failure, diversification failure, poor execution of major change.

These categories often overlap. For example, a cyberattack may create operational disruption, reputational damage, legal exposure, and financial loss at the same time.

4.2 Example: retail expansion strategy

Consider a fictional South African retail chain, Mbeki Home & Value, headquartered in Johannesburg, planning to open 12 new stores across Gauteng and KwaZulu-Natal over 18 months. The strategic objective is to increase annual revenue from R240 million to R312 million, a 30% increase.

That expansion carries several risks:

site selection risk if new stores are opened in weak locations,
supply chain risk if distribution capacity is insufficient,
cash flow risk because opening costs occur before revenue stabilises,
labour risk if recruitment and training are delayed,
security risk due to theft and stock losses,
demand risk if consumer spending weakens.

Risk management would require pre-opening assessments, phased rollout, security controls, supplier agreements, and financial contingency reserves. Without these measures, the expansion could consume capital faster than expected and damage overall performance.

4.3 Example: digital transformation strategy

Imagine a university service provider in Cape Town, Cape Gateway Learning Services, investing R18 million in a new online learning platform. The strategy is intended to improve scalability, learner access, and service quality. However, the project introduces risks such as:

software implementation delay,
data privacy breaches,
weak user adoption,
integration failure with existing systems,
vendor dependency,
staff resistance,
poor connectivity for users in remote areas.

The strategic question is not whether digital transformation is good or bad. It is whether the organisation understands the uncertainty and can manage it. Risk mitigation might include phased deployment, penetration testing, training, backup systems, service-level agreements, and user support structures.

4.4 Example: manufacturing and supply chain resilience

A manufacturing firm in Durban may depend on imported components. If the exchange rate weakens from R18.20 to the US dollar to R20.00, input costs rise. If the firm imports USD 2 million worth of inputs annually, the rand cost increases from R36.4 million to R40 million, an increase of R3.6 million. That financial risk may materially affect pricing, profitability, and competitiveness.

A strategic response may include:

negotiating local sourcing alternatives,
building inventory buffers,
using currency hedging,
redesigning products to reduce imported input dependence,
diversifying suppliers.

This example illustrates how financial risk and strategy are closely integrated.

4.5 Example: public sector strategic planning

A municipal utility that plans to improve water delivery must manage infrastructure risk, procurement risk, political risk, and reputational risk. Delays, corruption, poor contractor performance, and maintenance backlogs can all undermine strategic goals. Public organisations often face higher scrutiny because failures affect communities directly.

Strategic risk management in the public sector therefore emphasizes:

transparency,
procurement controls,
stakeholder consultation,
compliance with budgetary rules,
measurable service-delivery indicators,
anti-corruption measures.

4.6 Human resource and leadership risk

Risk is not only external. Strategic plans fail when leadership is weak, culture is toxic, or talent is missing. Human resource-related strategic risks include:

skills shortages,
loss of key managers,
poor succession planning,
low morale,
resistance to change,
labour disputes,
unethical leadership.

An organisation may invest heavily in a new strategy, but if employees do not understand it or support it, implementation will falter. This is why change management and strategic communication are part of risk management.

4.7 Reputational risk as a strategic issue

Reputation is an asset built over time and lost quickly. A single scandal, service failure, or misleading communication can damage trust. Reputational risk is strategic because it affects customer loyalty, investor confidence, regulatory attention, and employee pride.

To manage reputational risk, organisations must:

enforce ethical standards,
monitor public perception,
respond quickly to incidents,
maintain consistent communication,
align behaviour with stated values.

The strategic lesson is that reputation is not an afterthought. It is a core business asset that must be protected through disciplined decision-making.

5. Exam-Focused Integration: How to Write Strong MNG3701 Answers

Students often know individual concepts but lose marks because they cannot integrate them into coherent strategic arguments. Good exam answers demonstrate understanding, application, analysis, and evaluation. The safest approach is to connect risk management to strategic objectives, use relevant frameworks, and show clear consequences.

5.1 How to structure an exam answer

A strong essay or case-study answer usually follows this logic:

Define the concept clearly.
Explain its relevance to strategic planning.
Apply a framework such as SWOT, PESTLE, or a risk matrix.
Analyse implications for the organisation.
Recommend actions and justify them.
Conclude by linking risk management back to long-term sustainability.

This structure ensures that answers remain focused and analytical rather than descriptive.

5.2 Common exam command words

Understanding command words is essential:

Define: provide a concise meaning.
Describe: give the main features.
Explain: show how and why something works.
Analyse: break down the issue and show relationships.
Evaluate: assess strengths, weaknesses, and effectiveness.
Discuss: provide a balanced treatment with arguments for and against.
Recommend: propose actions and justify them.

Many students write definitions when the question asks for analysis. To score well, answer the command word directly.

5.3 What examiners typically want to see

Examiners generally reward:

correct use of strategic management terminology,
clear distinction between risk and uncertainty,
evidence of integration between strategy and risk,
application to the case or scenario,
practical and realistic recommendations,
structured, coherent writing.

They tend to penalise:

vague statements,
repetition,
unsupported claims,
generic risk lists without explanation,
ignoring the strategic context,
failing to link risks to objectives.

5.4 A high-quality integrated answer pattern

A well-developed paragraph should do more than mention a concept. It should connect concept, impact, and response. For example:

If a firm expands aggressively into a new province without analysing competitor intensity, logistics costs, and customer demand, strategic risk increases because the organisation may commit capital before proving market viability. A better approach is to phase the expansion, test demand in selected locations, and use performance triggers before full rollout.

This type of writing shows analysis, not memorisation.

5.5 Suggested case analysis method

When presented with a case study, use the following method:

Identify the organisation’s strategic objective.
Identify the main risks affecting that objective.
Classify risks by type and priority.
Analyse causes and likely consequences.
Recommend treatments for the most important risks.
Explain how monitoring will confirm whether the treatments work.

This method keeps the answer focused on strategic value rather than isolated technical details.

5.6 Table: linking strategy, risk, and response

Strategic issue	Risk type	Likely impact	Suitable response
Entering a new market	Market and financial risk	Low demand, cash losses	Pilot rollout, market research, phased investment
Digital transformation	Technological and operational risk	System failure, user resistance	Training, vendor controls, backup systems
Outsourcing logistics	Operational and reputational risk	Service failure, customer dissatisfaction	Service-level agreements, performance monitoring
Merging with another firm	Strategic and cultural risk	Integration failure, talent loss	Due diligence, integration plan, change management
Expanding exports	Currency and regulatory risk	Margin pressure, compliance problems	Hedging, legal review, diversified markets

This table can help organise revision because it shows the connection between strategic choices and specific risk responses.

5.7 Practical memory aids for revision

A useful way to remember the risk cycle is:

Identify
Analyse
Evaluate
Treat
Monitor
Communicate

Another useful principle is that risk management should be:

proactive rather than reactive,
systematic rather than ad hoc,
strategic rather than purely operational,
continuous rather than once-off,
aligned rather than isolated.

5.8 Final synthesis for exam success

The strongest conceptual point in MNG3701 is that strategic planning and risk management are mutually reinforcing. Strategy gives direction, while risk management gives realism and resilience. A strategy without risk management may be ambitious but fragile. Risk management without strategy may be cautious but directionless. Organisations perform best when they combine clear strategic intent with disciplined risk awareness, sensible controls, and adaptive leadership.

A student who can explain this relationship clearly, support it with examples, and apply it to a case study will usually produce a strong answer in the UNISA examination context.

6. Consolidated Revision Notes, Key Terms, and High-Value Summary Points

6.1 Key terms to know

Strategic planning: long-term decision-making about organisational direction and resource allocation.
Risk: the effect of uncertainty on objectives.
Strategic risk: uncertainty that affects the organisation’s long-term direction, survival, or competitive position.
Risk appetite: the level and type of risk the organisation is willing to pursue.
Risk tolerance: acceptable variation around performance targets.
Risk matrix: a tool for ranking risks by likelihood and impact.
Risk register: a record of identified risks, controls, owners, and actions.
Scenario planning: analysis of multiple possible future conditions.
Mitigation: reducing the likelihood or impact of risk.
Contingency planning: preparing for what to do if a risk occurs.

6.2 High-value revision bullets

Risk management is not separate from strategy; it is part of strategic thinking.
Strategic decisions always involve uncertainty and trade-offs.
Good risk management improves planning quality and organisational resilience.
South African organisations face both internal and external strategic risks.
Tools such as SWOT, PESTLE, risk matrices, and scenarios are highly relevant.
Risk treatment options include avoidance, reduction, transfer, acceptance, and exploitation.
Monitoring and communication are essential for long-term effectiveness.
Reputational, technological, and compliance risks often have strategic consequences.
Leadership, culture, and change management are central to successful risk responses.
In exams, always connect risks back to objectives, impacts, and responses.

6.3 Common mistakes to avoid

Defining risk only as a negative event and ignoring upside risk.
Listing risk types without explaining how they affect strategy.
Writing about operational controls without linking them to strategic goals.
Ignoring the external environment.
Forgetting monitoring and review.
Offering recommendations that are too vague to implement.
Confusing risk appetite with risk tolerance.
Treating risk management as a one-time exercise rather than a continuous process.

6.4 One-paragraph summary of the entire theme

Risk management in strategic planning is the process through which organisations anticipate uncertainty, assess its consequences, and make better long-term decisions. In the MNG3701 framework, it is essential for aligning strategic ambition with realistic execution, especially in complex environments such as South Africa, where economic volatility, infrastructure constraints, regulatory demands, and governance challenges shape organisational choices. Strong strategic leaders do not eliminate all risk; instead, they understand which risks are acceptable, which require control, which can be turned into opportunity, and which threaten the organisation’s future.