Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 Incorporating Enterprise Risk Management in the Business Model Innovation Process Yariv Taran 1, Harry Boer2 & Peter Lindgren3 Abstract Purpose: Relative to other types of innovations, little is known about business model innovation, let alone the process of managing the risks involved in that pro- cess. Using the emerging (enterprise) risk management literature, an approach is proposed through which risk management can be embedded in the business model innovation process. Design: The integrated business model innovation risk management model devel- oped in this paper has been tested through an action research study in a Danish company. Findings: The study supports our proposition that the implementation of risk man- agement throughout the innovation process reduces the risks related to the uncer- tainty and complexity of developing and implementing a new business model. Originality: The study supports the proposition that the implementation of risk management throughout the innovation process reduces the risks related to the uncertainty and complexity of developing and implementing a new business mod- el. The business model risk management model makes managers much more fo- cused on identifying problematic issues and putting explicit plans and timetables into place for resolving/reducing risks, and assists companies in aligning the risk treatment choices made during the innovation process with the company’s corpo- rate strategy and risk appetite. Keywords: Business Model Innovation, Risk Management, Action Research 1: Aalborg University, Center for Industrial Production, Fibigerstræde 10, 9220 Aalborg, Denmark, E-mail: yariv@business.aau.dk 2: Aalborg University, Center for Industrial Production, Fibigerstræde 10, 9220 Aalborg, Denmark 3: Aarhus University, Business and Social Sciences, Birk Centerpark 15, 7400 Herning, Denmark Please cite this paper as: Taran, Y., Boer, H., Lindberg, P. 2014. “Incorporating Enterprise Risk Management in the Business Model Innovation Process”, Journal of Business Models, Vol. 1, No. 1, pp. 38-60. 38 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 Introduction The demise of Lehman Brothers triggered a global chain reaction, the financial crisis of 2008 to 2011 – world stock markets collapsed, large financial institutions and industrial companies went bankrupt, were bought out, or are still (at the time of writing this paper) strug- gling to recover (e.g. GM, Chrysler, AIG). Worldwide, millions of employees lost their jobs, and governments have had to come up with rescue packages to save their own financial systems. As if it was not hard enough to adapt to the effects of hypercompetition (e.g. D’Aveni, 1994), many companies experienced the financial crisis as “the final straw that broke the camel’s back”. In a business summit that took place at Harvard Univer- sity in the early phases of the financial crisis (October 14, 2008), Professor Robert S. Kaplan linked the finan- cial crisis with firms’ behavior, and argued that “apart from the macro issues [such as] interest rates and regu- latory problems, virtually all the failures at those firms were because of the failure of their risk management function”. That is, CEOs were fired and companies col- lapsed because they took higher risks than they could afford, and were not prepared for, or failed to identify and respond adequately to, the magnitude of the crisis. Business today is more difficult to manage than ever – economic trends and market changes are hardly pre- dictable, and globalization has created ever more com- plex business environments. Innovation is a key ingre- dient in the way companies (have to) react to external changes. While most innovation efforts have tradition- ally been focused on developing new products and, al- beit to a lesser extent, process technologies, compa- nies are increasingly considering their entire business model as an object for innovation. The IBM global CEO study 2006 held among 765 top CEOs indicated that competitive pressures had pushed business model in- novation much higher than expected on industrial pri- ority lists. According to that study, approx. 30 percent of CEOs were pursuing business model innovation ini- tiatives and quite rightly so. There is little theoretical understanding of how to man- age that process adequately. The aim of this paper is to contribute to developing that understanding, with a specific focus on the role of risk and risk management. While product and process innovations are not without risk (e.g. Keizer and Halman, 2007), business model in- novation is potentially much riskier. Accordingly, our research question is: To what extent and, especially, how can risk management help a company handling various risks effectively throughout its business model innovation process? Risk and Risk Management In simple terms, the term risk refers to “uncertainty of outcome” (Chapman and Ward, 2004). Risk manage- ment has been defined as “the systematic application of management policies, procedures and practices to the tasks of communicating, consulting, establishing the context, identifying, analyzing, evaluating, treating, monitoring and reviewing risk” (ISO/IEC Guide 73, 2002). The evolution of risk management has come a long way in the past two decades. However, although com- panies have successfully adopted risk management in their internal audit, treasury, insurance, environmental health and safety, and legal functions, it has not yet been fully incorporated into core business processes re- lated to future growth, such as strategic planning, cap- ital allocation, and performance management (Deloitte & Touche, 2008). This seems to imply that unrewarded risks, in the sense that no premium is obtained from managing them – only the potential for loss is reduced, are the main driver in today’s risk management practic- es, while managing rewarded risks, which are part and parcel of decision-making processes associated with future growth, is not yet fully embedded in organiza- tional change and innovation processes. Furthermore, even if companies attempt to manage rewarded risks systematically, for example in project management (e.g. Kendrick, 2003; Chapman and Ward, 2004) or product innovation management (e.g. Keizer et al., 2002; Keizer and Halman, 2007), they essentially assume that those risks can be managed in isolation from the entire system. Recent surveys and studies (e.g. Taplin, 2005; Deloitte & Touche, 2008; O’Connor et al. 2008; Kalvet and Lember, 2010; Guo, 2012, 2013), however, have shown that a growing percentage of 39 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 managers worldwide are interested in applying risk management in a much more comprehensive (i.e. pro- active and holistic) manner. A study by Accenture (2009) suggests that there are, roughly speaking, three risk management models that a company can adopt, namely: 1. Risk management for compliance, which involves a regulatory set of requirements focused on keeping the company complying with regulations. 2. Risk management for value protection, which is aimed at managing expected risks as well as reduc- ing the degree of unforeseen risks.. 3. Risk management for value enhancement, which is aimed at covering all dimensions of the business as well as increasing the protection against unforeseen risks According to Accenture (2009), “In choosing where to stand on the risk management spectrum, a company is deciding what kind of risk management culture it wants to embrace. Does it want to simply comply with regulations? Or does it want to be visionary and adjust risk manage- ment for the evolved company it will become as the busi- ness grows?”. This suggests that dynamic, i.e. innova- tive, companies will, or perhaps even should, adopt a risk management model that is more focused on value en- hancement and helps them proactively to manage risks, pitfalls and surprises along the way (e.g. COSO, 2004). Enterprise risk management Enterprise Risk Management (ERM) attempts to cap- ture and reduce the effects of today’s business com- plexity and uncertainty by providing a broad framework for managing risks (e.g. Moeller, 2007; Monahan, 2008; Olson and Wu, 2010; Wu and Olsen, 2010; Hoyt and Liebenberg, 2011; Kraus and Lehner, 2012). According to the Committee of Sponsoring Organizations (COSO), ERM deals with risks and opportunities affecting value creation, and helps an entity to get where it wants to go and avoid pitfalls and surprises along the way. Thus, they define ERM as “a process, effected by an entity’s board of directors, management and other personnel … designed to identify potential events that may af- fect the entity, and manage risks to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives” (COSO, 2004). Table 1 gives an example of an ERM framework (CAS, 2003). Table 1: Enterprise Risk Management framework (adapted from CAS, 2003) Process step Types of risks Strategic Operational & Cultural Financial Hazard Establish Context Identify Risks Analyze / Quantify Integrate Risks Assess / Prioritize Risks Treat / Exploit Risks Monitor and Review 40 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 ERM benefits – Applying ERM helps companies (e.g. COSO, 2004; Graham, 2004; Ernst & Young, 2006; The National Affordable Homes Agency, 2008, Deloitte & Touche, 2008; Olson and Wu, 2010; Wu and Olsen, 2010; Hoyt and Liebenberg, 2011; Kraus and Lehner, 2012): • Improve their contingency planning by taking a proactive approach, so that managers can avoid surprises, and anticipate and influence events be- fore they are happening. • Make better decisions by aligning a company’s risk appetite with its strategy. • Enhance risk response decisions through risk avoid- ance, reduction, sharing, and acceptance. • Identify and manage multiple cross-enterprise risks, segmented mostly to four core risk groups: strategic, operational & cultural, financial and haz- ard risks (CAS, 2003). • Seize new opportunities based on identified risks. • Achieve efficiencies – a structured and comprehen- sive risk management process built into existing activities generates better managerial processes; e.g. facilitating resource allocation, improving de- ployment of capital, avoiding unnecessary prob- lems, or setting demanding performance targets. • Improve their corporate governance – an efficient ERM process can assist with defining reporting and communication protocols, setting appropriate cor- porate ethics as well as securing compliance with regulatory requirements. • Strengthen accountability by demonstrating that levels of risk associated with policies, plans, pro- grams and operations are explicitly understood, and that stakeholder interests are optimally bal- anced. ERM challenges – Despite the potential benefits sug- gested above, it has also been implicitly argued (e.g. Ernst & Young, 2006; Deloitte & Touche, 2008; Kraus and Lehner, 2012) that the understanding of how to in- corporate ERM into future-oriented business process- es is currently lacking. Companies that do apply ERM embed it within their system, but tend to focus on risks related to existing assets. In so doing, they miss the connection to business processes aimed at future growth (e.g. Deloitte & Touche, 2008), including busi- ness model innovation processes. Demonstrating the benefits of the value of taking risk (and preventing their consequences) is one of the great challenges related to the adoption of ERM and using it in future-oriented activities. According to the Deloitte & Touche ERM survey (2008, p. 2), “management is de- manding proof of the value proposition of ERM, just as they did when quality initiatives were first being intro- duced. Unfortunately, such proof is usually most evident after a catastrophe”. The aim of the study presented here is to demonstrate the usability and usefulness of risk management in one such future-oriented and, as the next subsection will show, potentially quite risky activity, namely business model innovation. Uncertainty and complexity management Risk is a function of the uncertainty and complexity re- lated to innovation. Boer (1991) addressed uncertainty and complexity as follows. Uncertainty – Several terms have been used to refer to this aspect of organizational reality. Some authors use the term predictability (e.g. Mintzberg, 1979); others pre- fer to call it uncertainty (e.g. Thompson, 1967; Galbraith, 1973; Mowery and Rosenberg, 1979). Inevitably connected with innovation, uncertainty refers to the extent to which individuals, groups or organizations are informed about the future (Galbraith, 1973). The level of uncertainty may vary along a continuum of certainty, risk, uncertainty and unstructured uncertainty (De Leeuw, 1982), is generally assumed to be highest at the initial stages of the inno- vation process, but should tend to decrease in the course of time. It may concern the objectives to be pursued, the activities to be performed in order to achieve desirable results, the people to perform the activities, the arrange- ments regulating their cooperation, and the influence of the organization’s context (Simon, 1964; Galbraith, 1973; Mintzberg, 1979; Kickert, 1979; De Leeuw, 1982). Typi- cal symptoms of uncertainty are failures being made, setbacks and surprises occurring, unforeseen barriers needing to be leveled, goals and objectives requiring re- 41 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 definition during the process, formerly elaborated ideas and accepted solutions being rejected and exchanged for new ideas leading to alternative solutions, implemented solutions appearing to be less effective than anticipated, and/or schedule and budget overruns (Galbraith, 1973; Sayles, 1974; During, 1984; Schroeder et al., 1986). Complexity – This factor has been referred to using different terms, such as comprehensibility (Mintzberg, 1979) and analyzability (Perrow, 1967). Still following Boer (1991), we use the term complexity to refer to the diffi- culty with which a process can be understood (cf. Mint- zberg, 1979). The extent to which an innovation process is complex or, contrarily, easy to understand, depends on features such as the newness and radicality of the in- novation. Furthermore, not all activities in an innovation process are complex. The greater the gap between the knowledge and skills required from the people involved, and the competences these people actually have, the more the organization has to rely on unanalyzed experi- ence, intuition, chance and guesswork, rather than well- known, standard methods of designing, developing and implementing solutions to the innovation problem (cf. e.g. Perrow, 1967). In other words, competence gaps in- crease uncertainty. Uncertainty, complexity and risk – It is important to note that the success of a business model innovation depends on the company’s ability to recognize that it is about to perform activities that are more uncertain, complex and therefore also riskier than anything it has experienced in the past, and the ability to cope with these process characteristics. Figure 1 illustrates the relationships between uncertainty, complexity and risk and, implicitly, suggests that the higher the level of in- novation uncertainty and complexity, the greater the need for risk management. The question is: how? The next section will investigate that. Figure 1: Complexity-uncertainty based risk scale HIGH RISK UNCERTAIN MEDIUM-HIGH RISK SIMPLE LOW RISK CERTAIN LOW-MEDIUM RISK COMPLEX B C DA 42 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 Managing Risk in Business Model Innovation Business model innovation Many authors have attempted to define the business model concept. Some authors took a narrow, more technological or financial focus (e.g. Stewart and Zhao, 2000; Chesbrough, 2007), others adopted a more gen- eral perspective (e.g. Amit and Zott, 2001; Osterwalder et al., 2004). Some have incorporated corporate strat- egy in their business model definition (e.g. Timmers, 1998; Hamel, 2000), others have left it out (e.g. Selz, 1999; Weill and Vitale, 2001). However, put simply, most (if not all) authors agree that a business model is a model that explains how a company does business. The number of building blocks of business model can- vasses presented in the literature ranges from three to nine (Osterwalder et al., 2004; Morris et al., 2005). There has been quite a debate in the literature on the question when a change can rightfully be called a busi- ness model innovation. Two approaches seem to pre- vail. The first approach defines business model inno- vation as a radical change in the way a company does business (Chesbrough 2007; Linder and Cantrell 2000). The second approach regards any change in any of the building blocks of a business model, or the relation- ships between them, as a form of business model in- novation (Amit and Zott 2001, Osterwalder et al. 2004, Magretta 2002; Taran et al., 2014). We adopt the sec- ond approach. Risk management in business model innovation Risk management in the context of business model innovation is “terra incognita” – unexplored territory (Taran, 2011). We will therefore rely on the (limited) re- search available on risk management in adjacent areas, namely project and product innovation management (e.g. Taplin, 2005; O’Connor et al. 2008; Kalvet and Lember, 2010; Guo, 2012, 2013), in particular the work of Keizer et al. (2002) and Chapman and Ward (2002), to develop a deeper understanding on how and when risk management could be incorporated into a compa- ny’s business model innovation process. Keizer et al. (2002) clarified how Unilever, a world- leading company in fast-moving consumer goods, adopted the Risk Diagnosing Methodology (RDM) in its product innovation management. RDM was initi- ated, developed and successfully tested first in a di- vision of Philips Electronics Company. Its aims were to identify and evaluate technological, organizational and business risks in product innovation. Similar to the Philips results, RDM proved to be a very useful method for Unilever for diagnosing product innovation project risks, promoting creative solutions, strengthening team ownership and building a knowledge base of po- tential risks in product innovation projects. Keizer et al. (2002) argued that, in relation to Unilever’s innovation funnel (Figure 2), the RDM process should be applied at the end of the “feasibility” phase, i.e. at the “contract” gate. Since RDM was focused particu- larly on one of the gates of the company’s innovation funnel, the main issues addressed at that stage were consumer and trade acceptance, commercial viability, competitive reactions, external influential responses, human resource implications, and manufacturability. Chapman and Ward (2004) proposed a framework for incorporating risk management in project manage- ment processes, called SHAMPU (Share, Harness, And Manage Project Uncertainty). In contrast to Keizer et al.’s (2002) study, which argues for applying the risk management process only once, at the end of the fea- sibility phase, Chapman and Ward maintain that the nine phases of the SHAMPU risk management process (define, focus, identify, structure, ownership, estimate, evaluate, harness, manage), should be presented as an ongoing process activity, followed by an iterative loop back to the “estimate” phase or even to the (first) “de- fine” phase, to refine or redefine the basis of analysis of sources of uncertainty revealed to be important. How- ever, similar to Keizer et al. (2002), Chapman and Ward (2004) also argued that the risk management process should start at the early phases of the project and end at the planning phase, before allocating and executing the project. This “planning” phase in the Chapman and Ward model can, to a great extent, be compared to the “feasibility” phase in the Unilever innovation funnel (Figure 2). In translating the suggestions put forward by Keizer et 43 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 al. (2002) and Chapman and Ward (2004) to business model innovation, we make one important amend- ment, which follows from the question why risk man- agement should only be applied early on in the innova- tion process. Why is it that other gates can be left out and, more fundamentally, how can risks be managed adequately at other (more progressed) gates, if risk management is not applied there? We believe that risk management should play a role throughout the entire innovation process and therefore propose: The implementation of risk management throughout the innovation process reduces the risks related to the uncertainty and complexity of developing and implementing a new business model. In order to be able to research this proposition, we put forward a generic process that illustrates the possible integration of risk management within the overall busi- ness model innovation process (Figure 3). The model adopts the widely used stage-gate model proposed by Cooper (1993). The rationale for adopting a stage-gate process is twofold. First, previous research (e.g. Taran, 2011) indicated that many companies have adopted this model and incorporated it, in one way or another, in their innovation processes. This makes logical sense: the stage-gate model is essentially a project manage- ment tool, which is meant to increase the manage- ability of an innovation process by organizing it as a sequence of stages and gates. Second, adopting the stage-gate model allows us and, for that matter, com- panies using the model, to allocate risk management activities where they belong, namely at the gates, as also suggested by both Keizer et al. (2002) and Chap- man and Ward (2004). A business model innovation risk management model We propose the model in depicted in Figure 3 to de- scribe a practical, i.e. linear and systematic, implemen- tation of risk management in the business model in- novation process. Stage one focuses on visualizing the “as-is” business model of the company. Then, the pro- cess will continue by following a stage-gate procedure ending with the implementation of the new business model. Each stage and gate provides an opportunity for a com- plete risk management process. Based on an extensive literature review (e.g. COSO, 2004; Graham, 2004; Ernst & Young, 2006; The National Affordable Homes Agency, 2008, Deloitte & Touche, 2008; Olson and Wu, 2010; Wu and Olsen, 2010; Hoyt and Liebenberg, 2011; Kraus and Lehner, 2012), we narrowed that process down to four core activities, namely: Figure 2: The Unilever innovation funnel (Keizer et al., 2002) PHASE 1 IDEAS PHASE 2 FEASIBILITY PHASE 3 CAPABILITY PHASE 4 LAUNCH PREPARATION PHASE 5 POST LAUNCH EVALUATION PHASE 6 ROLLOUT CONTENDER CANDIDATE PROJECT A CANDIDATE PROJECT B PROJECT C PROJECT D PROJECT E PROJECT F PROJECT G PROJECT H ON SHELF IN FIRST MARKET/S CHARTER GATE CONTRACT GATE LAUNCH GATE ROLLOUT GATE 44 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 1. Identify various risks – strategic, operational & cul- tural, financial and hazard risks. 2. Analyze each of the risks identified. 3. Evaluate those risks – determine the level of risk that a company is willing to accept. 4. Treat the risks – the four possibilities are: avoiding, reducing, accepting and transferring/sharing the risks (e.g. De Loach, 2003). The purpose of the gates is to relax constraints, un- certainties and complexities throughout the business model innovation process, as well as to provide more certainty for managers regarding the path chosen. The first risk management phase is focused on the assess- ment of the current (“as-is”) business model. Identify- ing the risks at that stage can, for example, follow from a SWOT analysis, where the company is considering how to take advantage of opportunities and strengths and deal with weaknesses and threats. Then, through careful analysis and evaluation of each identified (stra- tegic, operational & cultural, financial, hazard) risk, managers search for possibilities to treat those risks, which eventually results in three possibilities, namely: retrenchment (cost cutting), compliance with regula- tions, or search for innovation solutions (e.g. a new product/service, process and/or market position). The second risk management phase begins by identify- ing the risks of each business model innovation pos- sibility that was proposed in the design phase. Here, too, users follow a systematic process of analyzing, evaluating and then treating those risks, which results, during the prioritization phase, in rejecting some busi- ness model innovation ideas, and selecting others for further processing. Finally, the third risk management phase facilitates the identification, analysis, evaluation and treatment of risks related to each downstream milestone. The purpose of this gate is to systematically organize the anticipation and sense of urgency needed to prevent sloppy implementation processes by dealing with a large variety of strategic, operational & cultural, finan- cial and hazard risks. Thus, unlike Keizer et al. (2002) and Chapman and Ward (2004), who suggested that the risk analysis should take place (only) at the gates of the innovation process, in our model we propose that the risk management process should be applied through the entire business model in- novation process i.e. during all stages and at all gates. Figure 3: Risk management integrated in the business model innovation process Stage 1 Gate 1 Stage 2 Gate 2 Stage 3 Gate 3 Stage 4 Innovation Risk management As-is business model New business model design Prioritizing and milestones Implementation Identify risks I I I Analyze risks A A A Evaluate-prioritize E E E Treat risks T T T 45 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 It should also be noted that unlike Cooper’s (1993) stage-gate model, we chose not to include a testing and validation phase. Due to the nature of business model innovations, it would be quite impossible to test and validate a new business model prior to its imple- mentation, as suggested for product innovations. Research design In the previous section we presented a business model innovation risk management model, which is based on the proposition that risk management should be im- plemented throughout the innovation process. This section describes the design of the pilot study we con- ducted to shed more light on the practical usability and usefulness of the model. According to Christensen (2006), theory is built in two major stages: 1. A descriptive stage, which aims to inductively ob- serve, classify and define various relationships to a specific phenomenon. 2. A normative stage, in which the researcher moves beyond statements of correlation to define what causes the outcome of interest. Given the “state-of-the-theory” of business model inno- vation, it would be too early to pursue normative theory. For that reason, this paper focuses on the first phase, i.e. the descriptive ‘pyramid’. While the wide majority of business model innovation research has focused on the base (observe, describe, measure) of the pyramid, and some work has been conducted at the second level (cat- egorization) (e.g. Koen et al., 2011; Taran et al., 2014), this paper moves business model innovation theory develop- ment to the third level (models) (Figure 4). A business model innovation process conducted by a Danish company, Provital, provides the empirical basis for this paper. We decided to perform action research in order to: Figure 4: The process of building a (descriptive) theory (Christensen, 2006) STATEMENTS OF ASSOCIATION (MODELS) CATEGORIZATION BASED UPON ATTRIBUTES OF PHENOMENA (FRAMEWORKS & TYPOLOGIES) OBSERVE, DESCRIBE, AND MEASURE THE PHENOMENA (CONSTRUCTS) CO N FIR M PR ED IC T ANOMALY 46 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 • Put the model developed (Figure 3) into a field test aimed at analyzing its usability and usefulness and, through that, • Explore the extent to which and, especially, how risk management can help a company handling various risks throughout its business model inno- vation process (cf. our research question formu- lated in the introduction section). The study began in early 2008 and ended in 2011. We were involved in the company’s attempt to develop an innovative business model from its inception, and par- ticipated actively in the development and screening of new business model ideas, as well as in the strategic decision making and change processes implemented later on. Short case description Provital was established in 2008 as a joint venture be- tween two medium-sized Danish companies. Provital’s value proposition involved a new and revolutionary fil- tration system, which can be assembled in various ways and applied in multiple industries (e.g. pools, car wash, marine boats, drinking water). One of the strengths of the products resided in the fact that they offered high- er quality for a lower price and lower life-cycle cost to target customers, regardless of their industry. Taking the changing focus of customers and countries towards environmentally friendlier products, and given the fact that there were few competitors to their of- fering in the global market, Provital expected that its cleansing system had the potential to revolutionize the market for water purification and would help the com- pany become a large and global player in a relatively short period of time. However, due to the potentially wide array of applica- tions of, and target markets for, their products, Pro- vital had difficulties in understanding how to manage the development of a business model supporting the company’s ambitions and, particularly, how to mitigate the risks involved in that process. Each industrial focus required its own manufacturing methods and technol- ogies, ways to organize the company’s core activities, and selection of key suppliers as well as target mar- kets, including choices such as customer types (e.g. B2B versus B2C) and geographical areas. Data collection and data analysis The company gave us a lot of freedom in experimenting with the business model innovation risk management model. In order to keep track of our interventions, we developed a project definition report that systemati- cally described each phase we went through. After we completed that report, the R&D manager was inter- viewed in order to assess the risk management process in light of the criteria benefits, timing and functionality (see below). Data collection – In order to develop that report we used participant observation and, in addition, con- ducted ten semi-structured in-process interviews, an ex-post interview with the R&D manager, and seven meetings with the company managers. We designed the meetings as workshops, which systematically fol- lowed the business model innovation process depicted in Figure 3. This helped us to test the risk management process while it was implemented, and explore its ef- fects on the innovation process. All notes taken at the meetings and workshops were uploaded to the project extranet. The managers had free access to those files and were encouraged to comment, correct and/or sim- ply accept our interpretations of these events. Data analysis – Similar to the procedure reported by Keizer and Halman (2007), the data was analyzed in three successive steps: 1. Risk management literature review – to develop a list of key risk factors. 2. Analysis of the interviews – to develop a better un- derstanding of disparities between the expected and the actual contribution of applying risk man- agement, and of the importance of applying risk management in the business model innovation process. 3. Content analysis – to draw valid case conclusions and check the risks identified by Provital’s man- agers during the workshops against the potential risks outlined on the basis of our previous litera- ture review. 47 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 Through that process we developed a list of risks, separated into four categories (strategic, operational & cultural, financial and hazard) with 22 critical risk issues. Additionally, given that our intention with the action research was to put the model developed (Figure 3) into a field test to analyze its application and effects, we decided to select the following criteria for assessing whether the application of the model should be consid- ered as successful, partly successful or a failure: • Benefits – so that we could learn whether the application of risk management throughout the business model innovation process was, indeed, beneficial for the company, not only in terms of the “success” or “failure” of the innovation, but also as regards the extent to which uncertainties, complexities and consequent risks were reduced throughout the business model innovation pro- cess. • Timing – so that we could learn whether risk man- agement activities should be applied only once (e.g. Keizer et al. 2002), several times, but still only at the early phases of an innovation process (e.g. Chapman and Ward, 2004) or, as our model sug- gests, ongoing, throughout the entire process. • Functionality – akin to the clinical test of a new medicine, we developed a new model (i.e. new medicine) but can only confirm whether the model actually functions as expected and if there are any “side-effects”, by trying it out in practice. The “benefits” criterion tests the usefulness of the model. The “timing” and “functionality” criteria test the model’s usefulness as well as its usability. According to Popper (1963), every genuine test of a theory is an attempt to falsify or to refute it. Testabil- ity, according to him, is falsifiability. Accordingly, a suc- cessful case would only suggest that the model is not refuted – further research would be needed to develop arguments for its usefulness and usability in similar contexts and its transferability to different contexts. The second scenario (i.e. partly successful), would sug- gest that the model has been partly disproven. Fur- ther investigation would be needed in order to learn what went wrong in which stage(s) and/or gate(s) of the model, and which aspects of the model need to be revised before testing it again. The third scenario (i.e. failure) would indicate that the model has to be reject- ed. Validity and Reliability – as recommended by Field- ing and Fielding (1986), Duffy (1987), Dick (1993), Lew- is (1998), Greenwood and Levin (2000) and Maxwell (2005), we used the following tactics: • Data triangulation – multiple sources of evidence were used, namely primary and secondary data, face-to-face interviews, mediated interviews, and group and third party interviews. • Two action research cycles were performed – this increased our understanding, and facilitated us in refining the initial conceptual framework (e.g. Lewis, 1998). • Data gathering process – as mentioned above, in- process and ex-post interviews were conducted for understanding better the disparity between the expected and the actual contribution of applying risk management, as well as the importance and seriousness of applying risk management in the business model innovation process (e.g. Keizer and Halman, 2007). • Iterative triangulation – is recommended in situ- ations where the research topic is novel and un- derdeveloped, but at the same time a body of rel- evant literature exists (Lewis, 1998). Accordingly, the business model innovation risk management model, was developed based on existing studies, rather than on data collected directly from the company. Analysis and Discussion The aim of this section is to analyze the results in view of the research question, give more concrete details on the process applied to identify, evaluate, analyze and 48 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 treat various risks, and present initial findings regard- ing “how” and the “extent” to which risk management can help a company in the complex and uncertain pro- cess of business model innovation. Process description As shown in Table 2, the risk management process in- volved four phases. First, for each risk criterion (strate- gic, operational & cultural, financial and hazard), poten- tial risks were identified. Then, each risk was analyzed qualitatively by assessing both the probability of the risk to occur and the relative impact that risk would have. For those risks that were rated as “medium” or “high”, i.e. misfit to the corporate risk appetite level of the firm, an “action needed to be taken” description was made, focused on a possible solution, i.e. avoid- ing, reducing, accepting, transferring or sharing the risk (e.g. De Loach, 2003), along with appointing a person in charge and determining the expected target date of completion. Finally, residual risks were assessed against the risk appetite level of the firm. Benefits Our observations and experiences from the workshops and interviews suggest that Provital has gained valua- ble benefits from experimenting with risk management. The company’s managers report that risk management assisted them in managing various risks across the en- terprise efficiently and effectively, as well as in prior- itizing their strategic, operational and financial choices throughout the business model innovation process. According to Provital’s R&D manager, many of the risks identified were not new to them, but through the pro- cess of analyzing these risks they realized that they had not really known how to manage them effectively but learned to do so. Furthermore, rating risks as low, medium or high helped them to better understand, systematically prioritize and organize what needed to be done in order to deal with the risks identified. By explicitly describing how to treat each risk expected in the course of the process, they were better prepared for and more aware of the risks they were willing to accept, which reduced the risk level (inherent versus re- sidual risks) and, with that, also the overall uncertainty and complexity associated with the business model in- novation process. Furthermore, according to Provital’s R&D manager, risk management also served as a compass that kept the company on track with its strategic goals and, for himself, to prioritize his work tasks. Running daily op- erations is hard enough, and focusing on small issues can distract attention from the bigger and more urgent ones. Keeping an “action needed to be taken” table for the risks that were rated as “medium” or “high” kept him focused and certain that he would find the time to address them. Additionally, he also found risk management to be a very efficient tool. Dividing the larger problem into different criteria and steps that are relatively easy to understand guided him through the business model in- novation process. All in all, Provital’s managers were very satisfied with experimenting with the risk management process, and the R&D manager in particular stated that he intended to continue working with risk management in future innovation processes, as well as with prioritizing his daily, weekly and monthly activities. These findings confirm previous publications (e.g. COSO, 2004; Graham, 2004; Ernst & Young, 2006; The National Affordable Homes Agency, 2008; Deloitte & Touche, 2008), which propose many benefits that company may gain from applying risk management in their innovation processes. Timing When the R&D manager was asked whether risk man- agement should be applied once or, rather, as an ongo- ing part of the innovation process, he argued for the latter. He felt it is particularly important to apply risk management at the early phases of the innovation process, but since competition today is so dynamic, today’s certainties can very easily become tomorrow’s new challenges – e.g. their bank crashed during the global financial crisis. Thus, as strategies and innovation plans may need to be changed frequently and occasionally perhaps even radically, new risks may emerge, which need to be an- alyzed all the time, both with respect to new innova- tions and also in different phases of a single innovation process. According to the R&D manager, Provital will be 49 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 Table 2: Example of evaluation and treatment of risks at Provital Qualitative risk analysis Action plan Post-hoc evaluation Medium and high risks identified Likeli- hood (1-5) Impact (1-5) Inher- ent risk Risk treatment Person in charge, and milestones Re- sidual risk Fit to the compa- ny’s risk appetite Further action planned Strategic risks S1 – Pro- vital’s lack of sales, leads to a shutdown of the joint venture. 5 5 High Primary focus is on insuring the com- pany owners’ sat- isfaction through improving web visualization, ag- gressive market- ing, achieving im- mediate sales and revenues, and se- curing IPR on the system. Top manager and R&D man- ager are respon- sible, already working on solv- ing the problem. They continue more rigorously after receiving funding. Low Fit No further action need- ed. But keep m o n i t o r i n g closely the owners’ ex- pectations. S2 - New competitor enters the industry with a competitive solution. 4 3 Me- dium Monitoring the industry for po- tential competi- tors. R&D manager Medium No fit Keep moni- toring the industry for p o t e n t i a l competitors on a month- ly basis. Operational & cultural risks O1 - No profes- sional sales peo- ple. Low marketing skills and practice. 1 5 Me- dium Need to get fund- ing for employing high quality sales and marketing people. Also, con- sidering outsourc- ing the marketing function and sell- ing to a third (ex- pert) company. All company managers. Partly already in pro- gress, and to be applied more rig- orously after re- ceiving funding. Low Fit No further action is needed. 50 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 Table 2: Example of evaluation and treatment of risks at Provital Qualitative risk analysis Action plan Post-hoc evaluation Medium and high risks identified Likeli- hood (1-5) Impact (1-5) Inher- ent risk Risk treatment Person in charge, and milestones Re- sidual risk Fit to the compa- ny’s risk appetite Further action planned O2 - Tests fail to show that the system is success- ful also in other industrial settings. 2 3 Me- dium Insure that the system operates successfully be- fore sales. The system will not sell if the pre- stress tests show that the system fails to operate success- fully. R&D manager. Already working on the problem. Low to me- dium Poor fit No further action need- ed. O3 - One of Pro- vital’s suppliers choose to stop working with the company. 1 1 Low (many sup- pliers avail- able) - - - - No further action need- ed Financial risks F1 - Lack of invest- ment money. 3 4 Me- dium Looking for po- tential investor. All managers (and owners). Al- ready working it. Low to me- dium Poor fit No further action need- ed. F2 - One of the mother compa- nies goes bankrupt. 1 5 Me- dium Cannot be con- trolled by the company. - Medium No fit Tolerate. 51 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 Table 2: Example of evaluation and treatment of risks at Provital Qualitative risk analysis Action plan Post-hoc evaluation Medium and high risks identified Likeli- hood (1-5) Impact (1-5) Inher- ent risk Risk treatment Person in charge, and milestones Re- sidual risk Fit to the compa- ny’s risk appetite Further action planned Hazard risks H2 - Glob- al financial crisis af- fects the company’s perfor- mance and sales. 5 3 High Each financial investment will be carefully ana- lyzed and decid- ed on jointly with financial experts. Top manager and R&D man- ager are respon- sible. Already in progress. Low to me- dium Poor fit No further action need- ed. able to stay ahead of its competitors, be more flexible and cope better with changing conditions that are both internal and external to the organization, by continu- ally analyzing various risks systematically. Thus, contrary to Keizer et al. (2002), but partly in line with Chapman and Ward (2004), the Provital case sug- gests that risk management cannot only be beneficially applied in the early stages but actually during all stages and at all gates of an innovation process. Functionality The study shows that risk treatment choices need to be considered in a comprehensive manner when look- ing for appropriate and holistic solutions. Every change may create new problems, challenges and risks. If each risk is handled individually, treating one strategic risk may very well result in a new operational challenge. For example, sales volumes in the local markets Provital served so far were low and in order to grow the com- pany was eager to enter the US market. However, the entire supply chain was comprised of local players only. The high operational and (particularly) logistical costs involved in setting up a global supply system forced the company to consider alternative, more cost effec- tive, operational solutions such as licensing and a joint venture. Thus, in addition to managing strategic, operational & cultural, financial and hazard risks individually, keeping a bird’s eye (i.e. systemic) view on the entire business model innovation process is also recommendable. However, Provital’s R&D manager also observed that an over-abundance of risk management can be prob- lematic, too, as this overloads the organization with too many activities, which are not only time consuming but can also be confusing for staff members to cope with. For example, when Provital’s managers were asked to list what they thought would be significant risk factors (Table 2), they realized that their list was getting longer and longer, to a point that it simply be- came impossible to manage it effectively, and decided to reduce the list to the 22 most critical risk factors. This observation touches on previous research, which has reported the negative impact of bureaucracy on 52 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 innovation (e.g. Burns and Stalker 1961), especially during the early phases of an innovation process (e.g. Zaltman et al., 1973; Kelly and Kranzberg, 1975; Pierce and Delbecq, 1977; Boer and During, 2001). Thus, al- though managing risks throughout the business model innovation process is important, finding the right balance so as not to suffocate the process is a serious challenge. Additionally, we also identified that by incorporating risk management in business model innovation pro- cesses, starting at the stage prior to a gate, followed by risk analysis at the gate, and treatment choices that take place in the stage following that gate, Pro- vital could significantly reduce many of the uncertain- ties and complexities they were facing in the course of the business model innovation process. They were much more clear about the treatment initiatives in terms of “what to do”, “how to do it” and “when to do it”, and address the most urgent ones first with full commitment from the management team. These findings correspond with Courtney et al. (1997), who argued that if a company underestimates or fails to manage uncertainties adequately, it will lead the company to develop strategies and operational pro- cesses that: • Neither defend against threats nor take advan- tage of opportunities. • Assume that the world is entirely unpredictable, which will then lead them to either abandon plan- ning processes (i.e. too uncertain – too risky), or simply follow their gut instinct (i.e. “just do it”). In the latter case, the innovation process will be perceived as nothing less than a gamble.. Finally, we observed that the company did not always implement initial treatment choices made at the gates in full. If new problems emerged (e.g. financial constraints), the CEO occasionally decided to re-prior- itize. This raises the question whether risk treatment decisions made at the gates should always be carried out “as planned”, or, alternatively, that they should be regarded as suggestions for action during the next stage(s). Evaluation and Propositions The application of the model in the Provital case should be considered a success: • Benefits: Provital gained multiple benefits from applying the model. It has reduced the risk level (inherent versus residual risks), and with that also the overall uncertainty and complexity of the entire business model innovation process. Consequently, they could proceed with the inno- vation process with more certainty. Additionally, by mitigating (mostly) known risks, they became more actively aware of their risk appetite and the volume and types of risks they were willing to ac- cept. • Timing: it appears to be important to apply risk management through the entire innovation pro- cess i.e. during all stages and at all gates. By con- tinually analyzing potential risks, the company was able to act more flexibly and cope better with changing conditions both internal and external to the organization. • Functionality: the approach proposed in Figure 3 works (for Provital). One issue remains: too little risk management creates unforeseen risks and effects; too much risk management creates bu- reaucracy and reduces flexibility and creativity. Finding the right balance is crucial, but how to achieve that is an open question. Thus, the business model innovation risk manage- ment model proposed in this paper was not rejected. However, it is too soon to conclude that the model is generally valid – more research in similar and differ- ent contexts is needed. Table 3 translates the find- ings reported above into testable propositions. 53 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 Table 3: Generalization of action research findings into propositions Category Action research case analysis - related text Proposition Benefits “By explicitly describing how to treat each risk expected in the course of the process, they were better prepared for and more aware of the risks they were willing to accept, which reduced the risk level (inherent versus residual risks) and, with that, also the overall uncertainty and complexity associated with the business model innovation process.”. Proposition 1: The implementation of risk man- agement into a business model innovation process reduces the level of risk related to the uncertainty and complexity of, or associated with, developing the new business model. Proposition 2: Managing risks throughout the en- tire business model innovation process will assist a company in aligning risk-treatment processes with the risk appetite level of the firm. Timing “When the R&D manager was asked whether risk management should be applied once or, rather, as an ongoing part of the innovation process, he ar- gued for the latter. He felt it is particularly impor- tant to apply risk management at the early phases of the innovation process, but since competition today is so dynamic, today’s certainties can very easily become tomorrow’s new challenges …”. Proposition 3: The likelihood of launching a suc- cessful new business model is increased if risk man- agement is applied throughout the entire business model innovation process, i.e. in all stages and at all gates. “Provital will be able to stay ahead of its competi- tors, be more flexible and cope better with chang- ing conditions that are both internal and external to the organization, by continually analyzing vari- ous risks systematically”. Proposition 4: Embedding risk management pro- cess in business model innovation process promotes organizational learning and flexibility, and creates more focus on strategic choices made at the gates. Functionality “…in addition to managing strategic, operational & cultural, financial and hazard risks individually, keeping a bird’s eye (i.e. systemic) view on the en- tire business model innovation process”. “…an over-abundance of risk management can be problematic, too, as this overloads the organiza- tion with too many activities, which are not only time consuming but can also be confusing for staff members to cope with”. Proposition 5: The likelihood of launching a suc- cessful new business model increases by securing: 1) An adequate alignment of various (stra- tegic, operational & cultural, financial and hazard) risks treatments choices with one another. 2) A sufficient and effective volume of risk management activities overall. 54 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 Conclusion Contribution In this paper we investigated the application and suc- cess potential of risk management in business model innovation processes, and formulated the following research question: To what extent and, especially, how can risk management help a company handling various risks effectively throughout its business model innova- tion process? Accordingly, we integrated findings re- ported in the risk management literature and Cooper’s stage-gate process in the business model innovation risk management model depicted in Figure 3, and tried that model in a business model innovation process un- dertaken by the Danish company Provital. Given the limited research available on business mod- els and risk management (associated with innovation processes), and the lack of research on understanding how to incorporate risk management within the overall business model innovation process, this research was largely explorative study – entering “terra incognita”. In addition, the research is based on the study of a single case. Yet, some valuable lessons can be formulated. First, the study supports our proposition that the imple- mentation of risk management throughout the innova- tion process reduces the risks related to the uncertainty and complexity of developing and implementing a new business model. The operational use of the business model risk management model suggests that it makes managers much more focused on identifying problem- atic issues (“know what to do”), and on putting explicit plans and timetables into place for resolving/reducing identified high and medium rated risks (“know how and when to do it”). Furthermore, the study indicates that risk management assists a company in aligning the risk treatment choices made during the innovation process with the company’s corporate strategy and risk appe- tite. In effect, managers are more confident about the strategic choices made during the innovation process, and it is also relatively easier for them to share their vi- sion and future plans with their staff members, and to prioritize their operational plans. So, risk management is “good”, but the case study also suggests that too much risk management is not. An overload of risk management leads to time-consuming bureaucracy and reduces flexibility and creativity. How to find the optimal “volume” of risk management in a business model innovation process remains a question for further research. Further Research Carlile and Christensen (2005) suggest that the descrip- tive part of theory building (Figure 4) is a preliminary stage, which researchers generally must pass through in order to develop more advanced normative theory. Ac- cording to them, “the ability to know what actions will lead to desired results for a specific company in a spe- cific situation awaits the development of normative theory in this field” (Carlile and Christensen 2005, p. 4). The action research reported in this paper should be considered as a pilot study (e.g. Lancaster et al., 2004; Ruxton and Colegrave, 2006), aimed at pre-testing or “trying out” (Baker, 1994) the approach proposed in Figure 3. Thus, although the action research failed to falsify the proposed generic business model innovation process (Figure 3), the results drawn from this research should be considered as tentative theory. Consequent- ly, further research is needed in order to validate and test the generalizability of the model. In order to even- tually arrive at normative theory, further research will involve the following consecutive steps: • Test the approach in different situations, through a multiple action research study aimed at testing the approach through business model innovation initi- atives of various companies, preferably SMEs and larger firms, representing different industries. In that respect, it should also be recognized that prac- titioners should not only measure the operational use of the approach by the “success” or “failure” of a business model innovation, but also in terms of the extent to which uncertainties, complexities and consequent risks are reduced throughout the innovation process. The reason for doing so is the understanding that innovation is a “risky business” – risk will never be eliminated completely. The ap- plication of the model in various circumstances may also validate, or alternatively falsify, the sug- gested linear nature of the model and, particularly, the risk management activities applied throughout that process. 55 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 • Measure long-term effects of applying the model – once the application of the model has been tested in various industrial settings, and still assuming that it has yet to be falsified, we propose to pro- ceed with a questionnaire-based survey to analyze, retrospectively, not only the short term effects of applying the model, but also the long term effects of its application in terms of, for example, avoiding cannibalization and securing sustainable growth. References Accenture (2009), Managing risk in extraordinary times. http://www.anniesearle.com/web-services/Documents/ Articles/Managing%20Risk%20in%20Extraordinary%20Times.pdf. Retrieved 29 January 2014. Amit, R., and Zott, C. (2001), Value creation in e-business, Strategic Management Journal, Vol. 22, No. 6-7, pp. 493- 520. Baker, T.L. (1994), Doing social research, New York: McGraw-Hill Inc. Boer, H. (1991), Organising innovative manufacturing systems, Aldershot: Gower. Boer, H. and During, W.E. (2001), Innovation – What innovation? A comparison between product, process and or- ganisational innovation, International Journal of Technology Management, Vol. 22, Nos. 1-3, pp. 83-107. Burns, T. and Stalker, G.M. (1961), The management of innovation, London: Tavistock Publications. Carlile, P.R. and Christensen, C.M. (2005), The cycles of theory building in management research, Working paper 05- 057, Boston: Harvard Business School. http://www.hbs.edu/faculty/publication%20files/05-057.pdf. Retrieved 30 November 2013. CAS (Casualty Actuarial Society) (2003), Overview of enterprise risk management, Arlington: ERM community. Chapman, C.B. and Ward, S.C. (2004), Project risk management: Processes, techniques and insights, Chichester: John Wiley and Sons. Chesbrough, H. (2007), Open business models. How to thrive in the new innovation landscape, Boston: Harvard Business School. Chesbrough, H. (2010), Business model innovation: Opportunities and barriers, Long Range Planning, Vol. 43, Nos. 2-3, pp. 354-363. Christensen, C.M. (2006), The ongoing process of building a theory of disruption, Journal of Product Innovation Man- agement, Vol. 23, No. 1, pp. 39-55. COSO (2004), Enterprise risk management – integrated framework executive summary, Committee of Sponsoring Organizations of the Treadway Commission, USA. Cooper, R.G. (1993), Winning at new products: Accelerating the process from idea to launch, Boston: Addison-Wesley. 56 http://www.anniesearle.com/web-services/Documents/Articles/Managing%20Risk%20in%20Extraordinary%20Times.pdf http://www.anniesearle.com/web-services/Documents/Articles/Managing%20Risk%20in%20Extraordinary%20Times.pdf http://www.hbs.edu/faculty/publication%20files/05-057.pdf Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 Courtney, H., Kirkland, J. and Vigueria, P. (1997), Strategy under uncertainty, Harvard Business Review, Vol. 75, No. 6, pp. 66–79. D’Aveni, R.A. (1994), Hypercompetition. New York: The Free Press. De Leeuw, A.C.J. (1982), Organisaties: management, analyse, ontwerp en verandering; Een systeemvisie, Assen: Van Gorcum. De Loach, J.W. (2003), Building enterprise risk management on the foundation laid by Sarbanes-Oxley, Protiviti, Inc. Deloitte & Touche (2008), Perspectives on ERM and the risk intelligent enterprise – Enterprise Risk Management Benchmark Survey, Deloitte Development LLC. http://www.deloitte.com/assets/Dcom-UnitedStates/Local%20 Assets/Documents/us_risk%20consulting-ERMBenchmarkSurvey_110308.pdf. Retrieved 27 November 2013. Dick, B. (1993), You want to do an action research thesis? An interchange resource document No. v2.06:930507, Brisbane: Interchange. Duffy, M.E. (1987), Methodological triangulation a vehicle for merging quantitative and qualitative methods, Image: the Journal of Nursing Scholarship, Vol. 19, No. 3, pp. 130-133. During, W.E. (1984), Innovatieproblematiek in kleine industriële bedrijven, PhD thesis, Enschede: School of Manage- ment Studies, University of Twente (also published as: During, W.E. (1986), Innovatieproblematiek in kleine indus- triële bedrijven, Assen: Van Gorcum). Ernst & Young (2006), Managing risk across the enterprise: The value of enterprise risk management. http://www. wlu.ca/documents/35471/Managing_Risk_Across_the_Enterprise.pdf. Retrieved 27 November 2013. Fielding, N. and Fielding, J. (1986), Linking data: The articulation of qualitative and quantitative methods in social research. Sage, London and Beverly Hills/London: Sage. Galbraith, J.R. (1973), Designing complex organizations, Reading, MA: Addison-Wesley. Graham, A. (2004), Integrated risk management: Implementation guide, Treasury Board of Canada Secretariat. http://post.queensu.ca/~grahama/publications/TEXTPDF.pdf. Retrieved 27 November 2013. Greenwood, D.J. and Levin, M. (2000), Reconstructing the relationship between universities and society through action research. In N.K. Denzin and Y.S. Lincoln (eds.), Handbook of qualitative research, Thousand Oaks: Sage, pp. 85-106. Guo, Y. (2012), Research on innovation risk management based on Bayesian risk decision-making, International Journal of Business Administration, Vol. 3, No. 1, pp. 21-30. Guo, Y. (2013), Research on framework of risk management of uncertain innovation, Management, Vol. 3, No. 7, pp. 402-407. Hoyt, R.E. and Liebenberg, A.P. (2011), The value of enterprise risk management, The Journal of Risk and Insurance, Vol. 78, No. 4, pp. 795-822. IBM (2006), Expanding the innovation horizon, http://www-935.ibm.com/services/uk/bcs/html/t_ceo.html, re- trieved on 22 November 2006. ISO/IEC Guide 73 (2002), Risk management: Vocabulary, guidelines for use in standards. http://www.standardsdi- rect.org/standards/standards4/StandardsCatalogue24_view_26100.html. Retrieved 27 November 2013. 57 http://www.deloitte.com/assets/Dcom-UnitedStates/Local%20Assets/Documents/us_risk%20consulting-ERMBenchmarkSurvey_110308.pdf http://www.deloitte.com/assets/Dcom-UnitedStates/Local%20Assets/Documents/us_risk%20consulting-ERMBenchmarkSurvey_110308.pdf http://www.wlu.ca/documents/35471/Managing_Risk_Across_the_Enterprise.pdf http://www.wlu.ca/documents/35471/Managing_Risk_Across_the_Enterprise.pdf http://post.queensu.ca/~grahama/publications/TEXTPDF.pdf http://www-935.ibm.com/services/uk/bcs/html/t_ceo.html http://www.standardsdirect.org/standards/standards4/StandardsCatalogue24_view_26100.html http://www.standardsdirect.org/standards/standards4/StandardsCatalogue24_view_26100.html Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 Kalvet, T. and Lember, V. (2010), Risk management in public procurement for innovation: The case of Nordic–Baltic Sea cities, Innovation: The European Journal of Social Sciences, Vol. 23, No. 3, pp. 241-262. Kraus, V. and Lehner, O.M. (2012), The nexus of enterprise risk management and value creation: A systematic litera- ture review, ACRN Journal of Finance and Risk Perspectives; Vol. 1, No. 1, pp. 91-163. Keizer, J.A., Halman, J.I.M. and Song M. (2002), From experience: Applying the risk diagnosing methodology, Journal of Product Innovation Management, Vol. 19, No. 3, pp. 213-232. Keizer, J.A. and Halman, J.I.M. (2007), Diagnosing risk in radical innovation projects, Research Technology Manage- ment, Vol. 50, No. 5, pp. 30-36. Kelly, P. and Kranzberg, M. (eds.), (1975), Technical innovation: A critical review of current knowledge (Volume 1: The ecology of innovation), Advanced Technology and Science Studies Group, Atlanta: Georgia Tech. Kendrick, T. (2003), Identifying and managing project risk: Essential tools for failure-proofing your project, New York: Amacom. Kickert, W.J.M. (1979), Organisation of decision-making. A systems-theoretical approach, Amsterdam: North-Hol- land Publishing Company. Koen, P.A., Bertels, H.M.J. and Elsum, I.R. (2011), The three faces of business model innovation: Challenges for es- tablished firms, Research Technology Management, Vol. 54, No. 3, pp. 52-59. Lancaster, G.A., Dodd, S. and Williamson, P.R. (2004), Design and analysis of pilot studies: Recommendations for good practice. Journal of Evaluation in Clinical Practice, Vol. 10, No. 2, pp. 307-12. Lewis, M.W. (1998), Iterative triangulation: A theory development process using existing case studies, Journal of Operations Management, Vol.16, No.4, pp. 455-469. Magretta, J. (2002), Why business models matter?, Harvard Business Review, Vol. 80, No. 5, pp. 86-92. Maxwell, J.A. (2005), Qualitative research design: An interactive approach, Thousand Oaks: Sage. Mintzberg, H. (1979), The structuring of organizations, Englewood Cliffs: Prentice-Hall. Moeller, R. (2007), COSO Enterprise risk management: Understanding the new integrated ERM framework, Hobo- ken: John Wiley & Sons. Monahan, G. (2008), Enterprise risk management: A methodology for achieving strategic objectives, Hoboken: John Wiley & Sons. Morris, M., Schindehutte, M. and J. Allen (2003), The entrepreneur’s business model: Toward a unified perspective, Journal of Business Research, Vol. 58, No. 6, pp. 726-735. Mowery, D. and Rosenberg, N. (1979), The influence of market demand upon innovation: A critical review of some recent empirical studies, Research Policy, Vol. 8, No. 2, pp. 102-153. O’Connor, C.G., Ravichandran, T. and Robeson, D. (2008), Risk management through learning: Management prac- tices for radical innovation success, Journal of High Technology Management Research, Vol. 19, pp. 70-82. Olson, D.L. and Wu, D.D. (2010), A review of enterprise risk management in supply chain, Kybernetes, Vol. Vol. 39, No. 5, pp. 694-706. 58 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 Osterwalder, A., Pigneur, Y. and Tucci, L.C. (2004), Clarifying business models: Origins, present, and future of the concept, Communications of AIS, Vol. 16, pp. 1-25. Osterwalder, A. and Pigneur, Y. (2010), Business model generation. A handbook for visionaries, game changers and challengers, Hoboken: John Wiley and Sons. Perrow, C. (1967), A framework for the comparative analysis of organizations, American Sociological Review, Vol. 32, No. 2, pp. 194-208. Pierce, J.L. and Delbecq, A.L. (1977), Organization structure, individual attitudes and innovation, Academy of Man- agement Review, Vol. 2, No. 1, pp. 27-37. Popper, K. (1963), Conjectures and Refutations, London, UK, Routledge and Kegan Paul, pp. 33–39. Reprinted in Theodore Schick (ed.), (2000), Readings in the Philosophy of Science, Mountain View: Mayfield Publishing Com- pany, pp. 9-13. Ruxton, G.D. and Colegrave, N. (2006), Experimental design for the life sciences, Oxford: Oxford University Press. Sayles, L.R. (1974), The innovation process: An organizational analysis, The Journal of Management Studies, Octo- ber, Vol. 11, No. 3, pp. 190-204. Schroeder, R., Van de Ven, A.H., Scudder, G. and Polley, D. (1986), Managing innovation and change processes: Find- ings from the Minnesota innovation research program, Agribusiness, Vol. 2, No. 4, pp. 501-523. Selz, D. (1999), Value webs: Emerging forms of fluid and flexible organizations, unpublished doctoral dissertation, St. Gallen: University of St. Gallen. Simon, H.A. (1964), On the concept of organizational goal, Administrative Science Quarterly, Vol. 9, No. 1, pp. 1-22. Stewart, D.W. and Zhao, Q. (2000), Internet marketing, business models, and public policy, Journal of Public Policy & Marketing, Vol. 19, No. 2, pp. 287-296. Taplin, R. (2005), Risk management and innovation in Japan, Britain and the United States, London: Routledge. Taran, Y. (2011), Rethinking it all: Overcoming obstacles to business model innovation. PhD thesis, Aalborg: Center for Industrial Production, Aalborg University. Taran, Y., Boer, H., and Lindgren, P. (2014), A business model innovation typology, Decision Sciences Journal (forth- coming) The National Affordable Homes Agency (2008), Risk management strategy, London: Housing Corporation. Thompson, J.D. (1967), Organizations in action, New York: McGraw-Hill. Timmers, P. (1998), Business models for electronic markets, Journal on Electronic Markets, Vol. 8, No. 2, pp. 3-8. Weill, P. and Vitale, M.R. (2001), Place to space, Boston: Harvard Business School Press. Wu, D. and Olson, D.L. (2010), Enterprise risk management: Coping with model risk in a large bank, Journal of the Operational Research Society, Vol. 61, No. 2, pp.179-190. Zaltman, G., Duncan, R. and Holbek, J. (1973), Innovations and organizations, New York: John Wiley & Sons. 59 Journal of Business Models (2013), Vol. 1, No. 1 pp. 38-60 About the authors Dr. Yariv Taran is an Assistant Professor in Innovation and Or- ganization at the Center for Industrial Production at Aalborg University. He received a BSc in Management and Sociology at the Open University of Israel, and an MSc in Economics and Business Administration at Aalborg University, from where he also received his PhD in Business Model Innovation. His re- search focuses on business model innovation. Other areas of research interests include intellectual capital management, knowledge management, entrepreneurship and regional sys- tems of innovation. Dr. Harry Boer is a professor of strategy and organization at the Center for Industrial Production at Aalborg University, Denmark. He holds a BSc in applied mathematics and an MSc and PhD both in management engineering, all from Twente University, the Netherlands. He has published on subjects such as organization theory, flexible automation, manufac- turing strategy, and continuous improvement/innovation in the International Journal of Operations & Production Man- agement, the Journal of Production Innovation Management, Decision Sciences, the Journal of Manufacturing Technology Management, Creativity and Innovation Management, Pro- duction Planning & Control, and the international Journal of Technology Management. His current research interest is in continuous innovation, the effective interaction between day-to-day operations, incremental change, and radical in- novation. Dr. Peter Lindgren is Professor of Multi Business Model Inno- vation and Technology at Aarhus University. He holds a PhD in Network Based High Speed Innovation from Aalborg Uni- versity. He has (co-)authored articles and books on business model innovaion and multi business model innovation and technology. He was a researcher at Politechnico di Milano, Stanford University. He was founder and center manager of International Center for Innovation and research group Multi Business Model Innovation and Technology (MBIT). He is a thematic leader at The Center for TeleInFrastruktur (CTIF) and is editor of the Journal of Multi Business Model Innova- tion and Technology. His research interest is Multi Business model innovation and technology. 60 _GoBack _GoBack _GoBack