Effective Risk Management

Risk is embedded in every opportunity a business faces. And poor risk management can result in large financial costs, or even failure. Risk points can emerge anywhere: small scale project delays, the misguided actions of an employee, or a fire in an inventory warehouse.

This article will help any small business owner or manager better understand what risks are out there, and more importantly, how to better control them.

First, I’ll explain why a systematic analysis of risks is important and illustrate a simple risk management architecture. Then, I’ll talk about how I helped companies better identify and manage a variety of risks.

What is Risk Management?
Simply, risks are threats to your business or project. They are situations or events that can affect the outcome of your decisions and actions. Therefore, risk management is the identification, evaluation, and mitigation of risks to a business or project.

Why is Risk Management Important?
All businesses exist for one clear reason: To make a profit. Poorly managed risks have tangible and dramatic effects on the bottom line. Therefore, sound risk management is important to ensure that your business can overcome any problems and continue to grow profitably.

Threats to a small business or project can come from a variety of sources. In 2002, The Risk Management Standard categorized risks into four areas: Financial, Operational, Strategic, and Hazard. Strategic risks can emerge from competitors, customers, or markets of a company. For example, the technological features of a companies’ product may become obsolete. Operational risks can affect how the company operates internally. Systems such as IT, material procurement, and accounting responsibilities can be compromised by employees. Financial risks can hinge on financial market performance, such as foreign exchange fluctuations. The last type- Hazard risk- can be the most damaging. Events like natural disasters, manmade disasters, and crime can permanently disable a company.

How to Build an Effective Risk Management Strategy
An effective risk management strategy must be systematic and robust. It also must be straight-forward, and simple to implement.

An effective risk management strategy will have three stages:
•Identify
•Evaluate
•Mitigate
During the Identify stage, owners and/or senior managers need to thoroughly examine the business from many different perspectives. All risks facing all areas of a company need to be identified. This should be done with as many people involved as realistically possible to give a complete picture.

During the Evaluate stage, each risk is given a probability of occurrence and a severity of occurrence ranking (This can be done with a simple 1 to 5 scale; 1 being “rarely occurring” and “minimal damage”). This allows senior management to more clearly understand the extent of potential damage.

During the Mitigate stage, the resulting risks are controlled through a variety of methods. For example, traditional insurance is one way to remove hazard risk. Financial risks can be managed through capital market hedging transactions. Operational risks are minimized by clear check and balance procedures and management oversight within the company. Strategic risks can be minimized by better documentation, such as protecting intellectual property rights.

How I Have Managed Risk
My experiences have given me a clear appreciation for the importance of systematic and robust risk management. What I talk about next is how I identified, evaluated, and mitigated various risks at three different companies in three different industries.

While I managed a Midwestern real estate portfolio for Cohen-Esrey, risk emerged in several areas. The easiest risks to identify and mitigate were the hazard points, such as fire and water damage for an apartment building. More complex issues, such as “Slips and Falls” on icy steps required us to put traditional insurance in place with a covenant that said employees would also work to minimize any liability by removing snow in a timely fashion. Other problems and solutions were less clear cut. At one point we had issues with employees “walking off” with tools from the property workshops. To mitigate this problem, we restructured our recruitment and selection process. Vendor relationships also became a liability issue. Only clear communication on a timely basis minimized such vulnerability.

Although most small businesses won’t encounter the risks I mitigated at HSBC brokering financial derivatives, the experience built my appreciation for risk. Our team worked on behalf of many global banks hedging financial market risk. Although the market place conventions and contracts were similar, each transaction was done for a different reason. We analyzed the interest rate environment, advised traders as to how to better hedge their risk, and then brokered very large transactions. These experiences instilled in me the importance of understanding and transferring risk.

Managing a Customer Relationship Project for Reuters is where my risk management became a formalized business process. My job was to coordinate and implement a CRM initiative that stretched over 10 months and included staff on several continents. To better understand what issues would affect the timetable and budget, the team put together a Risk Matrix. This illustrated three key issues: what each risk point was, its’ potential occurrence and severity, and who was responsible for mitigating it. At every meeting the team would review the Risk Matrix and identify any future risk points. As with most projects, communication is key, and this encouraged a high degree of communication and accountability.

Risk is embedded in every opportunity a business faces, and poor risk management can have profound effects on the outcome of any business endeavor.

Putting an effective risk management system in place is the first step for a small business owner, who can then confidently exploit new business opportunities.