Eleven Steps to Smart Risk Management, Value Enhancement

The recipe of business contains a dizzying array of ingredients – products, services, employees, websites, contracts, relationships, vendors, contractors, debt, equity, marketing, advertising, sales, branding, location, writing, inventory, service, etc. The gathering and assembling and mixing and preparing and maintaining take an immense amount of time, energy and hard work. If all goes well, and with a little luck – a la the Wright Brothers of 1903 – the creation takes flight. Everybody cheers.

Before long, you’re flying each day. But your task has moved from getting airborne to wringing out the risk and variability. Only by skillfully managing the multitude of potential perils will the business endure. Only those who are able to wring out risk and deliver consistent and predictable results will be able to garner the essential support from vendors, lenders, insurance companies, employees and customers.

How can you do this? Where should you start? Follow these steps:

Step 1. Determine the Maximum Tolerable Loss (Dollars): Business owners, like pilots, want outcomes within an acceptable range. Outcomes outside of the acceptable range can result in demise. So, a key question for every business owner is, “How big a financial loss can we sustain without risking the solvency of our business?”

You need to answer this for yourself. For your business. Seek the aid of your accountant. The number is, of course, different for every business and business owner. It’s a function of the business’ liquidity, capitalization, cash flow and funds availability.

It also takes into account the risk tolerance of the owner(s).

Step 2. Assemble a Team: Once you’ve established the maximum loss that is tolerable, you need to assess your risk status. To do that, you need to assemble a team. The first and most important member of the team is you. Nobody knows your business and its risks as well as you do and, being the largest shareholder (most likely), nobody has a greater financial interest in the success of your business. Then include your partners, your commercial insurance broker and your attorney. Add to this anyone else you respect for his or her business or strategic mind and creativity. This could be your accountant, financial advisor, spouse or friend.

Step 3. Attend an Association Conference: Talking to peers is an unmatched way of identifying the many things that could happen to your business. By peers, we mean persons who own and/or run companies similar to yours. Risks are unique to every business and come in different forms for retailers, distributors, service companies and manufacturers. Attend an industry conference and talk to your peers about the types of risk events they’ve experienced, heard about and conceptualized. Then ask how they attempted to, or would, address each.

Step 4. Meet with Your Team to Identify Risks: To aid in risk identification, structure the discussions along the following lines, one at a time:

Your Value Chain. Value activities are building blocks a company uses to create a product or service. Every value activity involves inputs (material, labor, technology) that are important to the product or service you deliver.

There are two broad types of value activities – primary and support. Primary activities include physical creation of the product, its sale and transfer, and its after-sale assistance. Support activities buffer primary activities and one another by providing purchased inputs, technology and human resources.

Use the accompanying Generic Value Chain to lay out the key activities, or inputs, of your value chain. Then identify all of the various things (“risks”) that could interrupt each activity or input.

Important Relationships. Do you rely on a particular person’s talent, reputation or connections? A particular association?

Critical Data. Do you rely on a certain code or formula?

Set of information? Do you hold information that is important to your customers?

Critical Assets. Talent? Competency? Database? Equipment? Tool? Mold? Location?

Important Customers. Is a significant portion of your revenue coming from a single customer? Group of customers?

Important Industries. Is a significant amount of your revenue coming from a single industry? A narrow or related group

of industries?

Events and Accidents. What if your facility catches fire? A piece of equipment blows up? A flood? A key person suddenly can’t perform or cooperate or support?

List each risk by name, assign each a letter (A, B, C, etc.) and include a description.

Step 5. Estimate the Financial Impact of Each Risk:

Be sure to consider both direct and indirect costs. For example, inability to access key data would halt operations and cause loss but could also result in lawsuits by customers or vendors. Or a moral failure of a well-recognized and respected personality could result in losing that person, and indirectly lead, over time, to loss of additional employees, customers or financial providers. Once the risk has been estimated, it can help if you plot it on a chart, as in the example below.

Step 6. Estimate the Likelihood of Each Risk: Frequency of occurrence, or likelihood, is nearly as important as financial impact. Clearly, some risks are so rare that most people will just ignore them. They are risks at the level of “If that happens then we’re all in big trouble,” such as war. But once a risk hits the level of “I heard of it happening to others on occasion,” it needs to be evaluated. So rank each identified risk according to likelihood. We suggest the following categories:

1.   Never heard of this happening to anyone before.

2.   Heard of this happening before.

3.   Know companies that this has happened to before.

4.   It happened to us before.

5.   It happens to us periodically or even frequently.

Step 7. Create Your Risk Table: To each risk that you’ve identified, place your frequency rating, severity rating, and then multiply the two and place the total in an additional column. Here’s an example.

Sample Risk Table

¹ Frequency times Severity

*          on scale of 1 through 5 (1 being the least)

Step 8. Develop Your Customized Risk Matrix: Using the data in your risk chart, create your risk matrix. Place likelihood on the Y axis and financial impact on the X axis. Model your graph after the Generic Risk Matrix below. As you can see, your most dangerous risks will lie in the upper right of your matrix. Your least troublesome risks will be in the lower left.

Place each of your risks on your own matrix. Here’s an example of a completed Risk Matrix:

Step 9. Develop Your Risk Response: You have a choice in how you deal with risk. Your choices include:

Terminate. Avoid risk entirely by discontinuing the activity that gives rise to the risk. This might include, for example, not holding sensitive customer data or, if that’s not possible, not holding an existing credit card business at all.

Mitigate. This means reducing the risk somehow by, for example, hiring and training a second-in-command to buffer the company against potential loss of a key employee. Additional examples include diversifying your customer, product or vendor base to deal with concentration risk or buying the land and building to control your ability to retain a key location.

Transfer. Risk can be financially or contractually transferred to other parties by means of insurance, capital markets (such as hedging exposure to a rise in price of a key commodity) or contracts (such as requiring customers to contractually indemnify you for loss of their sensitive data or your inability to deliver because of certain events that might occur).

Exploit. In some cases, you may spot areas of risk, quantify the risk in loss per event and frequency, consider profit that is or could be earned, and then decide that the profit you could earn fully compensates for the risk. An exploit strategy typically entails savvy use of risk mitigation and transfers. In fact, areas of high risk can become high-value opportunities to those able to skillfully deal with risk.

Tolerate. Many risks fall below a threshold of tolerance (lower left in the Risk Matrix chart above). Their financial impact and frequency do not render them a material threat to the business. The choice of this option always depends on the relative cost of alternate strategies. In cases where mitigation or transfer are cheap and easy, even low-level risks can be dealt with economically. In cases where risks are difficult or costly to mitigate or transfer, and an exit is not merited, toleration is the appropriate strategy.

Step 10. Implement Your Risk Response: If you’ve made it this far, you’ve done more than most owners of small and midsize businesses. Now implement your strategies. Your company and its stakeholders will enjoy the benefits for years to come. To be sure it gets done, consider delegating the task to one of your most loyal employees. Put it on his or her list of important jobs and evaluate him or her on the success of the implementation.

Step 11. Periodic Review: The good news is that this risk evaluation process does not have to be done every year. The risks usually don’t change that quickly. An annual review of major risks laid out in your risk matrix, and the status of strategies in place, is sufficient. But every five years or so, we recommend that you start at Step 1, albeit with the old plan in hand, and consider the risks – new and old – once again.

I cannot emphasis enough that a thorough, strategic review of risk, response strategies and, of course, competent implementation will improve your business. As an owner, you will gain confidence and sleep better at night. Your employees and customers will see your professionalism and diligence, and you’ll be better able to attract and retain staff with both of these qualities. Your bankers will become more willing to lend, your insurance cost will probably go down, and your earnings will, over time, become less volatile. This mean higher valuations and – as we’ve said over and over in this publication – you enjoy value increases whether or not you sell your business.