Why Risk Management is Good Business (No Matter What Business You're In)

Effective risk management is good business sense, no matter what business you are in. It is a hugely important tool for organisations of all sizes, and across all sectors.

In this article we’ll discuss why, but also focus on smaller organisations. They are often the last to grasp this critical tool even though it is for them that risk management can prove the most beneficial.

________________________________________________________________________________________________

________________________________________________________________________________________________

What is a risk and why manage it?

A risk is an uncertain event – something that could happen but that has not yet happened. Why is that important? I mean, who can predict the future? Well, that’s the point. A good risk management plan helps you prepare for the future and either avoid bad things or make good things more likely.

You may be aware of a SWOT analysis, where a team or organisation looks at their Strengths, Weaknesses, Opportunities and Threats. With risk management you are effectively managing the Threats and Opportunities.

Your strengths and weaknesses are thing that you have; threats and opportunities are what you face.

Risk Management is Proactive

Essentially effective risk management allows you to be proactive. You want to avoid threats and seize opportunities. A good risk management framework allows you to do that.

Being proactive means you avoid the time and effort involved in reacting to things, which are at best a disruptive distraction. By looking ahead you can plan for, and even make more likely, the outcome you want to see and gain an advantage over others by shaping the future before others have started to think about the same things.

Examples of being proactive might include:

• a local charity realises it is dependent on one major source of funding. If the funding is reduced it puts the charity at risk, preventing it from achieving its charitable objectives. It decides to explore wider funding sources before anything changes, so it can make its survival more certain.
• a small business relies on one person to generate and manage invoices. If that person goes on long term sick leave there is a risk that the business will lose track of invoices, resulting in late or non-payment which could affect cash flow. The business decides to train colleagues so they can cover in the event of an unplanned absence.

Risk Management Enables Joint Working

A common approach to risk allows people with different jobs, or people from different teams, to communicate purposefully, and add value because they are using shared objective tools.

For example, bringing a new product to market carries a lot of risks:

• the costs of product development may exceed budgets;
• the product may not be ready in time for scheduled product launch;
• a lack of understanding of who the product is aimed at, and how to reach them;
• support not being in place for customers who need it.

All of these risks need to be managed, but they are owned by different parts of the organisation – finance, the project team, marketing, customer services. By coming together the owners of various risks can compare their risks and work out an action plan based on the level of risk, and at what point the risk is likely to emerge.

We All Manage Risk Every Day

Whether or not we have formal risk management processes, we all manage risks every day. We look both ways when crossing the road, we take an umbrella if it looks like rain and so on.

We are also familiar with risk management in terms of health and safety, and project risk assessment. Risk assessment is a core part of financial services, from insurance to mortgage lending (you can read more about risk in financial services here) It almost goes without saying that risk is managed in clinical settings, be it infection control or making a decision about whether to operate.

Formalising risk management within a framework effectively embeds a day to day activity within your organisation’s processes. The point of formalising it is that you make an intuitive, and relatively common, human activity part of your normal operational activity.

Since risk management happens so much, there is no reason for you to miss out. This is particularly true because, as we discuss below, relatively few organisations – especially SMEs – have this weapon in their arsenal.

Risk Management Was Key During Covid

According to Funding Circle three quarters of businesses who put risk assessment in place say it helped reduce the impact of the pandemic.

However, too few businesses, particularly smaller ones, take advantage of this core business tool.

Effective forward planning for threats and opportunities is more frequently done by larger businesses – at least 60% of those with over 100 employees, compared to only 36% with seven of fewer. Yet 84% of businesses that carried out risk planning said that their planning was effective, and 90% expect an increase in trade [1].

Also smaller businesses were twice as likely to report their contingency planning was not effective compared to larger organisations.

At a minimum all businesses need a contingency plan (or something like a business continuity plan). They can then take swift pre-planned action in the event of a recession, pandemic or other major change to the trading or operating environment.

________________________________________________________________________________________________

________________________________________________________________________________________________

Risk Management Techniques

The best place to start is to think about the contingency plans you might need for a number of scenarios that could affect your business.

Think about what could go wrong in the key operational units of your business.

• people
• suppliers and partners
• sales
• finance
• the wider economy

Phrase your question in terms of cause, event, and effect:

“If X happened, this could cause Y, which might result in Z”. Note the question is written about something that could happen – that is what a risk is.

For example, “If our sales dropped by 20% then we would no longer be profitable, which would mean we would need to dip into our financial reserves and find ways to cut costs – possibly including redundancies”.

Then you should think about your risk approach. Do you accept the risk (do nothing), avoid the risk (stop the activity that poses the risk) or mitigate the risk (find a way of making the outcome less bad)?

Because your risks do not sit in isolation, and because risk management should be a benefit not a burden, you will need to group your risks together and compare them to work out which are your highest priorities for action.

The best way of doing this is compiling a risk register. You can find a template risk register in the free resource section of our website – click here to download it.  You will need to keep your risks live and under review going forward. One of the biggest mistakes organisations large and small make is treating risk management as a one off exercise.

Remember the Opportunities Alongside the Threats

Going back to our SWOT analysis out uncertain events include opportunities as well as threats. Opportunities are “positive risks”. Things you want to happen – sales to new customers, repeat or upselling to existing customers for example.

For the most mature approach to risk management you should recast the techniques discussed above in positive terms and see what you can do to make the outcome more likely or better.

For example “If we added valuable new features to our core product we could increase quality at low cost, allowing us to increase prices, and turnover”.

Under the circumstances risk management is a critical tool that no business can afford to do without.

________________________________________________________________________________________________

________________________________________________________________________________________________