One of your management team has just pointed out that if the M25 were to be closed for a week, you'd probably go out of business. It has made you think about what other events - such as fire, flooding, computer viruses, litigation - would have a damaging impact on the business, and how you can ensure that the worst doesn't happen. Time to think about risk management.
WHY BOTHER? A risk is an event that will affect the value of your business. By managing risk, you minimise loss, maximise opportunities, reduce the time wasted on dealing with adverse events and provide a more reliable platform for planning.
IDENTIFY, PRIORITISE. 'The main problem is not being aware of a risk you face,' says Judith Shackleton, technical manager at the Institute of Chartered Accountants' faculty of finance and management. 'Once you know about it, you can do something about it.' Assess what risks you face in the following areas: strategic, operational, financial and environmental; then rank them in importance. In risk-mapping, the probability of the risk is plotted on one axis and its potential impact on the other; the top right-hand corner shows the risks that should have highest priority.
IT AIN'T JUST THE MONEY. 'People tend to think of the impact of risk purely in financial terms, but you also have to think about reputational risk,' says Teresa Graham, head of business services at accountants Baker Tilly. 'Think of what happened to Arthur Andersen, all because it lost credibility.'
TAKE IT OR LEAVE IT. For each risk identified, you must decide on a course of action. You can accept it, transfer it, reduce it or avoid it altogether. Insurance, financial derivatives and outsourcing are all ways of transferring risk; you can reduce or avoid risk by downgrading your exposure or pulling out of a particular market. 'But make sure that the cost of action is not higher than the cost of the risk itself,' advises Shackleton.
LOOK IN THE MIRROR. What is your appetite for risk as a company, bearing in mind that the greater the risk, the greater the reward? If you are a fashion retailer or biotech company, you operate in a high-risk sector, and this should inform your strategy. Compare yourself with other companies in your sector. 'Decisions about which risks are to be self-insured must be made at board level,' says Graham. 'The risk strategy has to come from the top.'
IF YOU ACCEPT A RISK, consider how you'd finance a loss. You could maintain a contingency fund to cover losses. Establish that there is a comfort zone in the business, or a way to raise money to tide you over. Build in controls - eg, credit limits and security procedures - to counter retained risks, and budget for the cost of compliance with employment law and other regulations.
GET AN OUTSIDE VIEW. Risk management can't be outsourced, but there is always a danger of not seeing the wood for the trees. 'At the very least, use somebody independent like a non-exec or a mentor to bounce your conclusions off,' says Graham.
KEEP UP TO DATE. 'Risk management isn't something you can do once and put away in a drawer,' says Shackleton. 'It needs to be updated and communicated to all those who need to know.'
REMEMBER THE UPSIDE. Risk isn't all about loss. An event that would significantly benefit your business is also a risk - the risk is of lost opportunity.
DO SAY: 'We have carried out an in-depth risk analysis, insured against the biggest potential losses and introduced a system of controls to minimise the impact of other adverse events.'
DON'T SAY: 'Que sera, sera.'