Thomas M. Bragg on Business Risk Management

In Part I of this series, I described the outcomes of risk evaluation. (It got a little long. Sorry.) In this post, let’s start digging into the individual steps.

.

What’s Involved in Evaluation?

Evaluating your identified risks involves 4 different activities. As you will see, it’s a lot easier to do the evaluation if you are working in a spreadsheet or some other computer based application. Here are the four steps, in order:

1. Estimating the probability of the risk occurring
2. Estimating the potential impact if the risk does occur
3. Calculating the “probable impact” of the risk
4. Evaluating your business’ sensitivity to the risk

.

Estimating Probability

The first step of risk evaluation is by far the most subjective. What we’re doing here is trying to estimate the likelihood that the risk will occur. You can do this in terms of percentages (”I think there is a 75% chance that material cost will be $10 per unit greater than planned”) or you can do it using buckets like ‘High’, ‘Medium’, and ‘Low’ and then assign a percentage to each bucket (e.g. High = 75%, Medium = 50% and Low = 25%) later. We will need the percentage values for the calculation step. Don’t worry about having a lot of probability buckets. Three will cover it for you. If you simply can’t live with three, please don’t exceed five buckets. And keep an odd number so you have a bucket in the middle to represent ‘50-50′.

.

WARNING: Some people (like us engineering types) will be tempted to try to achieve precision by using values like 74% or 87%. Don’t do it. Keep the probability values simple. If any of the last digits in your probabilities are anything other than a 0 or 5, you’re fooling yourself (and nobody else).

.

Estimating Potential Impact

This step estimates what the impact would be on your business if the risk occurs. Impact can be measured in different ways – sales, profit, cash flow, etc. but it should be in terms of your business’ currency – dollars, pounds, euros. In my opinion, the best measure is in terms of cash flow at some point in time because cash flow makes or breaks businesses. Using the example from above, the potential impact of material cost that is $10 per unit higher than planned will reduce cash on-hand at the end of the year by $20,000.

.

It is great if you can evaluate the potential impact using financial models that generate impact values, but models are not necessary. You can also use buckets in the same way you used them for probabilities. I recommend using five to seven buckets. Assign a value to each bucket. For the purposes of prioritizing risks, the magnitude of the value isn’t critical and can even range from 0 to 1 if you want. (Example: Low = 0.1, Med Low = 0.3, Med = 0.5, Med High = 0.7, High = 0.9) Note that if you use buckets it won’t be possible to estimate contingency funding or perform a sensitivity analysis.

.

WARNING, again: Please remember that these numbers are estimates. Precision is not necessary. Round your potential impact values to the nearest thousand or hundred.

.

If you’re using a spreadsheet for your risk inventory, you’ve now got at least three columns – the risk, its probability and its potential impact. Next time we’ll talk about calculating the probable impact and analyzing sensitivity.

.

Are you still with me? I know a lot of people are intimidated by math and the word “analysis”. Don’t freak out about this. It’s not a high stress situation. Can you see the potential uses of the evaluation data? How would you use the information in your business?

.