Thomas M. Bragg on Business Risk Management

First off, let me apologize for the inconsistent posting lately. The holiday and vacation really hosed up my editorial calendar…
.
So let’s get back to evaluating risks. In the last post, I introduced you to the first two steps in risk evaluation: estimating probability and estimating potential impact. The last two steps are calculating probable impact and testing sensitivity.

.

NOTE: These evaluation steps only apply if you estimated potential impact in terms of currency (e.g. dollars, pounds, yen). If you used buckets for potential impact, these steps don’t have any meaning…

.

Calculating Probable Impact

Do you remember how I described probable impact? (Here’s the original post.) The probable impact calculation is a way to mathematically calculate an amount to set aside to cover an uncertain event. (Richard Worzel describes it as “expected cost”.) The calculation is super easy – just multiply each risk’s estimated probability by its estimated potential impact.

EXAMPLE:

Joe has identified a risk that a competitor might open up a Starbucks just down the street from his coffee shop. Joe has estimated that the probability of the risk occurring is 50% and, if it does occur, his cash flow will be reduced $100,000. The calculated probable impact of the risk is then $50,000 or 50% x $100,000. Joe decides to set aside $50,000 in a savings account as contingency funding to cover the risk’s impact.

.

Make sense? OK, let’s move on to sensitivity analysis…

.

Sensitivity Analysis

In order to perform a sensitivity analysis, it is necessary to have some type of financial model where you can input different assumptions and evaluate the resulting impact. When I do a business plan or forecast, I set up a spreadsheet. The spreadsheet has a list of assumptions (e.g. # of units sold, average price, average cost, assumed overhead cost components, etc.) and uses formulas to calculate the revenue, profit and cash flow for each month. The model then allows me to do “what if” scenarios.

.

“So why do I want to do a sensitivity analysis?”, you might ask. Well, there a couple of reasons. First off, your estimated potential impact and estimated probability are just that – estimates. If you can evaluate a a range of potential impacts or probabilities for each risk, you can determine a range of contingency funding necessary to cover your risks to the level appropriate to your risk tolerance. Another reason for doing sensitivity analysis is that it provides insight into how your business runs. As you cycle through checking the sensitivity of each of your risks, you’ll find that your business is more sensitive to some than others. Here’s why… some risks impact your business in multiple ways so there is a compounding effect.

.

EXAMPLE:

Fred  has identified two risks for his retail business: a risk that a competitor opens down the street and takes away some of his customers and a risk of stocking poor quality merchandise. The potential impact of a new competitor is pretty straight forward – his daily customer count decreases, reducing his average daily sales and cash flow. The potential impact of poor quality merchandise affects his business in multiple ways. First Fred has to deal with the expense of product returns. Then there is the additional inventory cost to purchase additional product to cover the rejected items. There is also additional labor cost associated with doing a closer inspection of new product received from his distributor before he puts it on the shelf. And probably most importantly, there is the reputation cost of each dissatisfied customer telling ten of their friends about their poor experience.

.

Do you see how the compounding effect works and how some risks can have more impact on your business than others? So here’s how you perform sensitivity analysis. First, for each potential impact (or probability, if you prefer), estimate a range instead of a single value (e.g. Instead of using $100,000 as a potential impact, use $85,000 to $100,000). Calculate a probable impact (probability multiplied by potential impact, remember) for each extreme of the range. Look at the difference between the two values. You will see that some risks have large differences and some have smaller differences. If there is a large difference, that indicates that your business is particularly sensitive to the assumed impact (or probability) and it will be worthwhile to pay a little more attention to that particular risk.

.

WARNING: When doing a sensitivity analysis, create a range for each estimated probability or each potential impact, but not both.

.

As I wrote in Part I of this series, sensitivity analysis is an advanced method. It isn’t required to have a solid risk management program. Sensitivity analysis provides a way to fine tune your understanding – and management – of your business.

.

That’s it, the four steps of risk evaluation. Does it make sense? Do you see how calculating probable impact can help you determine a level of contingency funding and insurance necessary to cover your risks? Do you see how sensitivity analysis might cause you to manage your business differently? What’s your opinion about the usefulness of risk evaluation?