Let’s drill down a bit into risk evaluation – step 2 in the risk management process. It’s standard practice to evaluate a risk or opportunity’s impact and rank it. You can rank the impact on a scale of 1 to 5, with 5 being the highest impact. Or you can rank the impact “high”, “medium”, or “low”. Or if you’re utilizing financial models you can calculate the risk’s impact and represent it in terms of your local currency.
Seems very straight forward, right? It is, but let’s take a step back and ask “Impact on what?” Risks and opportunities can impact your business in multiple ways, right? They can impact:
- Revenue (sales or money coming in)
- Expenses (costs or money going out)
- Profits (the net difference of money coming in and money going out)
- Cash flow (cash on hand or the rate of cash accumulation)
- Quality (tangible product quality and customer-perceived service quality)
- Schedule (progress towards a milestone date)
Sidebar: I know that there are other types of risk impacts that could be added to the list – IT/data security, regulatory, reputation, etc. – but in my opinion all of them should boil down to one or more of the six impacts above.
In order to properly rank and prioritize the risks and opportunities, they should all be evaluated with respect to a single impact so they can be directly compared to each other. Does that make sense? Let me give you a quick example:
Fred has evaluated his risk inventory and identified the risk with the biggest impact on quality, the risk with the biggest impact on cash flow and the risk with the biggest impact on schedule. Fred looks at all three and scratches his head. “Which one do I work on first? They are all important.”
Fred’s dilemma was caused by evaluating his risks in terms of multiple impacts. If he had evaluated all of them with respect to only cash flow (or only quality or only schedule), the risks would all be ranked together and he could clearly see which one should be worked on first. Understand?
An interesting point: the ranked order of Fred’s risks if he evaluated them in terms of cash flow would probably be different than if he had evaluated them in terms of quality. Do you see why? It’s important to give some thought to the basis of your evaluation before you start.
So which impact is the right impact to use for risk evaluation?
The real answer is “It depends”, but personally I think 99% of the time the answer should be cash flow. Let me tell you why. First off, in a business setting – and especially in a small business setting – cash is king. Cash flow is the best litmus test for a successful business, even the mega-corporations. That’s because cash flow is a measure of the combined effects of the other five impacts. Businesses with exceptional revenue can easily fail (have you heard of ‘growing yourself out of business’?). Businesses with outstanding cost control and low expenses can fail if they don’t have the necessary revenues. Even businesses with solid profits can fail if the profits are primarily driven by depreciation, amortization, balance sheet transactions or other non-cash accounting treatments. But a business with great cash flow can only succeed. They have more cash coming in than is going out, and that’s the name of the game, folks.
I do have to tell you, there is a downside to evaluating in terms of cash flow. It pretty much requires some sort of financial model. Don’t let that scare you, though. Models don’t have to be complicated. I will be writing about how to set up financial models in a spreadsheet in future posts. You can do it.
So my advice to you is evaluate your risks in terms of cash flow. I know, I know. It will involve a bit more work and judgment on your part, but it is the most direct way to tie your risk management effort to your business success. Remember you’re not doing risk management just to go through the motions. Spend some time and do it right. You won’t regret it. I promise.
How are you doing so far? Still with me? I could use some feedback.