If you’ve been keeping score at home, you know that the risk management process has three basic steps – 1) identify risks and opportunities, 2) evaluate the risks and opportunities and 3) plan for risks and opportunities. However, there is some work that needs to happen before you get into the nuts and bolts of managing your risks.

.

This week let’s talk about what needs to happen before the process begins. There are some basic activities: inspiration, motivation and preparation. Over the last few months I’ve written several posts dealing with the “pre-activities”. Let’s take a look at each of them.

.

(If you want to skip to the end and see the entire list for all 3 steps, check out my page “How to Manage Business Risk”.)

.

5 Reasons You Should Care About Managing Risks

One of my earliest, and most popular posts. I briefly discuss five reasons a business owner should want to learn about and practice business risk management. This post sets the stage for why risk management makes sense for you and your business.

.

I Want to Manage My Risks. Where Do I Start?

In this post, we answer the questions that need to be answered before stepping into ‘risk identification’ – the first step in the risk management process. What is a “Risk”?, Where do risks come from? and How do I find my risks?

.

Fear Not Risk, My Friend. Master It!

This is one of the posts I am most proud of.  It discusses how there must be risk in order for there to be success – and not only in business. I share  some very personal examples with you.

.

Should You Go Formal or Informal?

Processes can be formal or informal. There are times when one type is more appropriate than the other. I write about the differences between formal and informal and how your risk management process should always be formalized.

.

The Value of Risk

Risk can impact a business in many ways but it is often hard to put a hard value on it. This post presents a real-life example where a company made a critical decision that clearly shows how risk can have a very real value, to your business as well as to your customers.

.

Permission to Make Mistakes

A company or organization with a ‘mistake avoidance’ culture is striving to avoid negative events (i.e. mistakes). An organization that strives for perfection but accepts mistakes is working to create positive events. The two groups have very different characteristics that will lead to very different outcomes.

.

10 Steps to a SMB Risk Management Process (guest post for ClearRisk Inc.)

I wrote this post to layout the roadmap for small and medium-sized businesses that are just starting to set up their risk management process. There are some key events that have to happen before you jump into brainstorming about the risks and opportunities facing your business.

.

I hope the posts above provide some useful information, motivation and inspiration for you. I would love to hear your thoughts, comments and suggestions. Please leave comments on this post or on the individual posts above. I read and reply to every one of them.

.

Related articles by Zemanta

• Backstory – Guest Post at ClearRisk.com (thomasmbragg.com)
• 3 Reasons Small Businesses Don’t Manage Risks (thomasmbragg.com)
• How To Manage Small Business Risk (thomasmbragg.com)

www.clearrisk.com

I am honored that Craig and his team at ClearRisk Inc. accepted one of my posts for publication in the ClearRisk blog. The post is titled “10 Steps to a SMB Risk Management Process“.

.

The Post’s Backstory

Over the last week or so, I’ve been contemplating the information I’ve seen on the web about business risk management. I’m pleased about the growing knowledge base that can be specifically applied by small and medium sized businesses. There is a downside, though. Most of the information is in snippets – blog posts of 400 to 800 words and tweets of 140 characters or less.  I could see where the seemingly random collection of information might be confusing or overwhelming for a business trying to figure out how to implement risk management. Thus the “10 Steps…” post.

.

I’m under no illusion that my one little post will provide all that’s needed to successfully implement a risk management process for your business. I do hope, however, that it provides a sort of checklist or roadmap you can use to step down the path without false starts and distractions. I know the list would have helped me when I started my first business.

.

Check Out the Website

If you follow my Twitter @tombragg stream, you will notice a lot of re-tweets of information from Craig. There’s a good reason – he puts out good content. I’d encourage you to follow @ClearRisk if you’re not already. And please take a few minutes to explore the ClearRisk website. It has a huge amount of great information, waiting just for you and that special business owner/manager in your life.

.

Disclaimer: I have no financial interest in ClearRisk. I haven’t received any compensation or freebies from them either. I just like the site and they let me play in their sandbox!

.

I look forward to reading your comments on the guest post. See you there!

.

Related articles by Zemanta

• ClearRisk Helps Regional Insurance Brokerages Compete with Multinationals (prweb.com)
• ClearRisk Levels the Risk Management Playing Field for Mid-Size Companies (prweb.com)
• 3 Reasons Small Businesses Don’t Manage Risks (thomasmbragg.com)
• 39 Examples of Small Business Risks (thomasmbragg.com)

If you’ve been keeping score at home, you’ve noticed that I’ve used the word ‘formal’ quite a bit. In fact, in one poorly worded post I suggested that “the (risk management) process doesn’t have to be formal” and got called to the carpet in a comment by Kristen. She was absolutely correct in stating that the process really does have to be formalized – meaning performed consistently and methodically – but doesn’t have to be complicated, expensive or burdensome (a point I attempted, and failed, to make).

.

That exchange was a good example of how the word ‘formal’ can be misused or at least have different meanings to different people. In my last post about cost benefit analysis, I was again throwing around the f-word (no, not that one…) somewhat carelessly. Let’s take a step back and explore what really characterizes a “formal” process.

.

What’s the Difference Between Formal and Informal?

If you look up the definition of ‘formal’, you will find phrases like “being in accord with established forms and conventions and requirements” and “characterized by strict or meticulous observation of forms; methodical“. These definitions touch on the concept I’m trying to describe, but they’re still too vague for my purposes. So let’s talk about the “tom” definition of formal and informal.

.

When we’re talking about processes, the differences between formal and informal generally can be found in two areas: the extent of the documentation and the consistency of the method. In other words, formal processes or analyses should be performed in a consistent manner (i.e. a standard method on a regular schedule) and captured in writing. A formal process will have a structure and form. It will have a schedule or at least a trigger event. Formal process will happen on a consistent basis.

.

As you would imagine, informal would be the opposite of formal. Informal processes tend to be more ad hoc – maybe an impromptu train of thought in your head or a spur-of-the-moment verbal conversation. Informal process or analysis will lack a pre-defined structure and schedule. It might happen when it’s needed or when somebody happens to think about it. It might not happen.

.

How Do You Know When To Use Formal Process?

There are occasions when the situation simply doesn’t warrant the overhead of a formal process or analysis, but sometimes a formal approach is definitely recommended. A formal approach is particularly helpful when you may need to revisit the rationale behind a particular decision or if you want to communicate the reasoning for a decision to others (think decision justification or training purposes). A formal process is also necessary when you have a task that needs to be performed consistently in method and schedule.

.

Many times you may have both a “formal” and “informal” version of the same process. Cost benefit analysis (CBA) is a perfect example. A formal cost benefit analysis will be triggered by a specific event or criteria. It will involve documentation of the facts (costs, benefits, assumptions) and the conclusion. An informal cost benefit analysis will probably be done in your head. Both are valid approaches as long as they are applied in the appropriate circumstances. You probably won’t want to use a formal CBA for deciding between a Big Mac and a McChicken sandwich at the local McDonalds. However, a formal CBA will be very justified if you are thinking about buying a $250,000 piece of equipment.

.

Risk management is one of those processes that always warrants the use of formal process. Financial record-keeping is another one. While it’s important to know the distiction between formal and informal process, it’s much more important to know when to select the right type of approach.

.

One closing thought… Don’t get caught in the trap of thinking that ‘formal’ equals ‘expensive’ or ‘complicated’. That is a complete myth. Formal processes can be very simple and cost effective. If you don’t believe me, watch what’s going on behind the counter at your local McDonalds. Their process is extraordinarily formal, but you can bet it’s optimized for cost and simplicity.

.

For some reason I have a craving for fast food so let’s wrap this up. What are your thoughts on formal vs. informal? What are your concerns? Leave me a comment and let’s talk about it.

Here’s a Quiz For You

What do these decisions have in common?

• Is it wise for me to invest in new equipment for my business?
• Should I respond to the irate customer’s email or just let it go?
• Is the best route turning left, turning right or going straight?
• Should I have beef or chicken for dinner tonight?
• Should I wear the blue shirt or the green shirt today?

.

Give up?

.

The answer is that each decision’s solution will be based on the costs and benefits as perceived by the decisionmaker. The decision will be driven by a cost benefit analysis.

.

(OK. I’ll come clean. It’s a trick question. Why? Because the solution to every decision is based on a cost benefit analysis.)

.

What is Cost Benefit Analysis?

Simply put, cost benefit analysis is evaluating the costs required to carry out a particular decision with respect to the benefits derived from that decision. It’s not a difficult concept. (But as with all simple concepts we can apply great complexity, so if you’re interested in the complex description, check out the Wikipedia page here.)

.

Cost benefit analysis consists of three simple steps:

1. Calculate the expected costs over some time frame
2. Calculate the expected benefits over the same time frame
3. Compare them to each other

.

Obviously the great majority of decisions are made using a unconscious cost benefit analysis, but there are times when consciously evaluating the costs and benefits may be helpful. One of those times is when you are planning how to mitigate your risks and exploit your opportunities.

.

Cost Benefit Analysis and Risk Management Connected How?

Cost benefit analysis (CBA) is a great tool for evaluating mitigation alternatives during step three of the risk management process – plan for your risks. We’ve all heard the saying “There’s more than one way to skin a cat.” It was uttered by a very wise, albeit somewhat troubled (or very hungry) individual. There are always alternatives. There are always decisions to be made. Cost benefit analysis provides the method for making the best decision.

.

Tips for Effective CBA

Analyzing costs and benefits is not difficult. In fact we all do it many times each day. There is a key to doing “effective” CBA, however – considering the “hidden” costs and benefits. Let’s look at a simple example…

Fred (of Fred’s Coffee Shop, introduced here) has identified fire risk as a key risk for his business. Working with his insurance broker, Fred has identified several different alternatives that will reduce his risk. A key part of every solution is insurance, but he could also purchase extra fire extinguishers, install a monitored fire detection system or install a sprinkler system. Fred recognizes that each alternative has a very obvious cost - installation cost. But Fred also realizes that there are hidden costs and benefits involved.

.

Fred learned from his insurance broker that each of his alternatives will have some ongoing expenses. The fire extinguishers will require employee training and need to be inspected every year. The monitoring system will have a monthly service charge. Even the sprinkler system will require regular inspections and testing. Fred makes a point to capture the hidden costs.

.

Fred’s insurance broker also told him that the insurance company will give Fred a discount on the insurance premium if he installs a fire detection system and an even bigger discount if he installs sprinklers. Fred adds these discounts to the “benefits” list so he can have a true picture of his net cost for each alternative. 

In the example Fred could have done the cost benefit analysis and made a decision without the hidden costs and benefits information, but the decision may not have been the best solution. Some of the hidden costs and benefits could be substantial.

.

It’s also important to remember to include qualitative costs and benefits in your analysis. Your alternative might have benefits like increasing employee morale or just plain making you more comfortable. Don’t forget to include that information in the analysis – it’s important.

.

Do you see how including hidden and qualitative costs and benefits could make an apparently obvious decision not so obvious?

.

We all do cost benefit analysis every day of our lives. It is an extremely effective way to make a good decision IF all of the costs and benefits are included in the analysis. Keep the formal CBA in your risk management toolbox. Once you start using it and getting comfortable with it, you’ll find that you come back to the technique over and over again.

.

How are you doing? Starting to get the idea about how to manage risk in your small business? Give me an example of when you’ve consciously done a cost benefit analysis. It doesn’t have to be business related. Feedback, please!

.

p.s. Check out the complete listing of “How To Manage Business Risk” for small business risk management tips, tricks and details.

Let’s drill down a bit into risk evaluation – step 2 in the risk management process. It’s standard practice to evaluate a risk or opportunity’s impact and rank it. You can rank the impact on a scale of 1 to 5, with 5 being the highest impact. Or you can rank the impact “high”, “medium”, or “low”. Or if you’re utilizing financial models you can calculate the risk’s impact and represent it in terms of your local currency.

.

Seems very straight forward, right? It is, but let’s take a step back and ask “Impact on what?” Risks and opportunities can impact your business in multiple ways, right? They can impact:

• Revenue (sales or money coming in)
• Expenses (costs or money going out)
• Profits (the net difference of money coming in and money going out)
• Cash flow (cash on hand or the rate of cash accumulation)
• Quality (tangible product quality and customer-perceived service quality)
• Schedule (progress towards a milestone date)

.

Sidebar: I know that there are other types of risk impacts that could be added to the list – IT/data security, regulatory, reputation, etc. – but in my opinion all of them should boil down to one or more of the six impacts above.

.

In order to properly rank and prioritize the risks and opportunities, they should all be evaluated with respect to a single impact so they can be directly compared to each other. Does that make sense? Let me give you a quick example:

Fred has evaluated his risk inventory and identified the risk with the biggest impact on quality, the risk with the biggest impact on cash flow and the risk with the biggest impact on schedule. Fred looks at all three and scratches his head. “Which one do I work on first? They are all important.”

Fred’s dilemma was caused by evaluating his risks in terms of multiple impacts. If he had evaluated all of them with respect to only cash flow (or only quality or only schedule), the risks would all be ranked together and he could clearly see which one should be worked on first. Understand?

.

An interesting point: the ranked order of Fred’s risks if he evaluated them in terms of cash flow would probably be different than if he had evaluated them in terms of quality. Do you see why? It’s important to give some thought to the basis of your evaluation before you start.

.

So which impact is the right impact to use for risk evaluation?

.

The real answer is “It depends”, but personally I think 99% of the time the answer should be cash flow. Let me tell you why. First off, in a business setting – and especially in a small business setting – cash is king. Cash flow is the best litmus test for a successful business, even the mega-corporations. That’s because cash flow is a measure of the combined effects of the other five impacts. Businesses with exceptional revenue can easily fail (have you heard of ‘growing yourself out of business’?). Businesses with outstanding cost control and low expenses can fail if they don’t have the necessary revenues. Even businesses with solid profits can fail if the profits are primarily driven by depreciation, amortization, balance sheet transactions or other non-cash accounting treatments. But a business with great cash flow can only succeed. They have more cash coming in than is going out, and that’s the name of the game, folks.

.

I do have to tell you, there is a downside to evaluating in terms of cash flow. It pretty much requires some sort of financial model. Don’t let that scare you, though. Models don’t have to be complicated. I will be writing about how to set up financial models in a spreadsheet in future posts. You can do it.

.

So my advice to you is evaluate your risks in terms of cash flow. I know, I know. It will involve a bit more work and judgment on your part, but it is the most direct way to tie your risk management effort to your business success. Remember you’re not doing risk management just to go through the motions. Spend some time and do it right. You won’t regret it. I promise.

.

How are you doing so far? Still with me? I could use some feedback.

Over the last couple of months, I’ve walked through the process for small business risk management with you. I thought it would be a good idea to capture all of the “how to” posts in one place.

.

Take a look at the compilation. My hope is that after reading all the posts below you have a general understanding of how to manage risks and opportunities for your small business. More importantly, I hope you see the benefit of incorporating formalized risk management into your daily business life.

.

Introduction & (hopefully) Motivation

5 Reasons You Should Care About Managing Risks

I Want to Manage My Risks. Where Do I Start?

.

Step 1: Identify Risks

3 Categories of Risks

Easy Money! Manage Your Opportunities

The 5 Coulds Technique

.

Step 2: Evaluate Risks

Evaluate Your Risks, Part I – Why?

Evaluate Your Risks, Part II – The First 2 Steps

Evaluate Your Risks, Part III – The Last 2 Steps

The Miracle of the 80-20 Rule

.

Step 3: Plan for Risks

Mitigate Risks, Exploit Opportunities!

.

I know, risk management sounds scary. Hopefully, what you read in the posts above helps make it less scary. As we continue our discussions you will see that there’s nothing to be afraid of. In reality, you’re already doing it every day – you just don’t realize it.

.

Remember, risk management is only two things: working to avoid or minimize the bad things that could happen to your business and working to take advantage of the potential good things.

.

Can you think of any management activity that isn’t driven by a risk or opportunity? I can’t.

.

How do you feel about the process? What is your impression about what I’ve written – too simplistic? too complex? unclear? How am I doing for you? Let me know.

It’s been a while… Let’s get back to basics of the risk management process.

.

We’ve covered the first two steps – identifying risks and evaluating them. You now have a great list of your risks and opportunities, in order of their potential impact on your business, but your work isn’t done yet. Having the list helps you anticipate which risk may have the biggest impact on your business, but if the risk becomes reality you will still be reacting to it during a potentially stressful situation.

 .

Since clear, thoughtful thinking is difficult during a crisis, let’s do some thinking now about what we would do. This exercise is called risk mitigation planning. Believe it or not, this is the fun part of risk management.

 .

Risks can be mitigated (i.e. made less severe or alleviated) in several different ways. You can mitigate risk by:

1. Avoiding it in the first place (the obvious preference)
2. Reducing the risk’s impact when it occurs
3. Transferring the risk and its impact to somebody else (e.g. through the use of insurance, warranties, etc.).

 .

For each risk, write down what steps you will take to mitigate that particular risk. How will you recognize the risk becoming reality (is there a measurement you can use)? At what point will you take mitigating action? What actions will you take? How will you know when you have succeeded? The mitigation plan is where you will realize the greatest value of your risk management efforts. You are now prepared for the most important risks to your business and have a plan for dealing with them if and when they occur.

.

I think there is a tendency to over think risk mitigation sometimes or at least make the planned mitigation more complex than it needs to be. Don’t fall in to the trap of making your plan overly complicated. Many times employee awareness or training will be just as effective as some fancy software – and a whole lot cheaper!

.

Let’s talk about how mitigation planning works for opportunities. During the sensitivity analysis, you created a rank order list of opportunities. Now is the time to plan on how you can realize some of those opportunities and reap their benefits. Write down the steps you will take to make the opportunities realities. What actions will you take? How will you know when you’ve succeeded?

. 

Opportunities are exciting! Planning for opportunities is fun! Now you can have some fun and transform the opportunities into results. Effectively executing your plans for your opportunities many times will offset the cost of the risk managment process or even pay for it completely. Don’t pass up the opportunity (pun intended )!

.

Robert F. Kennedy once wrote: “Only those who dare to fail greatly can ever achieve greatly.” Dare to manage your risks. I’ve got your back - so don’t worry about failing greatly - let’s achieve greatly. OK? Thoughts?

Let’s take a step back for a minute. Step one of the risk management process is “Identify your risks”. Three little words so it must be pretty easy, right? Not really.

.

A risk management plan is only as good as the risks you identify. They need to be specific. They need to be the ‘root risks’ or the root causes of those potential hazards (or opportunities, remember) facing your business. As you start drilling down into all of your assumptions you’ll find that it is hard to get deep enough. It’s hard to go far enough down into the details without getting derailed on meaningless tangents.

.

To help out the process, I’ve developed a technique I call the “5 Coulds”. I can’t claim this technique as original work. It’s based on a root cause analysis technique called the “5 Whys” that is used in process improvement and the Toyota Production System.

.

Here’s how the 5 Coulds technique works. Start with an assumption you have made about your business. For our example, let’s use the assumption that we will hit our budgeted sales levels. Obviously there are a lot of different risks that could cause us to miss our budget. Now start asking the question “What could cause..?” and keep going until you get to an answer that is beyond your control. In my experience, five levels will usually suffice – sometimes less, sometimes more.

.

Here’s a simple example for finding a ‘root risk’:

Assumption: We will hit budgeted sales
1) What could cause falling short on budgeted sales – a loss of customers
2) What could cause loss of customers – a lower priced alternative is available
3) What could cause lower priced alternative – a lack of perceived value of our product by customers
4) What could cause lack of perceived value – poor product packaging
5) What could cause poor packaging – lack of good taste

If we took the questioning down one more level – What could cause a lack of good taste? – you find that the answer is beyond your control, right? Taste either exists or it doesn’t. So the lack of taste is the “root risk”. It is very specific and it’s actionable. If you need to address the risk you can hire someone – with good taste – to design your packaging. Very specific risks generally present very obvious options for how to avoid or minimize their consequences.

.

Even better, very specific opportunities generally present very obvious options for how to exploit them. You can use the same technique by just tweaking the questions. For our example, change question 1) to “What could cause exceeding our budgeted sales?”.

.

As you use the technique, you’ll find that each questioning level may have multiple answers leading to other potential risks for a single assumption. That’s ok. You’ll also find that some assumptions will share root risks. That’s ok, too. If you did the technique graphically – like on a whiteboard - you’ll see that the end result looks like a tree structure with multiple branches coming off of each assumption. (The technique can also be done with word processing software – contact me for details.)

.

The 5 Coulds technique is pretty informal, but I find it to be effective and simple…and that’s the goal for an ideal business risk management process, right? I’m sure there are other methods out there, but I haven’t been exposed to them.

.

What techniques do you use for identifying specific risks? Please share.

.

P.S. Take a look at the De-Risk blog post Extreme Risk Management – Mountaineers and Project Management for a story about how keeping risks specific applies to climbing a mountain, too.

.

P.S.S. I’m putting together a step-by-step example of creating a risk management plan – from brainstorming risks all the way through planning for them. I haven’t quite decided how to best present the results, but I’ll get it out to you somehow.

In our last conversation about risk management how-to’s, we finished up the discussion on evaluating risks. If you are able to utilize some sort of financial model to estimate risk impacts during your evaluation, you now have a rather lengthy list of risks with their probable impacts. That list can now be sorted.

.

How you sort the data depends on your desired approach. You can sort the data in order of probable impact. (This sort order will put the risks with the greatest potential impact to your business at the top of the list.) Or you can sort the data in order of probability of occurrence. (This sort order will put the risks that are most likely to occur at the top of the list.) Each sort order has its benefits. Personally, I look at the data in both ways. I obviously want to deal with the biggest impact risks. But I also want to deal with the most probable risks. Call it selfish, but I like the idea of reducing my future stress levels by eliminating the most probable risks.

.

So we’ve got a sorted list of risks. It’s probably somewhat overwhelming. There is no way you can deal with all of them. Where do you start? Which risks do you work on and which do you leave alone? That’s where the 80-20 rule comes in…

.

The 80-20 Rule (aka Pareto Principle) is nothing short of amazing. It says that 80% of the effects come from 20% of the causes. The 80-20 rule applies in many places, but let’s talk about how it can help you out with your risk management.

.

Look at your risk inventory, sorted in order of impact. Count the total number of risks. Now take 20% of the total number. Add up the probable impact of those top 20% of risks and you’ll see that it accounts for about 80% of the total probable impact. Think about that for a minute…. You can address 80% of your total risk exposure by working on 20% of the risks facing your company. How cool is that? If you have 50 risks identified, you can address 10 of them and cover the lion’s share of your risk exposure. Now it’s not so overwhelming, eh?

.

So now we have a manageable number of risks to think about and plan for. That leads us into the final step of risk management – planning for your risks. That will be my topic for the next how-to posts.

.

Coming up

So far, I’ve done a lot of writing about how to do practical business risk management. That’s all fine and good, but I know it’s difficult to apply how-to text to real life. Over the next few weeks, I’m going to introduce you to Fred. Fred owns his own coffee shop and actively manages his risks. I’ll share some of Fred’s experiences with you and show you his risk management spreadsheet. I think the example will be helpful in seeing how all this information I’m spewing at you can be applied in your business.

.

Also in the works… I think it would a glossary of terms might be helpful. I use a lot of terms that can be confusing. Plus some of my terms are “tom terms” – a little different than the industry standard, but easier to understand (in my humble opinion). The glossary will be a living page on the blog. Stay tuned…

.

What else would you like to see from me? Is there different content or more of a certain category that you want to see? What can I do to help? I’m happy to accommodate. Let me know your opinion.

.

Disclosure: I now have a disclosure page. Click here or click the “Disclosure” tab at the top left of the page to read my full disclosure that I really have nothing to disclose.

First off, let me apologize for the inconsistent posting lately. The holiday and vacation really hosed up my editorial calendar…
.
So let’s get back to evaluating risks. In the last post, I introduced you to the first two steps in risk evaluation: estimating probability and estimating potential impact. The last two steps are calculating probable impact and testing sensitivity.

.

NOTE: These evaluation steps only apply if you estimated potential impact in terms of currency (e.g. dollars, pounds, yen). If you used buckets for potential impact, these steps don’t have any meaning…

.

Calculating Probable Impact

Do you remember how I described probable impact? (Here’s the original post.) The probable impact calculation is a way to mathematically calculate an amount to set aside to cover an uncertain event. (Richard Worzel describes it as “expected cost”.) The calculation is super easy – just multiply each risk’s estimated probability by its estimated potential impact.

EXAMPLE:

Joe has identified a risk that a competitor might open up a Starbucks just down the street from his coffee shop. Joe has estimated that the probability of the risk occurring is 50% and, if it does occur, his cash flow will be reduced $100,000. The calculated probable impact of the risk is then $50,000 or 50% x $100,000. Joe decides to set aside $50,000 in a savings account as contingency funding to cover the risk’s impact.

.

Make sense? OK, let’s move on to sensitivity analysis…

.

Sensitivity Analysis

In order to perform a sensitivity analysis, it is necessary to have some type of financial model where you can input different assumptions and evaluate the resulting impact. When I do a business plan or forecast, I set up a spreadsheet. The spreadsheet has a list of assumptions (e.g. # of units sold, average price, average cost, assumed overhead cost components, etc.) and uses formulas to calculate the revenue, profit and cash flow for each month. The model then allows me to do “what if” scenarios.

.

“So why do I want to do a sensitivity analysis?”, you might ask. Well, there a couple of reasons. First off, your estimated potential impact and estimated probability are just that – estimates. If you can evaluate a a range of potential impacts or probabilities for each risk, you can determine a range of contingency funding necessary to cover your risks to the level appropriate to your risk tolerance. Another reason for doing sensitivity analysis is that it provides insight into how your business runs. As you cycle through checking the sensitivity of each of your risks, you’ll find that your business is more sensitive to some than others. Here’s why… some risks impact your business in multiple ways so there is a compounding effect.

.

EXAMPLE:

Fred  has identified two risks for his retail business: a risk that a competitor opens down the street and takes away some of his customers and a risk of stocking poor quality merchandise. The potential impact of a new competitor is pretty straight forward – his daily customer count decreases, reducing his average daily sales and cash flow. The potential impact of poor quality merchandise affects his business in multiple ways. First Fred has to deal with the expense of product returns. Then there is the additional inventory cost to purchase additional product to cover the rejected items. There is also additional labor cost associated with doing a closer inspection of new product received from his distributor before he puts it on the shelf. And probably most importantly, there is the reputation cost of each dissatisfied customer telling ten of their friends about their poor experience.

.

Do you see how the compounding effect works and how some risks can have more impact on your business than others? So here’s how you perform sensitivity analysis. First, for each potential impact (or probability, if you prefer), estimate a range instead of a single value (e.g. Instead of using $100,000 as a potential impact, use $85,000 to $100,000). Calculate a probable impact (probability multiplied by potential impact, remember) for each extreme of the range. Look at the difference between the two values. You will see that some risks have large differences and some have smaller differences. If there is a large difference, that indicates that your business is particularly sensitive to the assumed impact (or probability) and it will be worthwhile to pay a little more attention to that particular risk.

.

WARNING: When doing a sensitivity analysis, create a range for each estimated probability or each potential impact, but not both.

.

As I wrote in Part I of this series, sensitivity analysis is an advanced method. It isn’t required to have a solid risk management program. Sensitivity analysis provides a way to fine tune your understanding – and management – of your business.

.

That’s it, the four steps of risk evaluation. Does it make sense? Do you see how calculating probable impact can help you determine a level of contingency funding and insurance necessary to cover your risks? Do you see how sensitivity analysis might cause you to manage your business differently? What’s your opinion about the usefulness of risk evaluation?