In my opinion, few business people recognize that risk has a very real (and substantial) value. The lack of recognition is understandable – it’s hard to put a convincing numerical value on a risk that may or may not occur. But every now and then, an event comes along that provides a quantified glimpse of risk’s value. I was a witness to one of those rare events. Here’s the story…

.

A high tech manufacturing company, let’s call them “WidgetCo”, won a very large and very challenging contract for a new product. Life was good at WidgetCo. Unfortunately, it didn’t take long for WidgetCo’s product development to fall significantly behind schedule and exceed budget. WidgetCo’s  management decided that they needed to outsource part of the development effort to an outside company.

.

WidgetCo put together a very attractive bid package. Many companies submitted aggressive bids in an attempt to win the business. As WidgetCo reviewed the proposals, they soon realized that some of the companies did not fully understand the scope of the project or just plain low-balled the estimate in an attempt to win the business. The company whose proposal was most complete and demonstrated a full understanding of the task at hand was also the most expensive – more than 20% higher than the next lower bid. WidgetCo management had a problem.

.

So how does the story end? After much thought and discussion, WidgetCo selected the most expensive proposal. Why? Because they saw that proposal as the lowest risk solution to their problem. WidgetCo paid a 20% premium to reduce their perceived risk. They valued that risk to be worth more than $2,000,000.

.

Does that result surprise you? I’ll be the first to admit that it’s unusual in today’s short-sighted, manage-for-quarterly-results business environment. But if you can put aside the pleasant novelty of the management decision, it is a great example of risk’s value. (It’s also a great example of risk awareness playing a big role in a major business decision.)

.

My story deals with the value assigned to risk by a corporate customer, but the same principle applies to individual customers like you and me. Think about people that buy Volvos. What about people that buy Macs? Both groups are at least somewhat concerned about risk (personal risk and malware risk) and are willing to pay a premium to minimize that risk. There are lots of examples of products marketed as ‘lower risk’. There are lots of people who gladly pay more to buy those products.

.

So let’s accept that there is significant value associated with the risks perceived by your external customer (i.e. external stakeholder). Doesn’t it stand to reason that there is significant value associated with risks perceived by your internal stakeholders – the risks faced by your business? Don’t you think it’s about time you start managing that value?

.

OK, I know what you’re thinking… “Great, Tom. My risks have value. But how do I figure out what that value is?” Funny you should ask. You can check out these posts for evaluation methods that you can use to quantify the value of your risks:

• Evaluate Your Risks, Part I – Why?
• Evaluate Your Risks, Part II – The First 2 Steps
• Risk’s Impact on What?
• Evaluate Your Risks, Part III – The Last 2 Steps
• The Miracle of the 80-20 Rule

.

I would love to hear some of your stories about value being assigned to risk. Leave me some comments and let’s talk about them.

.

I’ve put together a compilation of how-to posts to help guide you through the risk management process (“How To Manage Risk”) . Check it out!

It’s been difficult to come up with topics this week.  The situation in Haiti seems to consume the majority of my thoughts when I’m outside the office. Make a difference. Please donate cash to the relief agency of your choice.

.

I thought I’d take a look at my Google Analytics page and see what people are searching for when they find my website. There is a definite trend. Many of the searches involve the word “example” or are geared toward identifying potential risks for businesses. Let’s talk about that…

.

Businesses face many types of risks. Some of those risks can be managed with insurance. I’m not going to address those here, but I’ll point you to a great site with tons of free information. Check out www.ClearRisk.com for a comprehensive list of business risks that can be managed by insurance. I would also strongly recommend that you download and read their free e-book. It’s an easy read and provides a great education on insurance for small and medium businesses. (Disclaimer: My recommendation is not sponsored and I’m not being paid in any way. In fact, Craig Rowe and the ClearRisk team don’t even know I’m doing it.)

.

So let’s talk about the risks you can’t buy insurance for. Obviously every business is going to have risks that are unique to that business, but they will always fall into three broad categories – budget risk, quality risk and schedule risk. (Check out my post here for details.) Starting with those categories, you can drill down by using the “5 Coulds Technique” (detailed here).

.

As you do the brainstorming, you’ll find that you come up with a wide range of risks. Here are just a few that come to mind as I’m writing. I’m in a manufacturing and retail mindset this morning so the risks are geared to those kinds of businesses, but many of them apply to service businesses, too. Some risks are repeated in multiple categories purposely.

.

Make sure you read the IMPORTANT NOTE at the bottom of the post!

.

Employee Related Risks

• Theft
• Departure of a key employee
• Lack of training
• High turnover
• Sabotage/intentional misbehavior
• Employee disputes
• Poor customer service

.

Revenue Related Risks

• Competitor enters market
• Market size shrinks (local population shrinks, demographics change)
• Economic pressure (reduces money available to be spent on your product)
• Substitute product becomes available
• Customer access disrupted (e.g. road construction in front of your business)
• Pricing doesn’t match value perceived by customers

.

Expense Related Risks

• Material costs increase
• High rework expense
• High warranty expense
• Loss of key supplier
• Increased wage expense (tight labor market)
• Increased benefit costs
• Loss of lease/increased rent
• Increased utility rates
• Increased bank charges (interest rates, credit card fees)

.

Quality Related Risks

• Poor production process
• High rework expense
• High warranty expense
• Poor customer service
• Low quality materials
• Poor employee morale
• Inadequate equipment/tools
• Poor/unattractive packaging
• Equipment/tool breakdown

.

Schedule Related Risks

• Customers are slow paying
• Unfavorable terms from suppliers (e.g. cash in advance)
• Late delivery of materials
• Lost/misdirected shipments of your product
• Slow response of bank, government agency (e.g. loan proceeds, permits, etc.)
• Delayed construction/remodel
• Slow response to marketing campaign
• Equipment/tool breakdown (e.g. internet down, computer virus)

.

Are you getting the idea? This list just scratches the surface. Your business will have many more risks that are unique to your situation.

.

IMPORTANT NOTE: I’ve focused the examples above on risks, but don’t forget about your opportunities. Many of the risks listed above will have corresponding opportunities you can exploit. For example: The risk “Customers are slow paying” has an opportunity “Customers pay quicker than expected”. Don’t get caught in the trap of focusing only on the negative. Identifying and exploiting opportunities can pay for your risk management program. Check out this post for more info.

.

Please share some examples of risks facing your business. Leave a comment.

Let’s take a step back for a minute. Step one of the risk management process is “Identify your risks”. Three little words so it must be pretty easy, right? Not really.

.

A risk management plan is only as good as the risks you identify. They need to be specific. They need to be the ‘root risks’ or the root causes of those potential hazards (or opportunities, remember) facing your business. As you start drilling down into all of your assumptions you’ll find that it is hard to get deep enough. It’s hard to go far enough down into the details without getting derailed on meaningless tangents.

.

To help out the process, I’ve developed a technique I call the “5 Coulds”. I can’t claim this technique as original work. It’s based on a root cause analysis technique called the “5 Whys” that is used in process improvement and the Toyota Production System.

.

Here’s how the 5 Coulds technique works. Start with an assumption you have made about your business. For our example, let’s use the assumption that we will hit our budgeted sales levels. Obviously there are a lot of different risks that could cause us to miss our budget. Now start asking the question “What could cause..?” and keep going until you get to an answer that is beyond your control. In my experience, five levels will usually suffice – sometimes less, sometimes more.

.

Here’s a simple example for finding a ‘root risk’:

Assumption: We will hit budgeted sales
1) What could cause falling short on budgeted sales – a loss of customers
2) What could cause loss of customers – a lower priced alternative is available
3) What could cause lower priced alternative – a lack of perceived value of our product by customers
4) What could cause lack of perceived value – poor product packaging
5) What could cause poor packaging – lack of good taste

If we took the questioning down one more level – What could cause a lack of good taste? – you find that the answer is beyond your control, right? Taste either exists or it doesn’t. So the lack of taste is the “root risk”. It is very specific and it’s actionable. If you need to address the risk you can hire someone – with good taste – to design your packaging. Very specific risks generally present very obvious options for how to avoid or minimize their consequences.

.

Even better, very specific opportunities generally present very obvious options for how to exploit them. You can use the same technique by just tweaking the questions. For our example, change question 1) to “What could cause exceeding our budgeted sales?”.

.

As you use the technique, you’ll find that each questioning level may have multiple answers leading to other potential risks for a single assumption. That’s ok. You’ll also find that some assumptions will share root risks. That’s ok, too. If you did the technique graphically – like on a whiteboard - you’ll see that the end result looks like a tree structure with multiple branches coming off of each assumption. (The technique can also be done with word processing software – contact me for details.)

.

The 5 Coulds technique is pretty informal, but I find it to be effective and simple…and that’s the goal for an ideal business risk management process, right? I’m sure there are other methods out there, but I haven’t been exposed to them.

.

What techniques do you use for identifying specific risks? Please share.

.

P.S. Take a look at the De-Risk blog post Extreme Risk Management – Mountaineers and Project Management for a story about how keeping risks specific applies to climbing a mountain, too.

.

P.S.S. I’m putting together a step-by-step example of creating a risk management plan – from brainstorming risks all the way through planning for them. I haven’t quite decided how to best present the results, but I’ll get it out to you somehow.

I regularly read Stratfor’s Geopolitical Weekly. It’s a fascinating glimpse into the world of foreign policy risk management. Take this week’s issue for example. George Friedman analyzes the stalemate between the U.S. and Iran over Iran’s nuclear ambitions.

.

In the article, George writes about an Iranian incursion into Iraqi territory (which I hadn’t even heard about) and how it relates to Iran’s strategy for dealing with the U.S. demand to abandon its nuclear program. He provides a detailed analysis of the situation, the risks to each country, the possible consequences and the potential options for how each country might respond to those risks. Does the process sound familiar? It should. It’s the risk management process we’ve been talking about – identify risks, evaluate risks and plan for risks.

.

Every time I read one of Stratfor’s articles, I can’t help but wonder how many analysts are working for the U.S. government on these types of analyses. I’m sure the number would scare me. And then I think about how many analysts are working for the other major countries of the world. No doubt it is a very large number indeed – a good thing in my opinion. I shudder at the thought of politicians making world-changing decisions based on gut-feel.

.

Risk management plays a critical role in global life and the interactions between countries. It should play a critical role in your business life and the interactions with your stakeholders (customers, employees, financiers, et al.). The process is exactly the same, only the sophistication of the evaluation techniques differ. The decisions the world’s politicians make could change the world for all of us. The decisions you make in your business are world-changing for you and your stakeholders (granted, a smaller scale, but pretty damn important to your stakeholders, don’t you think?). Shouldn’t those decisions get the benefit of the same risk management process?

.

Do you see the parallel? Do you agree or disagree? I dare you to share your opinion….

.

p.s. I promise to get back to the how-to’s of the risk management process – how to plan for your risks – next week.

I learned a lesson this week. I implemented new technologies (yeah, that’s right – plural) and suffered some embarrassment because I didn’t manage the risks well. Here’s what went down..

.

My Story

I have a day job at a company that doesn’t allow the use of social media sites by employees. I write my blog posts and supporting Tweets during non-work hours. I found that the schedule has a negative impact on building up the following of my blog via Twitter so I researched tweet-scheduling tools and started using Twaitter. During early testing, I noticed an improvement in my website’s metrics and felt comfortable using the tool to pre-schedule tweets. I felt good to go on the tweet scheduling front…

.

One of my goals for my blog is to maintain a consistent editorial calendar with two posts per week on Mondays and Thursdays. So far I’ve done OK with getting two posts out most weeks, but I haven’t performed well on getting the posts out on my scheduled days. As part of my day job, I do a fair amount of business travel and my trips were impacting my blog schedule. There is a solution. The fix is to get one or two posts “in the can” - written ahead of time – so I could utilize the capability WordPress offers for pre-scheduling posts to publish automatically. I hadn’t really used the scheduling function, but it’s just clicking a couple of buttons. How hard can it be? I felt good to go on the post scheduling front, too…

.

So I’ve got the technologies identified that will solve my problems. Life is good, and I’m ready to do some writing during the weekend for Monday’s post. I write the post and set the scheduled publish date and time in WordPress. I copy the permalink from the post and enter it into bit.ly to get the shortened URL for my tweets. Then I go into Twaitter and write a few posts. I schedule them to go out during the course of the day on Monday with the first tweet happening about 15 minutes after the post is scheduled to hit the web.

.

I go to work on Monday confident that my post will publish and the associated tweets will go out. I check my website Monday morning and notice that the post didn’t publish. Strange, but no problem – I must have forgotten to click the “Publish” button. Oh well. I just go in and publish it manually. I can’t access Twaitter, but I don’t need to, right? The permalink is the same so the shortened URLs should be just fine…

.

I have some personal business away from home on Monday night. I don’t check in with Twitter because I’m sure that everything is clicking and purring without a hitch. I’m sure tweeps are clicking and retweeting, subscribers are subscribing…

.

Tuesday night rolls around and I check in with my Twitter account. I’ve got a couple of direct messages from @De_Risky letting me know that my links appear to be broken and are labeled as spam. Shit! Not a good thing for a early stage blog who’s trying to build a following. I send out a couple of tweets with the original short link and apologies, but the link still doesn’t work. I create a new short link and tweet again, apologizing sincerely to my followers. Tom screwed up big time…

.

So let’s take a step back and review Tom’s lesson in terms of the risk management process…

.

The Assumptions

• I assumed that since I was comfortable with new technologies individually, I could effectively implement them together.
• I assumed that I would not make a mistake in using the tools.

.
The Risk

• If I don’t execute the new technologies correctly, I risk alienating existing followers and losing potential new followers/subscribers.

.

Estimated Probability

• In my mind, the probability is pretty low. But if I had an objective second set of eyes, the real probability would probably be close to 50% – a pretty high number.

.

Potential Impact

• Since my blog is non-revenue producing at this point, I can’t assign a dollar impact. But I can tell you that the potential impact in terms of reputation and future follower/subscriber growth is high, in my opinion.

.

(What Should Have Been) The Plan

• I have a high impact risk with a 50% chance of occurrence. It is a risk that should be managed and planned for.
• The plan should have been to test each tool independently and repeatedly to prove that I was competent with them.
• Then I should have tested with the tools together to make sure I understood the interactions.
• Lastly, I should have given some thought to potential ‘gotchas’ (more risks, right?) and at least considered some potential contingencies.

.

Obviously, I didn’t walk the walk. I failed at managing my risk with my blog posting and related tweeting….

.

Here are the points I want you to take away from my story:

1. There is potentially significant risk associated with implementing new technologies – even the seemingly simple implementations.
2. Managing the risks doesn’t have to be an onerous, burdensome process, but it needs to exist.
3. Planning for and mitigating the risks can be very simple and straightforward – and much less painful than the potential impact.

.

That’s my story. Please note that none of the applications I mentioned had any faults. I still use them all. The embarrassment still stings a little – a good thing, I suppose. Do you have other examples you can share with us? I’d love to hear about them.

I feel like I’m procrastinating. I finished my initial series on step one of the risk management process – identifying risk. Now the plan is to move into writing about step two – evaluating the risks. I’ll get there, but I’ve got one more topic I want to address. Let’s talk about the traits of world class business risk management…

.

I’ve been thinking about these for about a week now.  The idea was triggered by a comment exchange with Kristen on my last post. We talked about “formal” process vs. “formalized” process. Kristen is absolutely correct that risk management needs to be formalized – meaning done in a proper and regular form. But I don’t think it needs to be “formal” – using the definition “stiffly ceremonious, burdensome or onerous”. I know it’s semantics, but the difference in perception will be the difference between effective execution and just going through the motions.

.

That exchange about a specific trait got me thinking about what other traits would characterize world class business risk management.  Here’s what I’ve come up with.

.

Regular and Periodic

I think, first and foremost, a world class business risk management organization executes their risk management process regularly. It might be monthly, quarterly or annually, but risk management will be a regular and consistent task. These companies recognize that the situation is constantly changing. They appreciate the need to stay on top of new risks that may develop or existing risks that may become more probable.

.

Formalized Methods

Risk management must be formalized. What I mean by that is the steps in the process must be repeated consistently. When a task or process is performed on a regular basis, it will become formalized over time. And more than likely they will be written down, which brings us to the next trait..

.

Documented Process

Any company that has a world class process will have it documented. The owners and managers will understand that the methods need to be written down so they can be repeated consistently, communicated to others and continuously improved. The owners will also recognize that the results of the process need to be documented so they can be communicated, evaluated and referred to later.

.

Quantitative Methods

I’ll be the first to tell you that the numbers generated by a risk management process (e.g. the probability of risk occurrence or the potential impact of the risks) are not “real”. They are totally subjective and based on a team’s best judgment. However, just because the numbers may not be precise does not mean that they have no value. The numbers are necessary to successfully evaluate the risks and prioritize your plans.  As long as the methods are consistent, the resulting numbers can be used in comparison with each other.

.

Part of the Organizational Culture

A company that is world class gets that way for a reason – because they place great importance on what they are doing. World class business risk management will be performed by organizations who are passionate about the benefits of the process and have intertwined the concepts into the company culture.

.

Comprehensive

Business risk management can be (should be) applied to all aspects of business – strategic planning, marketing, operations, finance, IT, quality, human resources, etc.  World class companies will have some form of risk management implemented throughout.

.

Communicated

This trait may be redundant with some of the others, but I included it anyway because I think it is critical. The concepts of business risk management will be communicated regularly by world class companies. There are many stakeholders to risk management: employees, owners, investors, bankers and insurers to name a few. Each stakeholder group cares about at least some of the risks facing the business. World class organizations recognize this and make a point to talk about risk management methods, benefits and results regularly.

.

Well there you go. That’s my take on the traits of world class business risk management. Have I missed anything? I know there are a few of you out there reading this. I’d like to hear your opinions…

“How does somebody develop a passion for business risk management?”, one might ask. Well, let’s just say that I  learned its importance the hard (read “expensive”) way.

.

My partner, Phil, and I started a retail liquor store in our hometown – a small town in eastern Iowa. We did our research. There was a  limited local supply – only the town’s grocery store offered a very sparse selection of liqour, beer and wine with zero customer service. Our interviews with competitors, potential customers and suppliers all indicated that there was a solid market for the business as long as the prices were reasonable. We wrote a kick-ass business plan (”Best I’ve ever read”, said the banker), got our financing, set up our space and opened the business.

.

The initial response was pretty encouraging. We had a great location and put together a nice marketing campaign to generate interest. The business was cash-flowing and life was good. But after about six months, we noticed sales starting to drop off. At first we attributed the drop to the end of the honeymoon every new retail business experiences, but the sales kept dropping off. Phil and I tried a lot of responses – increased marketing, special promotions, PR events, added services, expanded selection – but nothing seemed to stop the bleeding. We finally resorted to what we should have done in the first place…we started asking questions.  Our friends and former customers told us that the convenience of picking up their liquor, wine and beer while they were grocery shopping was more important to them than a better selection, better service and cool setting. Phil and I had assumed that a reasonably priced better selection with better service would win customers over. We assumed wrong.

.

After about three years it was apparent that the business was never going to hit our target returns unless we made some major investments, and even then the returns would be questionable. We elected to close the business down and take the financial hit instead of throwing good money after bad.

.

As we did a post-mortem on the good idea that didn’t work, it was clear that the bad assumption contributed to the loss. But the real cause of our loss was that we were not prepared when a key assumption didn’t pan out. As I’ve written before, assumptions are risks. We could have avoided the financial loss if we had managed our risks up front.

.

We learned our lesson. Can you think of a similar situation? I’d love to hear about it.