Let’s drill down a bit into risk evaluation – step 2 in the risk management process. It’s standard practice to evaluate a risk or opportunity’s impact and rank it. You can rank the impact on a scale of 1 to 5, with 5 being the highest impact. Or you can rank the impact “high”, “medium”, or “low”. Or if you’re utilizing financial models you can calculate the risk’s impact and represent it in terms of your local currency.

.

Seems very straight forward, right? It is, but let’s take a step back and ask “Impact on what?” Risks and opportunities can impact your business in multiple ways, right? They can impact:

• Revenue (sales or money coming in)
• Expenses (costs or money going out)
• Profits (the net difference of money coming in and money going out)
• Cash flow (cash on hand or the rate of cash accumulation)
• Quality (tangible product quality and customer-perceived service quality)
• Schedule (progress towards a milestone date)

.

Sidebar: I know that there are other types of risk impacts that could be added to the list – IT/data security, regulatory, reputation, etc. – but in my opinion all of them should boil down to one or more of the six impacts above.

.

In order to properly rank and prioritize the risks and opportunities, they should all be evaluated with respect to a single impact so they can be directly compared to each other. Does that make sense? Let me give you a quick example:

Fred has evaluated his risk inventory and identified the risk with the biggest impact on quality, the risk with the biggest impact on cash flow and the risk with the biggest impact on schedule. Fred looks at all three and scratches his head. “Which one do I work on first? They are all important.”

Fred’s dilemma was caused by evaluating his risks in terms of multiple impacts. If he had evaluated all of them with respect to only cash flow (or only quality or only schedule), the risks would all be ranked together and he could clearly see which one should be worked on first. Understand?

.

An interesting point: the ranked order of Fred’s risks if he evaluated them in terms of cash flow would probably be different than if he had evaluated them in terms of quality. Do you see why? It’s important to give some thought to the basis of your evaluation before you start.

.

So which impact is the right impact to use for risk evaluation?

.

The real answer is “It depends”, but personally I think 99% of the time the answer should be cash flow. Let me tell you why. First off, in a business setting – and especially in a small business setting – cash is king. Cash flow is the best litmus test for a successful business, even the mega-corporations. That’s because cash flow is a measure of the combined effects of the other five impacts. Businesses with exceptional revenue can easily fail (have you heard of ‘growing yourself out of business’?). Businesses with outstanding cost control and low expenses can fail if they don’t have the necessary revenues. Even businesses with solid profits can fail if the profits are primarily driven by depreciation, amortization, balance sheet transactions or other non-cash accounting treatments. But a business with great cash flow can only succeed. They have more cash coming in than is going out, and that’s the name of the game, folks.

.

I do have to tell you, there is a downside to evaluating in terms of cash flow. It pretty much requires some sort of financial model. Don’t let that scare you, though. Models don’t have to be complicated. I will be writing about how to set up financial models in a spreadsheet in future posts. You can do it.

.

So my advice to you is evaluate your risks in terms of cash flow. I know, I know. It will involve a bit more work and judgment on your part, but it is the most direct way to tie your risk management effort to your business success. Remember you’re not doing risk management just to go through the motions. Spend some time and do it right. You won’t regret it. I promise.

.

How are you doing so far? Still with me? I could use some feedback.

It’s been difficult to come up with topics this week.  The situation in Haiti seems to consume the majority of my thoughts when I’m outside the office. Make a difference. Please donate cash to the relief agency of your choice.

.

I thought I’d take a look at my Google Analytics page and see what people are searching for when they find my website. There is a definite trend. Many of the searches involve the word “example” or are geared toward identifying potential risks for businesses. Let’s talk about that…

.

Businesses face many types of risks. Some of those risks can be managed with insurance. I’m not going to address those here, but I’ll point you to a great site with tons of free information. Check out www.ClearRisk.com for a comprehensive list of business risks that can be managed by insurance. I would also strongly recommend that you download and read their free e-book. It’s an easy read and provides a great education on insurance for small and medium businesses. (Disclaimer: My recommendation is not sponsored and I’m not being paid in any way. In fact, Craig Rowe and the ClearRisk team don’t even know I’m doing it.)

.

So let’s talk about the risks you can’t buy insurance for. Obviously every business is going to have risks that are unique to that business, but they will always fall into three broad categories – budget risk, quality risk and schedule risk. (Check out my post here for details.) Starting with those categories, you can drill down by using the “5 Coulds Technique” (detailed here).

.

As you do the brainstorming, you’ll find that you come up with a wide range of risks. Here are just a few that come to mind as I’m writing. I’m in a manufacturing and retail mindset this morning so the risks are geared to those kinds of businesses, but many of them apply to service businesses, too. Some risks are repeated in multiple categories purposely.

.

Make sure you read the IMPORTANT NOTE at the bottom of the post!

.

Employee Related Risks

• Theft
• Departure of a key employee
• Lack of training
• High turnover
• Sabotage/intentional misbehavior
• Employee disputes
• Poor customer service

.

Revenue Related Risks

• Competitor enters market
• Market size shrinks (local population shrinks, demographics change)
• Economic pressure (reduces money available to be spent on your product)
• Substitute product becomes available
• Customer access disrupted (e.g. road construction in front of your business)
• Pricing doesn’t match value perceived by customers

.

Expense Related Risks

• Material costs increase
• High rework expense
• High warranty expense
• Loss of key supplier
• Increased wage expense (tight labor market)
• Increased benefit costs
• Loss of lease/increased rent
• Increased utility rates
• Increased bank charges (interest rates, credit card fees)

.

Quality Related Risks

• Poor production process
• High rework expense
• High warranty expense
• Poor customer service
• Low quality materials
• Poor employee morale
• Inadequate equipment/tools
• Poor/unattractive packaging
• Equipment/tool breakdown

.

Schedule Related Risks

• Customers are slow paying
• Unfavorable terms from suppliers (e.g. cash in advance)
• Late delivery of materials
• Lost/misdirected shipments of your product
• Slow response of bank, government agency (e.g. loan proceeds, permits, etc.)
• Delayed construction/remodel
• Slow response to marketing campaign
• Equipment/tool breakdown (e.g. internet down, computer virus)

.

Are you getting the idea? This list just scratches the surface. Your business will have many more risks that are unique to your situation.

.

IMPORTANT NOTE: I’ve focused the examples above on risks, but don’t forget about your opportunities. Many of the risks listed above will have corresponding opportunities you can exploit. For example: The risk “Customers are slow paying” has an opportunity “Customers pay quicker than expected”. Don’t get caught in the trap of focusing only on the negative. Identifying and exploiting opportunities can pay for your risk management program. Check out this post for more info.

.

Please share some examples of risks facing your business. Leave a comment.

Over the last couple of months, I’ve walked through the process for small business risk management with you. I thought it would be a good idea to capture all of the “how to” posts in one place.

.

Take a look at the compilation. My hope is that after reading all the posts below you have a general understanding of how to manage risks and opportunities for your small business. More importantly, I hope you see the benefit of incorporating formalized risk management into your daily business life.

.

Introduction & (hopefully) Motivation

5 Reasons You Should Care About Managing Risks

I Want to Manage My Risks. Where Do I Start?

.

Step 1: Identify Risks

3 Categories of Risks

Easy Money! Manage Your Opportunities

The 5 Coulds Technique

.

Step 2: Evaluate Risks

Evaluate Your Risks, Part I – Why?

Evaluate Your Risks, Part II – The First 2 Steps

Evaluate Your Risks, Part III – The Last 2 Steps

The Miracle of the 80-20 Rule

.

Step 3: Plan for Risks

Mitigate Risks, Exploit Opportunities!

.

I know, risk management sounds scary. Hopefully, what you read in the posts above helps make it less scary. As we continue our discussions you will see that there’s nothing to be afraid of. In reality, you’re already doing it every day – you just don’t realize it.

.

Remember, risk management is only two things: working to avoid or minimize the bad things that could happen to your business and working to take advantage of the potential good things.

.

Can you think of any management activity that isn’t driven by a risk or opportunity? I can’t.

.

How do you feel about the process? What is your impression about what I’ve written – too simplistic? too complex? unclear? How am I doing for you? Let me know.

It’s been a while… Let’s get back to basics of the risk management process.

.

We’ve covered the first two steps – identifying risks and evaluating them. You now have a great list of your risks and opportunities, in order of their potential impact on your business, but your work isn’t done yet. Having the list helps you anticipate which risk may have the biggest impact on your business, but if the risk becomes reality you will still be reacting to it during a potentially stressful situation.

 .

Since clear, thoughtful thinking is difficult during a crisis, let’s do some thinking now about what we would do. This exercise is called risk mitigation planning. Believe it or not, this is the fun part of risk management.

 .

Risks can be mitigated (i.e. made less severe or alleviated) in several different ways. You can mitigate risk by:

1. Avoiding it in the first place (the obvious preference)
2. Reducing the risk’s impact when it occurs
3. Transferring the risk and its impact to somebody else (e.g. through the use of insurance, warranties, etc.).

 .

For each risk, write down what steps you will take to mitigate that particular risk. How will you recognize the risk becoming reality (is there a measurement you can use)? At what point will you take mitigating action? What actions will you take? How will you know when you have succeeded? The mitigation plan is where you will realize the greatest value of your risk management efforts. You are now prepared for the most important risks to your business and have a plan for dealing with them if and when they occur.

.

I think there is a tendency to over think risk mitigation sometimes or at least make the planned mitigation more complex than it needs to be. Don’t fall in to the trap of making your plan overly complicated. Many times employee awareness or training will be just as effective as some fancy software – and a whole lot cheaper!

.

Let’s talk about how mitigation planning works for opportunities. During the sensitivity analysis, you created a rank order list of opportunities. Now is the time to plan on how you can realize some of those opportunities and reap their benefits. Write down the steps you will take to make the opportunities realities. What actions will you take? How will you know when you’ve succeeded?

. 

Opportunities are exciting! Planning for opportunities is fun! Now you can have some fun and transform the opportunities into results. Effectively executing your plans for your opportunities many times will offset the cost of the risk managment process or even pay for it completely. Don’t pass up the opportunity (pun intended )!

.

Robert F. Kennedy once wrote: “Only those who dare to fail greatly can ever achieve greatly.” Dare to manage your risks. I’ve got your back - so don’t worry about failing greatly - let’s achieve greatly. OK? Thoughts?

As you recall, the 3 steps of business risk management are:

1. Identify your risks
2. Evaluate your risks
3. Plan for your risks

I’ve written a couple of posts (here and here) about the first step – identifying risks and creating your risk inventory (list of risks and opportunities). I’ve also written about the related topic of identifying your opportunities. It hasn’t been an exhaustive tutorial, but hopefully there has been enough information presented to help you gain a basic understanding of how to get started.

.

Now let’s start talking about evaluating the risks. (Note: Whenever I write “risks” in this post, I am also referring to opportunities. They are evaluated in exactly the same way.) In this post I’m going to describe what results from the risk evaluation exercise. The next post will get into the specific actions involved in the evaluation.

.

Why Evaluate Risks?

The risk evaluation yields several important results. When you are done, you will have

1. A prioritized list of your risks and opportunities
2. An estimated amount of contingency funding required to cover the most important risks to your business
3. An understanding of how sensitive your business is to each of the most important risks.

The most important output is the prioritized list, but the contingency funding level and sensitivity analysis provide very useful information. If you have to cut corners stop after #1, but I would encourage you to work towards implementing all three evaluation steps.

.

Prioritize Risks and Opportunities

The first step of risk evaluation is to create a prioritized list of your risks and opportunities. We will accomplish this by estimating the probability of each risk’s occurrence and estimating the potential impact of each risk if it does occur. You will be able to sort your risk inventory in order of probability (the risks most likely to occur at the top) or in order of potential impact (the risks with the largest potential impact at the top). You may want to focus on the most probable risks or the risks with the largest potential impact – it’s your call. Or maybe you’ll want to look at it both ways. (This is where the advantage of a computer spreadsheet or risk management software comes in to play. A spreadsheet gives you the freedom to slice and dice the data in many different ways.) Now you can focus on just the few most important risks when we move into Risk Management Step #3: Planning For Your Risks.

.

Estimate Contingency Funding Requirements

If you have financial models available that allow you to generate some realistic potential impact values, risk evaluation will allow you to calculate the amount of contingency funding needed to cover your most important risks. The contingency funding will be based on the concept of “probable impact”. Probable impact is calculated by multiplying the risk’s probability by its potential impact. It is a way to mathematically estimate how much money should be set aside to cover uncertain events.

.

Here is how it works. We have a risk with a potential impact of $100,000. That means if the risk occurs (100% probable, right? – it is occurring), the impact on the business is $100,000. But what if the risk’s probability is only 50% – how much should I set aside to cover it? The conservative answer is $100,000, but that’s a lot of money to set aside for only a 50% chance of needing it. Using the probable impact calculation, we would put aside $50,000 (50% x $100,000). Granted, we’ll have some trouble if the risk occurs but not as much as if we hadn’t set anything aside. And remember that we have a list of risks, each with their own probability. Some will occur, some won’t, so at any given point you will have ‘extra’ money set aside that you can draw from. If you keep your risk inventory and evaluations current, you will have a real time estimate of contingency funding necessary to cover those risks you consider most important.

.

Analyze Sensitivity

The sensitivity analysis portion of risk evaluation requires some sort of financial model to test scenarios using your most important risks. Sensitivity analysis helps you understand how sensitive your business is to a particular risk. For example, you have identified a risk that material costs may be $10 per unit higher than planned. You have estimated that the potential impact of the higher material cost risk is $25,000. But your $10 estimate is just that – an estimate. What if the actual material costs are only $5 higher than planned? or $15 higher than planned? Does the risk’s potential impact change a lot or a little?You will find that your business is more sensitive to some risks than others. Sensitivity analysis allows you to identify risks whose potential impacts change more drastically as you move away from your assumed value. It’s definitely a more advanced aspect of risk management that helps you manage your risks more efficiently.

.

Those are the three outputs of a thorough risk evaluation. The concepts can be a little confusing at first (especially the last 2), but give it some time to sink in. The next post will cover more of the step-by-step, how-to details. In the meantime I would love to hear your questions, comments or complaints if I’ve completely lost you.

Most people think that risk management only deals with the potential bad things that could happen to your business. What a huge misconception. A key outcome of risk management is the identification of your opportunities, too. Very few businesses actively manage their opportunities, but those that do stand out above the rest in terms of growth and profitability. If you put just a little bit of effort into it, you can join the ranks of the best managed businesses.

.

As I wrote a while back, businesses make a lot of assumptions. Almost all assumptions are wrong, which means that the actual result may potentially be worse than the assumption (a risk) or may be potentially better than the assumption (an opportunity). Opportunities can be identified and managed in exactly the same way as risks…

.

Think about that. Opportunities can be managed in exactly the same way as risks. That means opportunities can be identified, evaluated and planned for. How awesome would it be to have a prioritized to-do list of ways to improve your business? Pretty awesome right? We can make it happen…without doing anything more than the normal risk management steps.

.

I’ve already written about how most risks are based on assumptions – conscious assumptions or unconscious assumptions. Most opportunities are based on assumptions, too. For example, you may be assuming a certain raw material or wholesale cost for your product. The risk is that the cost is higher than assumed. But the opportunity is that the cost is lower. The question is how can you make that happen? Another example: A competitor moves in down the street. The obvious risk is that the competitor takes away some of your business. But what if you step up and beat the competitor? What a great opportunity to create word-of-mouth advertising and a great reputation.

.

Good managers are constantly looking for opportunities. Seth Godin (Seth’s blog) and Jeff Cornwall (The Entrepreneurial Mind) both recently wrote about the importance of watching for opportunities.

Seth wrote:

As you get bigger and older, are you busy ensuring that a bad thing won’t happen that might upset your day, or are you aggressively investing in having a remarkable thing happen that will delight or move a customer?

Jeff wrote:

The most successful entrepreneurs are not necessarily those who write the best business plan. What successful entrepreneurs are good at is listening to their customers and then adjusting appropriately.

Both are talking about looking for opportunities.

.

So here’s the point. As you’re brainstorming on all of the risks facing your business, include the opportunities as well. For each risk category and assumption ask yourself “What is the potentially good thing that could happen to my business?” Opportunities are every bit as important to the future of your business as the risks.

.

So how are you doing? Feeling overwhelmed or kinda getting the concept? Hang in there. We’ve covered the basics of the first step of the risk management process: identify your risks (and opportunities). Coming up: evaluating your risks and opportunities.

.

What can I do better to help you out? Post a comment of contact me on the Contact Me page.

Risk management is arguably one of the most under-utilized business tools available to owners and managers today. It involves planning for potentially bad events before they happen. Risk management is a technique for predicting what unplanned events might occur and what the impact of those events might be. It’s also a technique for pre-planning how those events can be avoided or how their impact can be minimized. Almost every business does a limited amount of risk management – usually in the form of insurance – but very few businesses actively manage their risks.

.

So what kind of risks am I talking about? They run the gamut. The insurance I mentioned usually deals with financial risks associated with natural disasters, fire, injury or death, accidents, etc., but there are many, many more risks facing your company.

.Basically every assumption a business makes is a potential risk. Businesses make a lot of assumptions every day, so there are a lot of risks. Here are some examples:

• A highly publicized customer service failure
• A lower priced competitor entering the market place
• A large increase in raw material costs
• Lower than expected response rate to a key marketing campaign
• An economic downturn

Starting to get the idea? But risk management isn’t all about the bad things that can happen. It also addresses the good things that can happen to your business – a.k.a. opportunities. If you have an assumption there are two possibilities if your assumption doesn’t pan out. The possibility of the actual result being worse than the assumed value is the risk. The possibility of the actual result being better is the opportunity. Make sense? Some example opportunities are:

• A highly publicized customer service success
• A lower priced competitor goes out of business
• A large decrease in raw material costs
• Higher than expected response rate to a key marketing campaign
• An economic recovery

.

The concept of risk management is pretty simple – only 3 basic steps:

1. Identify the risks,
2. Evaluate the risks
3. Plan for how to avoid the risks or how to deal with them if they occur.

.

Risk management can be applied to any type of planning you might do – business planning, strategic planning, financial planning, market planning, product planning, etc. The technique is the same for all of them, only the risks and planned responses change.

.

You can make the risk management process as simple or as complex as you want. It can be a spreadsheet with automatic formulas, fancy formatting, etc. or it can be a spiral notebook with pencil entries. The mechanics of how you do risk management aren’t as important as the thought that you put into it. Dr. Jeff Cornwall recently wrote a very eloquent piece about the importance of business planning that nicely sums up how the thinking provides benefit.

Our actual path in our business will likely look very different than our plan. But the plan got us thinking. It made us think about all the details. It helped us understand how all of the parts of a business fit together to make a whole venture. It helps prepare us for our journey and makes us better prepared to adjust to all of the surprises that we will face almost every day we’re in business.

Risk management is the specific method that helps better prepare us for those surprises that are sure to happen…

.

This blog is dedicated to business risk management. In the future I will write about how the technique can be applied in different ways and the detailed step-by-step instructions on how to do it. Every now and then I’ll write about examples of risk management in current events to show how it’s being used (or should have been used) in real life.

.

I’m glad you have joined me. I’m looking forward to our discussions on how risk management can contribute to your business’ success.  Do you see the possibilities? Stay tuned…