Thomas M. Bragg on Business Risk Management » Risk Evaluation

The Value of Risk

Tom — Mon, 22 Feb 2010 20:18:44 +0000

: Image via Wikipedia

In my opinion, few business people recognize that risk has a very real (and substantial) value. The lack of recognition is understandable – it’s hard to put a convincing numerical value on a risk that may or may not occur. But every now and then, an event comes along that provides a quantified glimpse of risk’s value. I was a witness to one of those rare events. Here’s the story…

A high tech manufacturing company, let’s call them “WidgetCo”, won a very large and very challenging contract for a new product. Life was good at WidgetCo. Unfortunately, it didn’t take long for WidgetCo’s product development to fall significantly behind schedule and exceed budget. WidgetCo’s management decided that they needed to outsource part of the development effort to an outside company.

.

WidgetCo put together a very attractive bid package. Many companies submitted aggressive bids in an attempt to win the business. As WidgetCo reviewed the proposals, they soon realized that some of the companies did not fully understand the scope of the project or just plain low-balled the estimate in an attempt to win the business. The company whose proposal was most complete and demonstrated a full understanding of the task at hand was also the most expensive – more than 20% higher than the next lower bid. WidgetCo management had a problem.

.

So how does the story end? After much thought and discussion, WidgetCo selected the most expensive proposal. Why? Because they saw that proposal as the lowest risk solution to their problem. WidgetCo paid a 20% premium to reduce their perceived risk. They valued that risk to be worth more than $2,000,000.

Does that result surprise you? I’ll be the first to admit that it’s unusual in today’s short-sighted, manage-for-quarterly-results business environment. But if you can put aside the pleasant novelty of the management decision, it is a great example of risk’s value. (It’s also a great example of risk awareness playing a big role in a major business decision.)

My story deals with the value assigned to risk by a corporate customer, but the same principle applies to individual customers like you and me. Think about people that buy Volvos. What about people that buy Macs? Both groups are at least somewhat concerned about risk (personal risk and malware risk) and are willing to pay a premium to minimize that risk. There are lots of examples of products marketed as ‘lower risk’. There are lots of people who gladly pay more to buy those products.

So let’s accept that there is significant value associated with the risks perceived by your external customer (i.e. external stakeholder). Doesn’t it stand to reason that there is significant value associated with risks perceived by your internal stakeholders – the risks faced by your business? Don’t you think it’s about time you start managing that value?

OK, I know what you’re thinking… “Great, Tom. My risks have value. But how do I figure out what that value is?” Funny you should ask. You can check out these posts for evaluation methods that you can use to quantify the value of your risks:

I would love to hear some of your stories about value being assigned to risk. Leave me some comments and let’s talk about them.

I’ve put together a compilation of how-to posts to help guide you through the risk management process (“How To Manage Risk”) . Check it out!

Sexy Models of the Financial Kind

Tom — Fri, 29 Jan 2010 14:56:40 +0000

: Image by lochnessjess via Flickr

To be honest, I’ve debated about whether I should write about financial modeling. If you’re anything like my girlfriend Amy, the mere thought of financial modeling causes great anxiety and a profound desire to change the topic. And I’m pretty sure that a post on creating spreadsheet representations of your business may not go viral.

But the simple truth is that financial models are incredibly powerful tools and they’re not that hard to create. Models are also required to do certain types of risk evaluation (as I talk about here, here and here..) In fact, models of the financial kind can be kind of sexy – at least to the engineering types like me.

Well, now that I think about it the models really aren’t that sexy…did I mention that financial models are incredibly powerful?

So what is a financial model?

It’s a numerical representation of your business. It shows revenues, expenses and cash flow and all of their components. A model lists all of the assumptions (and there are a lot of them) with the assumed value for each. If you use formulas when you create the model, it’s possible to test different scenarios by changing the assumed values.

Here’s a simple example. Fred owns a coffee shop. In his model, he calculates revenue by assuming the number of cups of coffee he will sell each month and multiplying that number by an average price per cup.

Sales = # of cups x $/cup

In this example there are two assumptions. That means there are two risks and two opportunities, right? The actual result for each assumption could turn out to be wrong in a negative way (a risk) or wrong in a positive way (an opportunity). By changing the assumed values, you can see the financial impact of risks and opportunities directly from the model.

You can apply the same technique to the direct expenses, the overhead expenses and even cash flow factors like how quickly you pay your invoices and how quickly you get paid by your customers. I arrange the numbers in a column for each month. The end result looks very similar to an income statement (a.k.a. P&L report).

I’ve done a lot of financial models in my time – for business planning, budgeting and forecasting. I continue to be amazed by the amount of information a good model will give you.

I’m going to continue this series and give you some more detail on financial modeling over the coming weeks. I’ve also created a public sample financial model for Fred’s Coffee Shop. You can check it out here (I’m using Google documents since they are easy to share. I typically do my modeling in MS Excel). Feel free to make a copy and play with it. So far I’ve only created the income statement portion of the model, but I’ll be adding some cash flow components to it.

Don’t hesitate to contact me with any questions. This type of modeling has become an area of expertise for me (in MS Excel spreadsheets) and I’m happy to help.

Do you use any sort of financial modeling in your business? I’d love to hear about your experiences.

A Financial Model is Not Black Magic (startupprofessionals.com)

Risk’s Impact on What?

Tom — Fri, 22 Jan 2010 23:43:42 +0000

: Image by Jayson Ignacio via Flickr

Let’s drill down a bit into risk evaluation – step 2 in the risk management process. It’s standard practice to evaluate a risk or opportunity’s impact and rank it. You can rank the impact on a scale of 1 to 5, with 5 being the highest impact. Or you can rank the impact “high”, “medium”, or “low”. Or if you’re utilizing financial models you can calculate the risk’s impact and represent it in terms of your local currency.

Seems very straight forward, right? It is, but let’s take a step back and ask “Impact on what?” Risks and opportunities can impact your business in multiple ways, right? They can impact:

Revenue (sales or money coming in)
Expenses (costs or money going out)
Profits (the net difference of money coming in and money going out)
Cash flow (cash on hand or the rate of cash accumulation)
Quality (tangible product quality and customer-perceived service quality)
Schedule (progress towards a milestone date)

Sidebar: I know that there are other types of risk impacts that could be added to the list – IT/data security, regulatory, reputation, etc. – but in my opinion all of them should boil down to one or more of the six impacts above.

In order to properly rank and prioritize the risks and opportunities, they should all be evaluated with respect to a single impact so they can be directly compared to each other. Does that make sense? Let me give you a quick example:

Fred has evaluated his risk inventory and identified the risk with the biggest impact on quality, the risk with the biggest impact on cash flow and the risk with the biggest impact on schedule. Fred looks at all three and scratches his head. “Which one do I work on first? They are all important.”

Fred’s dilemma was caused by evaluating his risks in terms of multiple impacts. If he had evaluated all of them with respect to only cash flow (or only quality or only schedule), the risks would all be ranked together and he could clearly see which one should be worked on first. Understand?

An interesting point: the ranked order of Fred’s risks if he evaluated them in terms of cash flow would probably be different than if he had evaluated them in terms of quality. Do you see why? It’s important to give some thought to the basis of your evaluation before you start.

So which impact is the right impact to use for risk evaluation?

The real answer is “It depends”, but personally I think 99% of the time the answer should be cash flow. Let me tell you why. First off, in a business setting – and especially in a small business setting – cash is king. Cash flow is the best litmus test for a successful business, even the mega-corporations. That’s because cash flow is a measure of the combined effects of the other five impacts. Businesses with exceptional revenue can easily fail (have you heard of ‘growing yourself out of business’?). Businesses with outstanding cost control and low expenses can fail if they don’t have the necessary revenues. Even businesses with solid profits can fail if the profits are primarily driven by depreciation, amortization, balance sheet transactions or other non-cash accounting treatments. But a business with great cash flow can only succeed. They have more cash coming in than is going out, and that’s the name of the game, folks.

I do have to tell you, there is a downside to evaluating in terms of cash flow. It pretty much requires some sort of financial model. Don’t let that scare you, though. Models don’t have to be complicated. I will be writing about how to set up financial models in a spreadsheet in future posts. You can do it.

So my advice to you is evaluate your risks in terms of cash flow. I know, I know. It will involve a bit more work and judgment on your part, but it is the most direct way to tie your risk management effort to your business success. Remember you’re not doing risk management just to go through the motions. Spend some time and do it right. You won’t regret it. I promise.

How are you doing so far? Still with me? I could use some feedback.

How To Manage Small Business Risk

Tom — Thu, 07 Jan 2010 13:40:32 +0000

: Image via Wikipedia

Over the last couple of months, I’ve walked through the process for small business risk management with you. I thought it would be a good idea to capture all of the “how to” posts in one place.

Take a look at the compilation. My hope is that after reading all the posts below you have a general understanding of how to manage risks and opportunities for your small business. More importantly, I hope you see the benefit of incorporating formalized risk management into your daily business life.

I know, risk management sounds scary. Hopefully, what you read in the posts above helps make it less scary. As we continue our discussions you will see that there’s nothing to be afraid of. In reality, you’re already doing it every day – you just don’t realize it.

Remember, risk management is only two things: working to avoid or minimize the bad things that could happen to your business and working to take advantage of the potential good things.

Can you think of any management activity that isn’t driven by a risk or opportunity? I can’t.

How do you feel about the process? What is your impression about what I’ve written – too simplistic? too complex? unclear? How am I doing for you? Let me know.

Foreign Policy & Risk Management

Tom — Tue, 22 Dec 2009 01:44:48 +0000

: Image by Hamed Saber via Flickr

I regularly read Stratfor’s Geopolitical Weekly. It’s a fascinating glimpse into the world of foreign policy risk management. Take this week’s issue for example. George Friedman analyzes the stalemate between the U.S. and Iran over Iran’s nuclear ambitions.

In the article, George writes about an Iranian incursion into Iraqi territory (which I hadn’t even heard about) and how it relates to Iran’s strategy for dealing with the U.S. demand to abandon its nuclear program. He provides a detailed analysis of the situation, the risks to each country, the possible consequences and the potential options for how each country might respond to those risks. Does the process sound familiar? It should. It’s the risk management process we’ve been talking about – identify risks, evaluate risks and plan for risks.

Every time I read one of Stratfor’s articles, I can’t help but wonder how many analysts are working for the U.S. government on these types of analyses. I’m sure the number would scare me. And then I think about how many analysts are working for the other major countries of the world. No doubt it is a very large number indeed – a good thing in my opinion. I shudder at the thought of politicians making world-changing decisions based on gut-feel.

Risk management plays a critical role in global life and the interactions between countries. It should play a critical role in your business life and the interactions with your stakeholders (customers, employees, financiers, et al.). The process is exactly the same, only the sophistication of the evaluation techniques differ. The decisions the world’s politicians make could change the world for all of us. The decisions you make in your business are world-changing for you and your stakeholders (granted, a smaller scale, but pretty damn important to your stakeholders, don’t you think?). Shouldn’t those decisions get the benefit of the same risk management process?

Do you see the parallel? Do you agree or disagree? I dare you to share your opinion….

p.s. I promise to get back to the how-to’s of the risk management process – how to plan for your risks – next week.

The Miracle of the 80-20 Rule

Tom — Mon, 14 Dec 2009 13:39:47 +0000

: Image via Wikipedia

In our last conversation about risk management how-to’s, we finished up the discussion on evaluating risks. If you are able to utilize some sort of financial model to estimate risk impacts during your evaluation, you now have a rather lengthy list of risks with their probable impacts. That list can now be sorted.

How you sort the data depends on your desired approach. You can sort the data in order of probable impact. (This sort order will put the risks with the greatest potential impact to your business at the top of the list.) Or you can sort the data in order of probability of occurrence. (This sort order will put the risks that are most likely to occur at the top of the list.) Each sort order has its benefits. Personally, I look at the data in both ways. I obviously want to deal with the biggest impact risks. But I also want to deal with the most probable risks. Call it selfish, but I like the idea of reducing my future stress levels by eliminating the most probable risks.

So we’ve got a sorted list of risks. It’s probably somewhat overwhelming. There is no way you can deal with all of them. Where do you start? Which risks do you work on and which do you leave alone? That’s where the 80-20 rule comes in…

The 80-20 Rule (aka Pareto Principle) is nothing short of amazing. It says that 80% of the effects come from 20% of the causes. The 80-20 rule applies in many places, but let’s talk about how it can help you out with your risk management.

Look at your risk inventory, sorted in order of impact. Count the total number of risks. Now take 20% of the total number. Add up the probable impact of those top 20% of risks and you’ll see that it accounts for about 80% of the total probable impact. Think about that for a minute…. You can address 80% of your total risk exposure by working on 20% of the risks facing your company. How cool is that? If you have 50 risks identified, you can address 10 of them and cover the lion’s share of your risk exposure. Now it’s not so overwhelming, eh?

So now we have a manageable number of risks to think about and plan for. That leads us into the final step of risk management – planning for your risks. That will be my topic for the next how-to posts.

Coming up

So far, I’ve done a lot of writing about how to do practical business risk management. That’s all fine and good, but I know it’s difficult to apply how-to text to real life. Over the next few weeks, I’m going to introduce you to Fred. Fred owns his own coffee shop and actively manages his risks. I’ll share some of Fred’s experiences with you and show you his risk management spreadsheet. I think the example will be helpful in seeing how all this information I’m spewing at you can be applied in your business.

Also in the works… I think it would a glossary of terms might be helpful. I use a lot of terms that can be confusing. Plus some of my terms are “tom terms” – a little different than the industry standard, but easier to understand (in my humble opinion). The glossary will be a living page on the blog. Stay tuned…

What else would you like to see from me? Is there different content or more of a certain category that you want to see? What can I do to help? I’m happy to accommodate. Let me know your opinion.

Disclosure: I now have a disclosure page. Click here or click the “Disclosure” tab at the top left of the page to read my full disclosure that I really have nothing to disclose.

Evaluate Your Risks, Part III – The Last 2 Steps

Tom — Sun, 06 Dec 2009 20:24:12 +0000

First off, let me apologize for the inconsistent posting lately. The holiday and vacation really hosed up my editorial calendar…
.
So let’s get back to evaluating risks. In the last post, I introduced you to the first two steps in risk evaluation: estimating probability and estimating potential impact. The last two steps are calculating probable impact and testing sensitivity.

NOTE: These evaluation steps only apply if you estimated potential impact in terms of currency (e.g. dollars, pounds, yen). If you used buckets for potential impact, these steps don’t have any meaning…

Calculating Probable Impact

Do you remember how I described probable impact? (Here’s the original post.) The probable impact calculation is a way to mathematically calculate an amount to set aside to cover an uncertain event. (Richard Worzel describes it as “expected cost”.) The calculation is super easy – just multiply each risk’s estimated probability by its estimated potential impact.

EXAMPLE:

Joe has identified a risk that a competitor might open up a Starbucks just down the street from his coffee shop. Joe has estimated that the probability of the risk occurring is 50% and, if it does occur, his cash flow will be reduced $100,000. The calculated probable impact of the risk is then $50,000 or 50% x $100,000. Joe decides to set aside $50,000 in a savings account as contingency funding to cover the risk’s impact.

Make sense? OK, let’s move on to sensitivity analysis…

Sensitivity Analysis

In order to perform a sensitivity analysis, it is necessary to have some type of financial model where you can input different assumptions and evaluate the resulting impact. When I do a business plan or forecast, I set up a spreadsheet. The spreadsheet has a list of assumptions (e.g. # of units sold, average price, average cost, assumed overhead cost components, etc.) and uses formulas to calculate the revenue, profit and cash flow for each month. The model then allows me to do “what if” scenarios.

“So why do I want to do a sensitivity analysis?”, you might ask. Well, there a couple of reasons. First off, your estimated potential impact and estimated probability are just that – estimates. If you can evaluate a a range of potential impacts or probabilities for each risk, you can determine a range of contingency funding necessary to cover your risks to the level appropriate to your risk tolerance. Another reason for doing sensitivity analysis is that it provides insight into how your business runs. As you cycle through checking the sensitivity of each of your risks, you’ll find that your business is more sensitive to some than others. Here’s why… some risks impact your business in multiple ways so there is a compounding effect.

EXAMPLE:

Fred has identified two risks for his retail business: a risk that a competitor opens down the street and takes away some of his customers and a risk of stocking poor quality merchandise. The potential impact of a new competitor is pretty straight forward – his daily customer count decreases, reducing his average daily sales and cash flow. The potential impact of poor quality merchandise affects his business in multiple ways. First Fred has to deal with the expense of product returns. Then there is the additional inventory cost to purchase additional product to cover the rejected items. There is also additional labor cost associated with doing a closer inspection of new product received from his distributor before he puts it on the shelf. And probably most importantly, there is the reputation cost of each dissatisfied customer telling ten of their friends about their poor experience.

Do you see how the compounding effect works and how some risks can have more impact on your business than others? So here’s how you perform sensitivity analysis. First, for each potential impact (or probability, if you prefer), estimate a range instead of a single value (e.g. Instead of using $100,000 as a potential impact, use $85,000 to $100,000). Calculate a probable impact (probability multiplied by potential impact, remember) for each extreme of the range. Look at the difference between the two values. You will see that some risks have large differences and some have smaller differences. If there is a large difference, that indicates that your business is particularly sensitive to the assumed impact (or probability) and it will be worthwhile to pay a little more attention to that particular risk.

WARNING: When doing a sensitivity analysis, create a range for each estimated probability or each potential impact, but not both.

As I wrote in Part I of this series, sensitivity analysis is an advanced method. It isn’t required to have a solid risk management program. Sensitivity analysis provides a way to fine tune your understanding – and management – of your business.

That’s it, the four steps of risk evaluation. Does it make sense? Do you see how calculating probable impact can help you determine a level of contingency funding and insurance necessary to cover your risks? Do you see how sensitivity analysis might cause you to manage your business differently? What’s your opinion about the usefulness of risk evaluation?

Evaluate Your Risks, Part II – The First 2 Steps

Tom — Tue, 01 Dec 2009 13:49:52 +0000

In Part I of this series, I described the outcomes of risk evaluation. (It got a little long. Sorry.) In this post, let’s start digging into the individual steps.

What’s Involved in Evaluation?

Evaluating your identified risks involves 4 different activities. As you will see, it’s a lot easier to do the evaluation if you are working in a spreadsheet or some other computer based application. Here are the four steps, in order:

Estimating the probability of the risk occurring
Estimating the potential impact if the risk does occur
Calculating the “probable impact” of the risk
Evaluating your business’ sensitivity to the risk

Estimating Probability

The first step of risk evaluation is by far the most subjective. What we’re doing here is trying to estimate the likelihood that the risk will occur. You can do this in terms of percentages (”I think there is a 75% chance that material cost will be $10 per unit greater than planned”) or you can do it using buckets like ‘High’, ‘Medium’, and ‘Low’ and then assign a percentage to each bucket (e.g. High = 75%, Medium = 50% and Low = 25%) later. We will need the percentage values for the calculation step. Don’t worry about having a lot of probability buckets. Three will cover it for you. If you simply can’t live with three, please don’t exceed five buckets. And keep an odd number so you have a bucket in the middle to represent ‘50-50′.

WARNING: Some people (like us engineering types) will be tempted to try to achieve precision by using values like 74% or 87%. Don’t do it. Keep the probability values simple. If any of the last digits in your probabilities are anything other than a 0 or 5, you’re fooling yourself (and nobody else).

Estimating Potential Impact

This step estimates what the impact would be on your business if the risk occurs. Impact can be measured in different ways – sales, profit, cash flow, etc. but it should be in terms of your business’ currency – dollars, pounds, euros. In my opinion, the best measure is in terms of cash flow at some point in time because cash flow makes or breaks businesses. Using the example from above, the potential impact of material cost that is $10 per unit higher than planned will reduce cash on-hand at the end of the year by $20,000.

It is great if you can evaluate the potential impact using financial models that generate impact values, but models are not necessary. You can also use buckets in the same way you used them for probabilities. I recommend using five to seven buckets. Assign a value to each bucket. For the purposes of prioritizing risks, the magnitude of the value isn’t critical and can even range from 0 to 1 if you want. (Example: Low = 0.1, Med Low = 0.3, Med = 0.5, Med High = 0.7, High = 0.9) Note that if you use buckets it won’t be possible to estimate contingency funding or perform a sensitivity analysis.

WARNING, again: Please remember that these numbers are estimates. Precision is not necessary. Round your potential impact values to the nearest thousand or hundred.

If you’re using a spreadsheet for your risk inventory, you’ve now got at least three columns – the risk, its probability and its potential impact. Next time we’ll talk about calculating the probable impact and analyzing sensitivity.

Are you still with me? I know a lot of people are intimidated by math and the word “analysis”. Don’t freak out about this. It’s not a high stress situation. Can you see the potential uses of the evaluation data? How would you use the information in your business?

Evaluate Your Risks, Part I – Why?

Tom — Fri, 27 Nov 2009 15:53:22 +0000

As you recall, the 3 steps of business risk management are:

Identify your risks
Evaluate your risks
Plan for your risks

I’ve written a couple of posts (here and here) about the first step – identifying risks and creating your risk inventory (list of risks and opportunities). I’ve also written about the related topic of identifying your opportunities. It hasn’t been an exhaustive tutorial, but hopefully there has been enough information presented to help you gain a basic understanding of how to get started.

Now let’s start talking about evaluating the risks. (Note: Whenever I write “risks” in this post, I am also referring to opportunities. They are evaluated in exactly the same way.) In this post I’m going to describe what results from the risk evaluation exercise. The next post will get into the specific actions involved in the evaluation.

Why Evaluate Risks?

The risk evaluation yields several important results. When you are done, you will have

A prioritized list of your risks and opportunities
An estimated amount of contingency funding required to cover the most important risks to your business
An understanding of how sensitive your business is to each of the most important risks.

The most important output is the prioritized list, but the contingency funding level and sensitivity analysis provide very useful information. If you have to cut corners stop after #1, but I would encourage you to work towards implementing all three evaluation steps.

Prioritize Risks and Opportunities

The first step of risk evaluation is to create a prioritized list of your risks and opportunities. We will accomplish this by estimating the probability of each risk’s occurrence and estimating the potential impact of each risk if it does occur. You will be able to sort your risk inventory in order of probability (the risks most likely to occur at the top) or in order of potential impact (the risks with the largest potential impact at the top). You may want to focus on the most probable risks or the risks with the largest potential impact – it’s your call. Or maybe you’ll want to look at it both ways. (This is where the advantage of a computer spreadsheet or risk management software comes in to play. A spreadsheet gives you the freedom to slice and dice the data in many different ways.) Now you can focus on just the few most important risks when we move into Risk Management Step #3: Planning For Your Risks.

Estimate Contingency Funding Requirements

If you have financial models available that allow you to generate some realistic potential impact values, risk evaluation will allow you to calculate the amount of contingency funding needed to cover your most important risks. The contingency funding will be based on the concept of “probable impact”. Probable impact is calculated by multiplying the risk’s probability by its potential impact. It is a way to mathematically estimate how much money should be set aside to cover uncertain events.

Here is how it works. We have a risk with a potential impact of $100,000. That means if the risk occurs (100% probable, right? – it is occurring), the impact on the business is $100,000. But what if the risk’s probability is only 50% – how much should I set aside to cover it? The conservative answer is $100,000, but that’s a lot of money to set aside for only a 50% chance of needing it. Using the probable impact calculation, we would put aside $50,000 (50% x $100,000). Granted, we’ll have some trouble if the risk occurs but not as much as if we hadn’t set anything aside. And remember that we have a list of risks, each with their own probability. Some will occur, some won’t, so at any given point you will have ‘extra’ money set aside that you can draw from. If you keep your risk inventory and evaluations current, you will have a real time estimate of contingency funding necessary to cover those risks you consider most important.

Analyze Sensitivity

The sensitivity analysis portion of risk evaluation requires some sort of financial model to test scenarios using your most important risks. Sensitivity analysis helps you understand how sensitive your business is to a particular risk. For example, you have identified a risk that material costs may be $10 per unit higher than planned. You have estimated that the potential impact of the higher material cost risk is $25,000. But your $10 estimate is just that – an estimate. What if the actual material costs are only $5 higher than planned? or $15 higher than planned? Does the risk’s potential impact change a lot or a little?You will find that your business is more sensitive to some risks than others. Sensitivity analysis allows you to identify risks whose potential impacts change more drastically as you move away from your assumed value. It’s definitely a more advanced aspect of risk management that helps you manage your risks more efficiently.

Those are the three outputs of a thorough risk evaluation. The concepts can be a little confusing at first (especially the last 2), but give it some time to sink in. The next post will cover more of the step-by-step, how-to details. In the meantime I would love to hear your questions, comments or complaints if I’ve completely lost you.