Risk can take many forms. I had a reminder the other day while doing some mild off-roading in the Rocky Mountains. We were driving on an unplowed road at dusk with strong gusts of blowing snow and temperatures below 0, reaching -11 degrees without the wind chill factor. Well, of course, the truck got stuck at one point in a snow bank on the side of a very narrow path. It took about 40 minutes to get out. I knew that was a potential risk taking a road like that in those conditions, but on the plus side, I had also tried to prepare for it by having some basic equipment with me to help get out. And truth be told, it added some fun, or at least suspense to the day and made it more of an adventure than a Sunday drive.
We like our security and safety, but sometimes risk can even be appealing as in the risks associated with extreme sports. In those cases, it is the risk or danger that makes something interesting. After all, most people don’t go sky-diving for the view. But typically, businesses don’t like risk or the unknown. Too much risk makes it very difficult to create plans, budgets or decisions about operations.
So how does risk affect businesses? Every piece of your core business model has some exposure to risk or dangers. Some may be security-related such as the cost of crime or loss due to theft. Other risks could be completely unrelated to security, but could be just or more threatening.
Look at all the parts of a business and your core business model. You probably have all or most of the following to some degree or another.
1. Human Resources
2. Accounting
3. Management
4. Proprietary Information
5. Supply Chain
6. Vendors
7. Customers/visitors
8. Facilities/physical locations
9. Manufacturing
Any one of these areas has different risks or threats associated with it. HR may be concerned with the risk of employee turnover, or complaints of harassment or biased treatment. Accounting may be concerned about the number of days of cash on hand or perhaps the worry about the costs of fraud or increased unemployment taxes. Management poses a different set of risks and could be the risk themselves. For example, the wrong strategic response to competition or poor decision-making could severely damage the company. Proprietary information is obviously a huge potential source of advantage over the competition and loss of key info could give competitors an edge, or create a new source of competition from copy cat products. Proprietary info may include contracts with pricing or bid information. And, of course, as technology keeps developing and memory storage gets more advanced, it makes it that much harder to protect key information – just look at the recent Wikileaks scandal and how that information was obtained.
Supply chains and vendors are critical for many businesses, especially if that is the vital source of services or items used to give customers the product. If a provider in the supply chain becomes unavailable, such as a supplier going bankrupt, or a dock strike overseas, your manufacturing supplies could dry up. Do you have a back up source so you don’t suffer delays?
Customers and visitors could pose a risk themselves or be part of your overall risk assessment. In retail, some percentage of customers will actually be shoplifters, taking a cut of your profit. A bigger concern for any organization is that the customers will go elsewhere for one reason or another. Are they unable to spend on your product or service due to their own difficult financial situation? Are there other options in the market place that they might find a better value than yours?
Traditional risk management focuses on avoiding risk (not building in a flood zone), transferring risk (buy insurance) or accepting risk (“let’s hope that doesn’t happen"). To really understand risk, an analysis should look at each part of the core business model and also the related risk. Every situation and every organization will be different. A full enterprise risk analysis should look at the potential problems from a financial perspective, operational view, market risk viewpoint and also security concerns.
Remember to think about what keeps you up at night and more importantly, what should keep you up at night. Then you can take the right steps to deal with the risks that most threaten your organization.
No comments:
Post a Comment