Risk Management

Small and medium enterprises are prone to various risks that may stagnate their capacity to grow or even threaten their existence. It is therefore important that the entrepreneur (and his team) understand what risks the business is likely to be, or already exposed to, and what mitigating measures should be put in place.

1) WHAT IS ‘RISK’?: From a business perspective, risk is the combination of the probability of the occurrence of an event and its consequence. The two factors, probability and consequence, are important in identifying, classifying and managing any risk. For instance, there is no risk if an event is unlikely to occur or there is no consequence if the event does occur.

2) WHAT IS RISK MANAGEMENT?: Risk management refers to the deliberate process of identifying and recognising risks, and developing methods to eliminate, minimize or manage them. This process involves:

• Risk identification and recognition,
• Risk assessment (and prioritisation),
• Risk monitoring, and
• Risk control.

The way to identify and manage these risks are as follows:

1. First, identify the events, which could cause a loss or disruption to the business. These events should then be analysed to ascertain the likelihood of their occurrence and the consequences of the occurrence. A simple way is to start by assessing each event as ‘very likely’, ‘moderately likely’ or ‘very unlikely’. Then prioritise them by putting a financial value on each,
2. Attend to the most likely and most ‘expensive’ events first,
3. Develop a response and procedure commensurate with the risk,
4. Put in place a monitoring system to ensure compliance, implementation and effectiveness of the detection, prevention and remedial action system.

3) IMPORTANCE OF RISK MANAGEMENT: Risk management enhances the chances of business survival and growth. Risks can impair the proper functioning of a business, thereby making it difficult to serve its customers, generate revenue and make profit. Some risks will impair certain part of a business whilst others can shut down the whole business. It is necessary to develop control measure for both ‘local’ risks (as to those affecting only a business unit) and ‘global’ risks (as to those affecting the whole company).

Reduced insurance costs, down time, and inventory losses are some benefits of proper management of risks. Effective risk management ultimately enhances the cash flow of a business. This engenders confidence in the business from employees, customers, creditors and suppliers. All these will make the business more stable thereby improving the chances of further growth.

4) TYPES OF RISKS: Obviously each business and industry faces different risks that may arise from internal weaknesses as well as external threats. For the purposes of the small and medium business owner however, we can classify risks into ‘internal’ and ‘external’.

Internal risks refer to all those risks that may crystalise as a result of the internal weaknesses of the business. Generally, these are easier to foresee and mitigate. They may include the following, amongst others:

Operational Risk: This is the risk of loss arising from inadequate or failed internal processes, incompetent or dishonest people, weak systems, etc.

Administrative risks: Lack of proper administrative controls and procedures that may negatively affect employee supervision and productivity.

Human risks: These may include illness, injuries, or death of owner(s), key staff etc.; fraud, low employee morale; resignations, litigations, sabotage, etc.

Equipment risks: When you are running a manufacturing facility, you run the risk of old equipment failing, thereby resulting in downtimes, missed deliveries etc. Older equipment might run slower, cost more to maintain etc.

Financial risks: Financial risk refers to the chance that a business’ cash flows are not sufficient to discharge its financial commitments. Financial risk, therefore, relates less to a business’ operations themselves and more to the amount of debt a business incurs to finance those operations.

Reputational Risk: Reputation is the most valuable intangible asset of the entrepreneur and their business. Any event that could jeopardise it should therefore be taken seriously. A “reputational risk” may crystallise when, for instance, when you fail to honour your trade commitments.

External risks on the other hand, are risks that might crystallise as a result of actual occurrence of external threats. They might include the following:

Business risks: Business risk refers to the chance a business’s cash flows are not enough to cover its operating expenses (such as cost of goods sold, rent and wages, etc.). Unlike financial risk, business risk is independent of the amount of debt a business owes. Business risks might arise as a result of competitor(s) being able to sell their products much cheaper, thereby making it difficult for the business to cover its costs.

Market risks: This is the risk that the value of your trading assets will decrease due to changes in the market place. This is different from business risk in the sense that here, you may hold stock of your products whose market value you know today. However, if an importer brings similar products and sales them cheaper than you in the market, you could loose value in the stock you hold. Essentially, the distinction between market risk and business risk parallels the distinction between market-value accounting and book-value accounting.

Credit risks: Credit risk is the risk of loss that occurs when a counter-party does not make payment on the debt that they owe your business. This is a major risk for small businesses unless properly contained by appropriate business policies.

Government  and regulatory risks: This is the risk that a change in laws and regulations will materially impact your business, sector or market. Changes in regulations can increase the costs of operating a business. It may also serve as an incentive for potential competitors to come in thereby changing the competitive landscape.

5) RISK IDENTIFICATION: Your business plan must comprehensively identify risks and prioritise them. Any likely event that could affect your operations, sales, cash flow and profitability should be identified and ranked. This review should be made regularly with your team and on a periodic basis. Your field staff at various levels can provide useful information and should be involved. Discussions must be be frank, robust, detailed and sincere. Interacting with professionals and competitors will help you further appreciate the business specific risks that you face.  Regular business assessment will either bring up emerging risks (which should then be assessed and mitigating measures put in place) or ‘dead’ risks should be eliminated to enable you focus on the emerging ones.

Warning Signals: Frequent business and risk review will bring up signals that can serve as warnings to potential disasters. The following could be very important indicators:

1. High employee turnover rate
2. Reliance of few customers
3. Reliance on monoproduct
4. Cash flow problems
5. Poor financial ratios
6. Dwindling customer orders

A thorough understanding, and constant review, of your macroeconomic environment will also help you detect looming risks.

6) RISK EVALUATION: SWOT analyses is a very good ground on which to start your risk assessment and evaluation. Having identified risks that you face, the next thing to do is to assess the likely impact of each. As we mentioned earlier, the consequences and likelihood of an event occurring determines the response and measure that should be put in place. For each risk that you identify, you have to assess the severity of the damage that it could cause. This should form the basis of:

1. What specific measure or measures should be put in place to forestall its occurrence,
2. What remedial measures should be taken in the event that the risk does crystalise,
3. Exactly who should do what in any given situation, and
4. Timing of each measure that should be taken.

7) RISK CONTROL: Each risk identified and assessed must have a control measure(s) put in place. Some risks can be completed avoided. Others can be reduced or transferred, whilst others can reasonably be accepted. Depending on your business, situation and the risks identified, the following measure(s) might be put in place:

1. Incorporation: Ensure that you business is legally registered. Retain a lawyer to ensure that you are up to date in compliance with your registration authority. Where you have other shareholders, make sure you have a duly executed Shareholders Agreement,
2. Ensure you obtain general and any specific licences for you to operate your type of business. Where renewals are required, develop a simple system that will trigger the renewal process before expiry of your current license (allowing for the time it takes for the renewal to be approved),
3. Financial records: Keep your accounts properly and ensure that you make statutory payments as and when due. Retain and accountant to help you meet the various obligations,
4. Employees: A simple but detailed employee recruitment policy and guidelines should be drawn up to attract the right employees and retain them. This should be backed by employee manual with all necessary details. Issues such as disengagement procedures, confidentiality and non-compete agreements can all considered, discussed and agreed upon. At the end of the day, an employment contract should protect both parties,
5. Your employees must also be made to fully understand the capabilities of your organisation and ensure that they always deliver what they promise to their customers and other stakeholders. Whenever they are unlikely to meet what was agreed to, they should communicate in advance and get the other party’s understanding. Wherever possible or necessary in such situations, they should offer some compensation,
6. A frequent risk associated with employees, particularly with small and medium busienness, is the over reliance on an employee or a few key employees. Such employees are allowed to keep too much information and other business assets that are critical to the business. You have to avoid this by making sure that the organisation properly internalizes resources,
7. Insurance: Identify all areas of your business where insurance covers may be required either by law or really just in your own business interest. Appropriate insurance can offer asset protection covers as well as against claims from third parties. Vehicles, office equipment, plant etc should all be reasonably insured. Goods-in-transit, fire, burglary and special perils should be covered depending on your situation and circumstances,
8. Premises protection: is particularly important when the location you operate is critical to your business. You have to plan to ensure that rents, rates, and any leases thereon are paid on time to avoid disruptions,
9. IT Systmes: With growing significance of information technology in businesses, it is important that you take specific measures to protect your IT assets and secure the information you have. Make regular backups and ensure that you have at least one off site backup,
10. Customers: It is important you have deliberate measures to protect your business against the risks that customers could expose you to. You could for instance, be forced out of business if you rely entirely on one or few customers. Customer and product diversification could shield you against that. Work to reduce the likelihood of dispute with you customers by having very clear and upfront agreements. Credit risk issues should all be addressed,
11. Vendors: As with customers, you should manage your vendor risk by procuring your supplies from a reasonable number of vendors. You should however be professional and upright by not divulging the confidential aspects of each relationship. Where appropriate and sensible, lock your vendors into long-term contracts,
12. Service plans: Have service plans for the regular maintenance of your office and factory equipment. This is to reduce or eliminate the risk of breakdowns. Sometimes, it is necessary to include redundant assets at critical points in the office or the plant to eliminate certain risks.

Always remember that success in business comes by doing so many things right. Managing risks is one of the key responsibilities you have to discharge diligently and competently to stand a chance to succeed.