by Richard Gomes

Created on: July 25, 2008   Last Updated: July 28, 2008

Risk management is a core competency that enables management to make pragmatic decisions on how best to minimize a business's exposure to harm.

It doesn't matter whether a business manufactures product or delivers services; whether it is in the start up, early growth or maturity phase, it needs to be protected. Risk profiles differ and approaches vary, but successful businesses employ sustainable methods for assessing, addressing, and mitigating the risks they face.

At the top, enterprise risk management is concerned with the Franchise or the 'Brand'. Here strategic planning considers the threats and vulnerabilities that have the potential to significantly disrupt the business, drive down market share, and materially affect the value of the business. At this level, risk is assessed in aggregate across the pertinent operational, financial, legal, and regulatory domains. These assessments are far reaching and their accuracy is dependent on timely and effective metrics collection, analysis, and reporting processes.

This means that at the core of the key operational and functional units of the business, there must be a commitment to the continuous improvement of control processes that:
Protect against known risks
Detect inconsistencies
Correct process failures

In finance, this means using third party rating services to periodically provide credit worthiness data on key partners and clients that is then used in a Credit Risk assessment model. The model itself rates the overall cash flow exposure due to non- or late payment from customers and trading partners while offering insight into potential exposures to disruption on the supply side.

Employee health and safety is another important risk area. Depending on the size and nature of the business, this can have both legal and regulatory implications. The most frequent legal actions in larger companies originate with employees. Defending the company against workman's compensation claims or responding to the Occupational Safety and Administration (OSHA) violations frequently eat up a meaningful portion of the legal budget, have the potential to disrupt operations, and can affect a company's ability to hire qualified people. Here, a periodic self assessment based on OSHA guidelines combined with Human Resources sponsored anonymous reporting tip line' can warn of health and safety issues before they undermine productivity.

A good Risk Management program starts with an assessment. First, identify the important players in your key operational and functional units. For many businesses this means the heads of Finance, Operations, Technology, Legal, and HR. Second, jointly draw up a list of important risks. Usually this is a process that takes more than one session; but the end result should be a high-level list of the risks, their perceived likelihood, their impact, and mitigation approach. Third charge the team with delivering an integrated Risk Program that addresses:
Measuring exposure
Corrective Action Planning and monitoring
Investment requirements

Finally, establish a periodic Risk Review with the team to audit progress, assess Program effectiveness, and to implement improvements.

Learn more about this author, Richard Gomes.
Click here to send this author comments or questions.