No business is immune from risk. The risks faced could be enough to force a company out of business, to face law-suits or reduce profits. Risk management plays a key role of minimising the risks and the impact that any of these may have on the business.

Every new venture is undertaken with an element of risk. Every human endeavour is fraught with risk. Without risk there would be no advances, no technological changes and no new businesses.

Risk is ever-present in business. A business faces risks from all directions - the economic cycle, competition from other businesses, government actions, from external crime and from internal crime. A business may even be at risk from the weather or employee incompetence.

Risk management takes a number of forms. The first is the formulation of a risk management strategy. This strategy must make provision against the different types of risk that the company faces. These are environmental and competitive risks and physical risks.

The policy should be formulated on the basis of knowledge gained about the environment and best-guess forecasts and through the advice of the internal auditors.

Internal audit is usually very aware of the types of risk faced. In the main these concern protection against threats such as fraud, industrial espionage, security violations, fire and flooding. The internal auditors should also be able to advise on compliance to government and industry regulations.

The risks identified by the auditors should be quantified in terms of the financial risk as well as the cost of protection against risk. The cost of protection must be weighed up against the risk of loss and the probability of that loss occurring.

The risk management policy must also take the environmental risks into account. One way to achieve this is to implement a form of environmental scanning to provide an early warning of new competitive products, of pending legislation and so on.

Insurance may also play a part in risk management. A company may choose to insure high value assets and self-insure the rest, or to insure everything. The choices will depend on cost and the assessed risk.

Many of the risks faced by a business arise from within the company itself. Employees may knowingly or unknowingly provide information to third parties that could be used by adversaries or criminals. Some employees resort to defrauding their employers or the company's clients. Protection against this type of risk is often the most difficult. It may be simpler to protect against the internal rather than the internal threats. Many companies have discovered fraudulent activities within the business - sometimes after many years of embezzlement.

Ensuring that there is a strong internal audit function within the business coupled with a sound set of checks and balances to detect unwelcome activity can provide some protection.

Instituting a risk management policy incurs costs. Each business must decide which risks must be covered and to what extent. Many businesses are happy to live with a moderate level of risk while others are less tolerant.

Learn more about this author, Barry Marcus.
Click here to send this author comments or questions.

---

Add your voice

Know something about Risk management defined?
We want to hear your view. Write now!