Profile – Risk Strata – Risk Management Consultants

How do entrepreneurs manage business risk?

When I saw this question pop up in my “People also searched for…” list of a Google search the other day my immediate, somewhat flippant, response was: “very badly”. But the more I thought about it the more I began to feel that the answer was, as any good agile coach or scrum master would say: “it depends”.

It depends on how you evaluate a risk management system.

If you evaluate it by the presence of policies and guidelines, appetite statements, governance forums and reporting, issue and action management frameworks and risk profiles then for the most part, yes, they tend to manage it very badly. But if business is all about managing risk (and it is) and the success of your business depends on how well you manage that risk (which often it does), then the fact that at least some entrepreneurs are successful must mean that there is a degree of success in their risk management approach – even if by accident.

The thing about most entrepreneurs, in my experience anyway, is that they don’t think about risk as a thing – it is entwined in the very fabric of their business because much of the decision making is very closely held by the entrepreneur themselves. This model works for them because they don’t need a widely distributed set of frameworks, policies or appetite statements. They hold all of these in their head – not so much in a specific metric or threshold, but in a gut feel of comfort – and they use this gut feel frequently when making day to day decisions in their business. In reality, they are managing risk in their business without even knowing it.

But… – there’s always a “but” – there are two flaws with this approach – how big they are probably depends on the type of industry or business that the entrepreneur finds themselves.

One of the challenges for (and most frequent criticisms of) entrepreneurs is that they spend an inordinate amount of time working IN their business and insufficient time working ON their business. This is often due to a desire to minimise costs and they do more work themselves rather than employing staff – and that is completely understandable. What that often means, though, is that entrepreneurs often don’t have a particularly long lead time into challenges in their business because they haven’t spent the time to develop or understand the key metrics or indicators that could warn them when things are not fully on track. As a result, many entrepreneurs run their businesses in a state of persistent crisis, lurching from one potential disaster to the next. Sometimes they get it right and sometimes they aren’t so lucky. Subtle indicators that could alert them to problem areas in parts of their business that they aren’t necessarily focused on at that time could allow them to make decisions to correct or solve problems before they become crises. This results in an overall smoother operation as there is more sustained focus and attention on what matters without distraction from the latest crisis.

The second flaw with this approach is that if you are making decisions based on gut feel then your decisions will vary based on how your gut happens to feel at the time – with no clearly articulated or documented parameters. This results in inconsistency in that decision making and what felt like good decision today, may not be tomorrow. You could even end up being presented with the same, or similar, situation at different times and end up with two completely different decisions resulting in two completely different outcomes and have no idea why you did what you did.

Many businesses, small and large, pride themselves on their agility, their ability to be nimble and adapt deftly to the circumstances and obstacles that are presented to them. If you follow the principles of lean six sigma or agile or any number of other efficiency processes, you will know that they all share a dogma around minimising task switching as a pathway to efficiency in the way the brain approaches work.

I recall attending a post incident review meeting at a large organisation I was working with on one occasion and the comment was made that we should be careful to introduce a risk assessment step ahead of a significant change because the engineers were all busy and this would distract them and take up their time. I looked around the room and couldn’t help but draw attention to the number of people sitting around the table and on the phone, their roles in the organisation and what their hourly rate must be for the hour or two that the meeting was scheduled for. Robust risk assessment may be a distraction at the start of the process, but it’s not nearly as distracting, time consuming or expensive as it is to fix the problem afterwards.

The same can be true for entrepreneurs or small businesses in general. Establishing robust risk frameworks and clearly articulated appetite settings (coupled with good and regular reporting and analysis of the same) can all sound very over the top and time consuming, but often not nearly as much as fixing the problems presented after the fact because you didn’t notice a problem in time or because you lost good staff who got tired of the state of constant crisis or the inconsistency within which they were operating as the basis of decisions seemed to change from hour to hour, day to day.

Therein lies the trick to good risk management. You can’t (and shouldn’t) just lift and drop a standard solution from one business to the next. It needs to be tailored to suit the needs, the size and scale of your business and the entrepreneur is pivotal to that process – because NOBODY knows the business as well as you do.

Risk Strata is a sound risk advisor and partner that you can trust to help you work through these complexities and the process to understand your business risk, articulate your risk appetite, build appropriate risk metrics and implement right sized risk policies and processes. We specialise in supporting small and medium businesses with outsourced risk management services. Send us a message from our Contact page if you’d like to have a more detailed discussion in confidence.

5 Fraud tips every business leader should act on

It’s International Fraud Awareness Week – how well do you respond to the risk of fraud in your business?

Understanding the risk and having ideas to act are a good start – we can help you develop a plan to turn those ideas into real actions and controls that can protect your business. Contact us to set up a time for us to talk through your business risk and see how we can help.

How do perpetrators conceal their frauds?

It’s International Fraud Awareness Week – a good time to reflect on the risks that face our businesses and how we can control them.

Controls don’t stop bad things from happening, but they can help you prevent bad things, detect that they are happening or mitigate the impact of those bad things when they do happen. To build effective controls you need to understand the vulnerability and then design controls to fit the profile of the risk.

We can help you understand your vulnerabilities and your risk profile so that you can build effective controls to keep your business safe. Contact us to arrange a time for us to meet and discuss your risk needs.

The Importance of Risk Profile Assessment in Business: Factors to Consider

What is the biggest risk to your business?

Do you know? Do you know how you are currently controlling it or managing it? Do you know how severe it is or what effect it could have on your business if it were to happen?

In today’s dynamic and uncertain business environment, understanding and managing risks effectively is crucial for the success and sustainability of any organization. A risk profile assessment serves as a fundamental tool for businesses to identify, evaluate, and mitigate potential risks. When this is combined with key risk indicators in your risk appetite statement and an evaluation of your control environment you get an effective benchmark of how well you are managing your business and how effective your control environment is. By systematically analyzing risks, organizations can make informed decisions, allocate resources efficiently, and enhance overall risk management strategies.

Importance of a risk profile assessment

A comprehensive risk profile assessment starts with the identification of risks applicable to the business. These may be grouped to create a map of risks in various categories and sub-categories to comprehensively cover the entire scope of the business. When you assess these risks at their most granular level possible and then aggregate up to each level above it, it provides senior managers with a clear understanding of where their greatest vulnerabilities to their operations reside and where the greatest and most important improvements are required.

A good risk profile should include a range of both internal and external risk factors, such as staff theft or data loss, compliance breaches or regulatory changes, technology and cyber disruptions or practice failures and strategic business risks.

Strategic decision making

Understanding the risk landscape is essential for strategic decision-making processes. A risk profile assessment provides critical insights into potential risks associated with new ventures, investments, or expansion plans. By evaluating risks and their potential consequences, businesses can make well-informed decisions, weigh potential rewards against risks, and develop appropriate risk mitigation strategies. This proactive approach enhances the likelihood of successful outcomes and reduces the chances of unexpected setbacks.

Risk appetite

Before you even begin to assess each risk you need to determine your risk appetite. Risk appetite refers to the amount of risk an organization is willing to accept in pursuit of its objectives, while risk tolerance represents the organization’s ability to withstand potential losses. By aligning risk management strategies with the organization’s risk appetite and tolerance, businesses can strike a balance between risk-taking and risk mitigation.

The trick is to simply and effectively articulate a definition for the risk appetite that can be used to assess risks at different levels. At what point does a risk become material or even catastrophic to your business. This is the first step in building the map against which you measure the risks – often called a 5-by-5 (5 x 5) matrix or a heatmap. It maps the likelihood of a risk eventuating within the next 12 months against the impact of the risk, should it eventuate to determine a position on the heatmap. Depending on your appetite these coordinates will determine whether the risk meets your criteria for being either Low, Medium, High or Very High to your business.

The impact of a risk should be assessed against the key factors that are important to your business and what the consequence of the risk may be against them. These could be factors like Financial consequences, Regulatory consequences, Customer impacts, Staff impacts or other factors that could affect your business operations or wider reputation.

By evaluating risks based on their likelihood and potential impact, organizations can prioritize their mitigation efforts and allocate resources accordingly.

Inherent and Residual Risk

For each risk it’s worth evaluating both the inherent and residual risk positions. This helps assess the sufficiency of the control environment that has been put in place to contain the risk. Controls aren’t about stopping bad things from happening in your business, their purpose is to contain those bad things within your appetite.

Inherent risk is the assessment of the likelihood and impact of the risk in the absence of any controls across each of the impact categories. Residual risk is the assessment of the likelihood and impact of the risk once controls have been taken into account. As part of this you should consider whether the state of each individual control and whether collectively they are effective, require improvement or are wholly unsatisfactory. That will help guide the effect they have on reducing the likelihood or impact of the risk should it occur. You should also consider any work underway to fix controls, any incidents and what effects they have on the risk or the controls.

By comparing the inherent and residual risk positions on the heatmap or matrix you can determine whether the risk is sufficiently contained to within your appetite and then focus on measuring it until your next assessment.

Resource Allocation

Limited resources are a common challenge for businesses. A risk profile assessment helps organizations allocate their resources effectively by identifying risks that require immediate attention and those that can be managed or accepted without significant impact. By focusing resources on critical risks, businesses can enhance their ability to respond to potential threats, minimize losses, and maximize returns on investment.

Stakeholder Engagement

Engaging key stakeholders, such as leaders and employees, is crucial during the risk profile assessment process. Stakeholders often possess valuable insights into potential risks and their consequences. Their involvement not only enhances the accuracy of risk assessments but also improves risk communication and fosters a risk-aware culture within the organization.

A robust risk profile assessment is a vital component of effective risk management in businesses. By identifying and evaluating potential risks, organizations can proactively develop strategies to mitigate risks or exploit opportunities with a deeper understanding of their relative strengths and weaknesses.

Whilst the above taste of a risk profile may sound complex (and it can be), a lot of the groundwork is a one-off effort which, if done well, can be reused every quarter or annual review cycle.

Risk Strata is a sound risk advisor and partner that you can trust to help you work through these complexities and the process to complete a risk profile and understand your business environment better. They can also recommend ways that you can build, enhance and map controls to protect your business and close vulnerabilities. Send us a message from our Contact page if you’d like to have a more detailed discussion in confidence.

Returning to appetite

In a few of these blog posts I’ve referred to a risk appetite. There’s no way I’m going to try to sell you that an appetite of risk is comparable to a tasty morsel of any sort. All businesses carry some degree of risk – the risk appetite is how much you’re prepared to carry in your business. The risk you’re prepared to carry is called the residual risk and the risk that exists assuming you do nothing about it is called the inherent risk. It’s very rare that you would find (or should accept) that the risk in the environment (inherent) is what you’re prepared to accept – because it means you’ve either underestimated that risk or you’re over-exposed. To bring the risk down from inherent to residual requires you to invest time or money in planning or building contingency and controls for your business. The work associated in doing that is often called a “Return to Appetite” plan – because you’re bringing the risk to within your acceptable appetite.

A ”Return to Appetite” plan (or RTA) usually includes outlining some key measures or metrics that will be tracked to tell you when you have achieved your return and are now within appetite.

In my experience chasing the numbers is a horrible strategy because once you achieve the numbers it can often result in complacency where you linger under the false belief that the numbers are good, so everything is fine – but what if the numbers have missed something. Don’t misunderstand me – you absolutely need the numbers to keep you honest and help you to monitor progress, but it’s a far better strategy to build a good framework, implement discipline and a strong risk culture – start doing the right thing and the numbers will gradually start to improve organically. Chasing numbers for numbers sake means the depth of culture and improvement is not there and your return is superficial. You’ll end up in a constant cycle of being within appetite and then dropping out and then returning and then dropping out again.

Building discipline around frameworks, processes and systems, is a much more enduring strategy and with that increased rigour you’ll see the numbers improve on their own. Manage risk appropriately because you want to manage it well for your business, not because you’re just trying to make some box on a chart turn green.

To be honest, that oversimplifies what’s involved in a good RTA. A good RTA requires a thorough understanding of not only the risks of the business, the appetite settings, but also the controls, the state of those controls and reporting. Essentially an RTA is a litmus test of the entire end to end risk management environment within a business and then on top of that, identifying the work or tasks required to improve the environment. All of this sounds like a lot of work and expense – and it can be – but how much work is up to you. You can adjust the appetite to say do less work, but be prepared to accept more risk, so if an event were to occur, you’d rather absorb the impact of that event on your business. Ultimately the appetite setting is yours and the RTA should be integrated to your business risk profile. So how well do you understand either of those for your business?

Remember it’s quite possible that not all risks will be out of appetite for your business at the same time. The first time you do the exercise, yes, it may be a lot of work and could be expensive. There’s a peace of mind that comes with that and following that initial success, an annual review and minor tweaking should be all that’s required. It’s really only inaction or material change to your business or environment that would lead to a major piece of work like that again.

Risk Strata specialise in helping businesses understand their risk profile and implementing processes, controls and frameworks to effectively manage those risks so that you can make informed decisions to keep your business safe and healthy. We can tailor a package of services to meet your needs from basic profiling right through to the design and implementation of control frameworks, reporting metrics and appetites and training for yourself and staff. If you want to understand your business better, “let’s talk”.

The Risk Onion

Over the last few weeks there have been numerous reports in the news media of ram raids of similar delinquency targeting a range of businesses, including small businesses. It got me to thinking about controls. There was one comment, in particular, from the owner of a chain of shops, with reference to ram raids. He said: “…forget about bollards [in front of shop doors], if they can’t crash through the door with a vehicle, they will take a hammer to the door instead…” [or words to that effect].

My initial reaction was a thought back to an old cyber-security lecturer I had, who suggested that there was no such thing as an infallible cyber-security mechanism. In cyber-security, just as in your own personal house, the determined burglar will find a way in – the best your security arrangements can do is to make the effort unpalatable or slow them down sufficiently for you to take action. As I thought about that, I don’t know why I was surprised, but it resonated with a general concept of risk management that I have reminded people in business of countless times. The purpose and object of controls is not to stop the risk from eventuating, but to contain it within an acceptable appetite.

In reality you wouldn’t just rely on a single control to protect your computer network or your house, but you would have layers of controls for that protection – the same is true for your business – you have layers of controls to protect against risks. In saying that, again, those controls are not designed to stop the risk from happening – you could do that, but it’s likely the controls would be extremely restrictive on your business.

You might have a username and password on your computer. That’s one layer. Perhaps you have a firewall. That’s another layer. Maybe remote access is controlled by a VPN. That’s another layer. You may operate Intrusion Protection Software. That’s another layer. For your house, you likely have locks on your doors. Perhaps you also have locks on your windows. You might have a burglar alarm. You could implement retinal scan, guard dogs, security patrols, electrified fencing and rotating invisible laser beams to detect movement or foreign bodies, but the cost of doing so – and the inconvenience – may well exceed the need for the risk – or outweighs the benefit of simply buying insurance. This is an example where there are a significant number of controls available, but our appetite to defend against the risk doesn’t extend so far as to incur that level of cost or comfort.

So, if you are facing an increase in ram raids, bollards may not stop them, but they do likely represent the first layer in your defensive controls. How far you go to implement additional layers of control depends on your appetite to defend against the robbery.

Where is risk?

My wife and I visited a local coffee shop the other day and while we were sitting there enjoying the coffee, and the novelty of being able to go out and support the hospitality sector again, it got me thinking about the types of risks in their business. Obviously, the recent pandemic came to mind, but who could ever have predicted that. COVID in the multiple forms it took is (hopefully) a once in a lifetime event. It’s what we in the risk fraternity would refer to as a “black swan” event (I don’t know why – black swans aren’t all that rare – especially if you look around the central lakes of the north island). In fact, it’s the sort of event we try to imagine and plan for when “stress testing” our disaster or risk scenarios – that is we look at the scenario and let our pessimistic minds run wild to guess just how bad it could get. In saying that, I doubt many of us in any of our scenarios got quite as complex as COVID – we probably considered people dying or being off work, but the complexities of lockdowns, isolation, MIQ, labour shortages, etc, likely struggled to make it into those scenarios.

This is where the idea of thinking about risk for those businesses became particularly interesting. Most businesses look at risk and they think of an immediate event that has an immediate impact. In the case of hospitality, this could be something like, what do I do if one of my fridges breaks down? Where do I keep the food cold? How can I source another one? Or, based on historical experience in Auckland, what happens if there’s an extended power outage? You might even consider, what happens if the building I operate from is condemned or requires extensive repairs? Most of these are what we call “Business Continuity” Risk scenarios. They absolutely are risks, but they’re usually short term and unpredictable. Most often they would either be accompanied by some form of civil remedy (which, yes, could take ages to eventuate through the Courts) or would be accompanied by some form of Government assistance. In the case of COVID, certainly the government support was woefully inadequate – so what could those businesses have done.

Building risk scenarios is an important part of managing risk and building resilience in your business, so that when an event does occur, it doesn’t mean you aren’t affected, but it gives you peace of mind that you are protected, and the impact is contained to within an acceptable standard of risk. This containment is in the form of controls. You might have some offsite cold storage, or an emergency back up generator, or a shipping container or food caravan you can operate from instead. All of these are controls that don’t pretend to allow your business to operate at the same level as previously but give you peace of mind to know that they are there and will mitigate the impact should an event occur.

Understanding your business’ vulnerability and testing whether you have controls in place can give you peace of mind to know that you have some protection. It also means you’re putting mechanisms in place to protect your business rather than having to make knee jerk decisions under pressure that might have unintended consequences or may not deliver the best or most efficient outcomes for your business. It also means you’re thinking about your business and ensuring you have appropriate mechanisms in place to alert you to problems early – again for example regular monitoring of fridge temperature could tell you a fridge needs to be replaced which is a much better indicator than coming in one morning and discovering a fridge full of soiled product.

Would this process have predicted the COVID impact or response for many of these businesses? I doubt it. But we are learning all the time and we use our experience from the past to better prepare us for the future. I can bet you almost certainly that there won’t be many risk scenarios developed in the next twenty years, that won’t include some form of pandemic assessment and won’t use the experience of the last 3 years as a basis for evaluating the impacts of that scenario on any business. Few scenarios up until now would have included a line saying: “What if the government says we can’t operate for the next four to six months?”, but I bet from now on they will.

Remember, risk management isn’t about stopping events from happening – or saying that somehow they won’t impact you. It’s about doing your best to estimate what the event would look like and how it would impact you (and reassessing this year on year as you learn more) and then thinking about what you can do to manage it, to contain it within an appetite.

Is it feasible to bring all your customers into your ‘bubble’? Or to have all your staff and their families in your ‘bubble’ so you can continue to operate? No (although I do know of some businesses that did this), but it might give you pause to think of alternate distribution mechanisms – if your customers can’t come to you – how can you take your product to them?

When it comes to risk management “wait and see” and “hope for the best” are rarely ever the best strategies.