|
Conducting business has always been a risky proposition, and all businesses
have some tools in place to manage risk. Companies insure
against losses, institute safety, health, and environmental procedures,
lobby governments, hedge currencies, trade commodity futures, and
protect their IT systems with firewalls and other measures. But generally
these decisions are silo-based: managed by plant managers, country
managers, finance departments, and IT administrators. While these may
have sufficed in the past, they are inadequate in the era of interdependent
risk. No one department or business unit (or even one company)
has the peripheral vision needed to manage these risks.
What’s more, the trend in corporate governance reform over the
past few years means that more corporate boards have new legal
responsibilities for enterprise-wide risk management. Since the mid-
1990s and particularly after the accounting scandals at Enron,
WorldCom, and others, standards bodies in Australia, New Zealand,
Canada, Germany, the United Kingdom, and the United States have all
emphasized the board’s responsibility in identifying and managing business
risks.
Facing greater risks, many businesses are at a loss, and ask questions
such as: “What can we do about acts of God or terrorists?” or “Aren’t my
competitors just as vulnerable as I am?” They may believe that they cannot
afford to take risks, or, having taken risks already, they cannot afford
to invest in risk mitigation, believing that it will increase their costs, slow
them down, and make them less competitive. Managing risk, however, is
about becoming more flexible and competitive, not less. Risk must be
examined in the overall context of corporate strategy and market opportunity,
but the old adage still applies, “There is no reward without risk.”
As a result, companies are turning to strategic risk management to
improve outcomes while continuing to actively engage a volatile global
business environment. More than just a checklist of safety measures, a
strategic risk management approach identifies the core processes that
drive a company’s earnings and monitors both internal processes and
external events to ensure that risk and reward are continually reevaluated
and rebalanced. It is a dynamic approach demanded by a dynamically
changing global business environment. The ultimate goal is,
through an iterative process, to help companies evaluate their risk management
process in the context of a structured “stages of excellence”
approach.
Rather than cataloguing all the possible risks a company might face,
the first stage in strategic risk management is to understand the company’s
internal processes in order to isolate the most relevant and critical risks.
Once a company understands its own
internal vulnerabilities, it can monitor
the external environment for danger
signs and then begin to create mitigation
and contingency plans accordingly.
While companies may not be
able to prevent disasters, they can
reduce the impact by understanding
how their operations may be affected.
The goal is not to eliminate risk altogether (an impossible proposition) but
to develop operational resilience, foster the ability to recover quickly, and
plot alternative courses to work around the disruption.
While global corporations are vulnerable to many of the same risks,
each company has a unique risk profile. There are five key steps in the
development of this profile:
Prioritize earnings drivers. The first step is to identify and then map a
company’s earnings drivers, which provide operational support for the
overall business strategy. These are the factors that would
have the biggest impact on earnings if disrupted, and a shock to any one
could endanger the business. For example, a financial services firm
might depend on information technology to the extent that even 10
minutes of downtime could have a major impact on earnings. A consumer
products company depends on its brand reputation.
Identify critical infrastructure. The next step is to identify the infrastructure
—including processes, relationships, people, regulations, plant,
and equipment—that supports the firm’s ability to generate earnings.
Brand reputation, for example, might depend on product quality control
processes, supplier labor practices, and key spokespeople within the firm.
Research and development might depend on specific laboratory loca
tions, critical personnel, and patent protection. Again, every company is
unique, and even companies in the same industry will prioritize their drivers
differently. The goal is to identify the essential components required
for the earnings driver. One way to do this is by asking, “What are the
processes which, if they failed, would seriously affect my earnings?”
Locate vulnerabilities. Having mapped the critical operational infrastructure,
the next step is to identify the main vulnerabilities. What are
the weakest links, the elements on which all of the others depend? It
could be a single supplier for a critical component, a border that 80 percent
of your products must cross to get to your key markets, a single
employee who knows how to restore data if the IT system fails, or a regulation
that makes it possible for you to stay in business. Vulnerabilities
are characterized by:
• An element on which many others depend; a bottleneck
• Processes with no alternatives
• Association with high-risk geographic areas, industries, and products
(war or flood zones, or economically troubled industries, such
as airlines)
• Insecure access points to important infrastructure
Notice that the focus is still on the internal processes rather than
potential external events. In many ways, the impact of a disruption does
not depend on the precise manner in which these elements fail. Whether
your key supplier fails because of a fire in a plant, an earthquake, a terrorist
attack, or an economic crisis, you may have the same response plan.
Develop responses. After mapping its risk profile, a company will have
detailed knowledge of its operational vulnerabilities and how these relate
to its strategic goals and earnings. Simply understanding these vulnerabilities
at the enterprise level will clarify critical decisions. The decision
to move production from South America to China, for example, will
have a clear impact on the company’s risk profile, as will a decision to
adopt new corporate social responsibility standards.
But completing a risk profile will also bring to light opportunities to
reduce risk while at the same time indicating the value to be gained. Risk
mitigation plans can be put into two broad categories: flexibility and
redundancy. Flexible responses generally require advanced planning but
little or no upfront investment and include:
• Identifying alternate suppliers
• Identifying alternate modes of transportation
• Using products designed for rapid switching of components
• Adopting manufacturing designs for rapid switching of products
• Having multiple (flexible) locations for various tasks
• Identifying additional production capacity
• Cross-training employees
Redundant solutions, on the other hand, generally require an investment
in capacity that may not be needed and include:
• Increasing inventory
• Developing a cadre of alternate suppliers
• Preparing back-up IT and telecom systems
• Holding unused capacity
• Fostering long-term supplier contracts
Monitor the risk environment. For each vulnerability, there will be a
number of potential responses. In order to evaluate which responses
are most appropriate, it is necessary to look at the external environment.
To be sure, some risks—notably, the wild cards, such as a worldwide pandemic or a simultaneous
resurgence of terrorism in several countries—defy easy countermeasures.
But most other risks—those that affect a specific country,
region, or industrial sector—are manageable. By gauging the likelihood
of various events, the company can evaluate how much to invest
for each vulnerability. A company’s risk profile is constantly changing
—economic and market conditions change, consumer tastes
change, the regulatory environment changes, as will products and
processes. It is essential that the company’s risk map change in tandem,
implementing an early warning system so contingency plans
can be activated as soon as possible. Although a detailed development
of a company’s risk management profile is a fairly elaborate process,
a simple self-assessment can quickly identify the largest gaps.
Clearly, being able to reduce the costs of a disaster is a major benefit
of risk management. But risk management is much more than an insurance
policy that kicks in after disaster strikes. By understanding the relationship
between corporate strategy and risk profile, corporations can
ensure that they are not taking unnecessary risks, while at the same time
reducing the potential impact of essential risks. Through flexibility and
redundancy, companies can react quickly to changes in the marketplace,
whether those changes are as common as varying consumer demand or
as rare as political revolutions. The agility that results will ultimately
allow corporations to maintain their equilibrium and come out on top,
even in a world perpetually out of balance.
|
Disclaimer
