Risk management

What it means

Risk management is an ongoing process in which a company identifies what could threaten its objectives, assesses how likely and serious these risks are, and decides how to respond. It covers financial, operational, legal, tax, IT and reputational risks.

The assessment is often shown in a risk matrix combining likelihood and impact. There are four basic responses to each risk: avoid it, reduce it through measures, transfer it to someone else, for example by insurance or contract, or knowingly accept it.

Risk management is closely linked to internal control, compliance and the business continuity plan. While internal control deals with day-to-day procedures, risk management looks ahead and asks what could go wrong.

How it works in practice

With clients we start with a simple list of the ten biggest risks, assigning each an owner, likelihood, impact and response. For small companies these are often dependence on one customer, losing a key person, running short of cash or a tax error.

For financial risks, scenario analysis helps: what happens to cash if the largest customer pays two months late or interest rates rise? The results show the buffer or credit facility needed.

Some risks are worth transferring. We review with clients the scope of property, business interruption and liability insurance and contractual limits of liability towards customers. With suppliers, vetting and spreading purchases help.

What to watch out for

A risk list written once and never revisited is not risk management. Risks change with the company and its environment, so we recommend reviewing them at least once a year and with every major change.

The greatest damage is often done by risks that seemed unlikely but had a big impact. For those, looking at likelihood is not enough; there must be a procedure ready in case they happen anyway.