Clive Lewis, head of SME issues at the Institute of Chartered Accountants in England and Wales (ICAEW), offers advice to firms on managing risk.
The UK's most notable event in 2005 was the London bombings on 7 July. While media headlines understandably focused on the human tragedy, few looked at the impact on businesses.
The explosion at the Total oil terminal in Hemel Hempstead appears to have a more direct relevance to business than the London terror attacks because the site was located near to an industrial estate with resulting disruption to companies. It has been estimated that business losses will amount to millions of pounds. The eventual cost and who bears it will probably not be decided for a long time and it is possible that some of the firms will never trade again.
There have been calls for businesses to check whether they are covered by insurance – not only for damage to premises and stock but also business interruption and denial of access cover. Of course businesses should always have appropriate insurance, but 86% of respondents to a recent survey by the ICAEW disagreed with the proposition that adequate insurance for major risks removes the necessity for proactively managing risks.
What should SMEs do to actively manage risks?
SMEs have many demands on their limited financial resources. Bombings and explosions are still, thankfully, a rarity. The answer is they must firstly identify the risks to the business and then manage a prioritised list. The ICAEW survey found that businesses generally rated risks in three broad tiers. Physical threats such as fire and explosion, business interruption and safety of employees were second tier risks.
So how does managing these second tier risk work in practice? Well there are a number of sources of external help for evaluating risks. Insurance broker will usually undertake a check prior to renewing the insurance cover. Compliance inspectors (such as the Fire Service) are also available for consultation on preventative measures. The government’s businesslink.gov.uk website also offers practical, easy tools to help mange a wide variety of physical risks from health, safety and premises to fire safety and security and crime prevention.
In the ICAEW survey, four first priority risks were rated as having the greatest impact. These were people, information and communication technology (ICT), market changes (such as new competitors) and image impairment (developing a poor reputation), which could broadly be described as “Operational risks”.
Having identified the most important risks how can you manage them? Well, the key thing is for the senior managers and/or the Board to formally discuss the risks faced by the business. The following questions might help:
General - Do we have a business plan? What are the main barriers to achieving that plan?
Staff - Who are the key staff? How would the business cope without them? Do we have a succession plan?
ICT - How dependent is the business on ICT? What arrangements are in place to cover breakdowns, failures, etc? How often do we take back-ups of data? Where are the back-ups stored?
Market - Are we aware of what’s happening in the marketplace? How do we plan to meet the competitive threats? Who are our key customers? Are we overly reliant on a few customers? Are any show signs of financial stress? What if one went under?
Image impairment – Are there any market issues which might damage the business’ image? Are quality standards improving?
Again, there are a number of external sources of help. Auditors or accountants can offer assistance in a number of ways from strategic reviews to ICT security advice. The local Business Link might also be a source of advice and the businesslink.gov.uk website offers free advice from marketing and selling overseas to online marketing and e-commerce.
A tool adopted by a number of SMEs is the Risk Management Schedule using a traffic light system - red indicates business critical; amber requires monitoring; and green shows a low risk.
The document tabled at every board meeting identifies each risk, the person responsible for monitoring it, the controls in place, future actions and contingent plans and "Alert Factor" (colour).
So for example, "skills shortage" might be a risk, "training and induction programs" the current control in place and "employment market reviews" might be the future action assigned to the person responsible for HR together with senior management.
The status might be amber or green dependent upon the urgency of the skills shortage. Using such a system, risk management discussions at board meetings might be confined to the red risks and those risks judged to be increasing.
Business is all about taking risks. Very few enterprises have no risk, but risk management is all about awareness and professionalism. It has been suggested that every director should be able to recite the major risks facing the business and identify the way the company is meeting them. How do you measure up?
www.icaew.co.uk