Lastest news

A framework for business risk management

Apr 27, 2019
BY JOHN McKENZIE

In a world of increasing competition, rapid technological development and political and economic uncertainties, the risks faced in almost every significant decision we take are greater than ever before. Business risk assessment is, however, most usually subjective and organisations and managers display differing attitudes and acceptance of risk.
 
Yet, risk sets the tone — perhaps more than any other element — for the direction and aspirations of strategic and business plans developed by management. Our perception of risk not only determines the choices we make and their success, but also the ambition (or lack of) of our aspirations.
 
More objectivity should be brought to business risk management. This can be achieved through a rigorous and standardised process of business case development and risk assessment — a process where the finance and accounting function is at the heart of facilitation, coordination and assessment.
 
A business case should consider, where appropriate:
 
  1. The strategic case for change: this should cover rationale, background, policy context and strategic fit. Are there clear SMART objectives in terms of outcomes? And are dependencies, constraints and risks identified?
  2. The commercial case: is the proposal commercially feasible and deliverable? What procurement is required? Are there key contractual issues and clear milestones and delivery dates? Is risk identified, quantified and managed? What, if any, are the personnel implications?
  3. The management case: is the proposal practically deliverable and what are the delivery plans? Are there clear delivery dates and detailed milestones? Is there a contingency plan with arrangements and provision for risk management? Are benefits realistically evaluated and quantified? Does the plan include monitoring arrangements and post-implementation evaluation?
  4. The financial case: is full funding secured and budgeted? What are the impacts on the P&L account and on the balance sheet? Are potential cost over-runs provided for, and are there any contingent liabilities? Have you performed a risk-adjusted discounted cash flow with appropriate risk and funding discount rates? Are the opportunity costs of already-owned assets included?
The above should be summarised as follows:
 
  • What are we proposing?
  • How will we make it happen?
  • Who will deliver it?
  • When will it happen?
  • Why should we do it at all?
When pondering this final question, we should consider the balance of costs, benefits and risk to make optimal decisions.

Risk evaluation

To aid your risk evaluation, consider these eight risk categories:
 
  1. Forecast and assumption risk: how well have you forecasted in the past? What degrees of uncertainty are there?
  2. Business and market risk: are you extending into new products and services or unfamiliar markets? What is the competitive environment? Are there supply chain/sourcing issues?
  3. Technological risk: are you employing new or unfamiliar technologies? Will technological developments outstrip your plans or make them obsolete?
  4. Implementation and cultural risk: do you have the skills and resources necessary to realise your plans? If not, can you acquire them? Are there cultural and employment impacts that might be disruptive?
  5. Economic and political risk: what is the economic outlook? Are there possible political impacts such as compliance and regulation, tariff and non-tariff barriers and so on?
  6. Optimism bias: does past history suggest that you tend to take an overly optimistic viewpoint in your expectations, forecasts and outcomes?
  7. Discontinuity risk: do you run the risk of business disruption if your plans go awry? Have you the means to mitigate disruption risks?
  8. ‘Do nothing’ risk: is the risk of doing nothing significant in terms of competitive threat, customer dissatisfaction, product or service obsolescence, loss of revenues and so on? You can think of this as a ‘negative’ risk, by which you can offset other risks when considering a risk-adjusted cash flow analysis.
By using a standardised framework encompassing all of the above in your business planning and the construction of business cases, you can bring a more objective approach to the process of risk assessment. Furthermore, it allows you to review past plans and cases, and identify both what you get right and where your planning weaknesses lie. Most importantly, it enables you improve in the future.
 
John McKenzie is a management consultant and lecturer at Chartered Accountants Ireland.