Managing Risks in Small to Mid-sized Firms
I’d like to pick up where I left off in my last post concerning risk management. In that piece, the context was set in larger firms, although the core issues apply regardless of firm size. Let’s put a little more specificity on this issue for smaller firms. How should these smaller companies manage and mitigate the risks to which they are exposed?
Recall our earlier discussion on identification and evaluation of risks. Small and mid-sized firms also need to do this and focus on the relevant risks (those of higher expected impact) to their businesses.
First, they’ve got to identify the risks that warrant their attention. From where do they source their inputs? How tightly do they manage inventory? What contractual obligations do they have with their customers? Are their workers highly skilled and thus difficult to replace on short notice? These can then be mapped into a table exemplified by the above. And the list may be quite long, but let’s go through the following fictionalized case.
Consider a maker of consumer products that require three types of inputs, two of which are widely available at the desired quality level. The third, however, is sourced from the lone supplier in the area. What happens to their business if that supplier can no longer deliver? The company needs to evaluate the risk level (low, medium, or high) and the potential risk impact (which in this case is very high). The company needs to develop mitigation plans now or prepare a plan in case of non-delivery. Clearly planning now is preferred.
If they know of alternative suppliers outside the area then they may only need to contact two or three of them and arrange a cost-effective substitute input. Or they can develop a plan for a dual supplier relationship with contract terms that include delivering a multiple of the requirement within a specified period of time. This will affect their margins in the short term but likely will be manageable and allow them to deliver to their customers. Keeping tabs on their supply chain, having relationships with possible alternative suppliers and having a game plan (e.g., shipping alternatives) for obtaining the input will be critical should a negative event occur. Also, opening supplier discussions may facilitate their firm’s expansion into new markets. This is not just risk management activity – arguably it is also business development activity. The value created from implementing this plan is very high.
When a negative event occurs that impacts the firm’s ability to deliver to their customers, timely and effective communication is key for managing the situation. A point person accountable for contacting customers should be nominated and that person carries out all direct communication to clients. That same person also vets any other communications and message platforms to be distributed (press releases, blog posts, website updates, the lot). The same message needs to be delivered to all recipients to eliminate confusion. The last thing the company wants to hear is that customers that have spoken with each other after the direct communications have been delivered and now some are calling to complain.
If a firm has highly skilled and experienced staff this may prove to be difficult and potentially a liability. There are ways to hedge this risk (cross-training, detailed and up-to-date procedures, key-man insurance) but not all are cost effective, especially for smaller firms. Of course, we’ve all heard the excuse that documentation prevents progress and costs too much. Well, no documentation may well have led to some period of better bottom lines. But, when that key person contracts a serious case of the flu, the operation may grind to a halt. Customers not receiving their orders timely may opt to find an alternative supplier. And if your operational stall is lengthy, those lost customers will not necessarily choose to be exposed to your company’s delivery risk to them! Documentation and training to facilitate better handling of negative events, as well as vacation time for your staff, is an investment that will pay continuing dividends. This is not limited to risk events, but can be used to demonstrate a competitive advantage to prospects. A tight ship presents fewer risks for any potential customer.
Oh yes, we live and work in southern California, so we have at least two risks that are given by our location: earthquakes and fires. And actually, when we experience the latter, the next time (perhaps years down the road) we are blessed with rain, the problems of land movement and flooding are relevant. All of these events have different probabilities and several are unlikely. Yet the implications of not planning for how to adapt may be the difference between surviving and going out of business.
In passing we point out that there is no industry link to these risks – whether you produce some type of consumer product, are in the supply chain of another producer, or provide services for the community in which you operate – all firms are exposed to these events and their consequences.
An example comes to mind. A friend and small business owner sources tissues from global tissue banks. He then processes these samples to produce inputs used in medical research laboratories around the world. His operation is quite small and critically dependent on freezers to preserve the tissue samples he uses as inputs.
The first time he showed me around his business, I asked whether he had a back-up power generator. A bit to my surprise his response was no. He had asked the landlord about it some years ago but the issue dropped off the radar. So his business, located in a relatively rural location but clearly exposed to both earthquakes and fires, was at risk if there was a power disruption. The cost of a back-up diesel generator with sufficient capacity for keeping his freezer units operating was about $4,000 when I checked. And diesel is a much safer fuel than gasoline and the technology itself is more than proven.
One last point. While head of risk and compliance at a major investment firm in London, I heard the story of a much larger sister organization in California that had acquired a back-up generator. Then when the parent’s risk team visited to confirm their risk management was up to scratch, one visiting person asked to see the back-up generator and found it had not been connected! The key takeaway is that regardless of your risk plan, companies should test and perform disaster scenario planning on at least a yearly basis depending on the type of company.
When you deal with risk issues, the questions one asks typically are not industry-specific but rather are almost generic. What are the supply chain issues? What are the downstream issues? Does the firm have a business continuity plan? Does the firm have a calling tree? Does the firm conduct unannounced tests of both the calling tree and business continuity plan? If so, what have been the results of the most recent tests? Who are the key staff and are any at risk of leaving?
Answers to these questions likely will expose gaps that need to be assessed for impact and, if appropriate, steps taken to fill the gaps. The PRASE Methodology that C-Level Partners employs in working with clients is a natural for moving a business from the current higher-risk operational state to the desired lower risk state with known and understood remaining risks to be managed going forward.
All companies want to know the cost. Our rule of thumb is that that a firm should be spending about 2% of its budget on risk management. This includes insurance premia (with these policies you are offloading the risk, but you have to take care to understand what coverage you have [recall those Farmers’ ads!]), staff and management time to create and maintain documentation, monitoring firm activities, etc. So a company with a budget of $50 million should be spending about $1 million on risk management – relevant, but not huge. And a company has to ask the flip side of that question: What would it cost if something went bump in the night and your operations went down? Can you recover? Will your customers remain loyal or would they shift to a competitor and never return. All these questions can be addressed in a risk audit.
If you have a different view, please let me know as I’m always interested in others’ views. And if you would like a copy of our risk checklist feel free to contact me at bnewton@clevelpartners.net or on (949) 445-1080 x301. I look forward to hearing from you and discussing how we can help improve your business and enhance value creation.
