Understand the risks and your firm will thrive, says LEAN business coach Ray McCreadie

Benjamin Graham, the American investor, economist, and professor once said, “Success in business is about managing risk, not avoiding it.”  Every day as we go about our business, we are assessing risks; it is part of our survival mechanisms. Limiting risk or deploying formal risk mitigation strategies needs to be considered by all businesses to ensure survival.  

Imagine a scenario where business leaders do not stop to reflect on past mistakes or constantly embrace new opportunities without considering how it could impact their business. That would not be sustainable. To effectively reduce risk within an organisation, we need to have a basic understanding of the diverse types of risk and how to prevent them. Some of the most common risks to be considered are listed below: 

Physical risks include dangers that pose a threat to physical assets, including your buildings, equipment, and people. Risks could be events such as fire, flooding, or crimes like theft and vandalism.  

Strategic risk is normally the result of a company not having a complete business strategy or lack of a business plan.  

Legal risk is where the company breaks the government's rules and can face the prospect of fines or director disqualification.  

Compliance or regulatory risk is when the company violates external or internal laws, regulations, or customer standards.  

Reputational risk is a hidden threat to the good name or standing of the company and can occur through a variety of ways without warning.  

Technology (Cybersecurity) risk - doing business in an increasingly digital world naturally comes with both risks and rewards. Cyberattacks and the reputational damage or data breach they can cause are a growing concern for many businesses.  

Financial risk is a good example of the external pressure businesses can face, from economic uncertainties and volatile financial markets to the move towards sustainable finance with investors increasingly taking environmental and social factors into account. All these things can impact an organisation financially, along with risks such as poor financial planning and projection and fraudulent activity.  

Operational risk is a term used to describe the risk of losses caused by flawed or failed processes, policies, systems, or events that disrupt business operations. It can be caused by employee errors, criminal activity such as fraud, and physical events.  

Once you have an idea of the potential risks, the next step is to assign them a score based on the likelihood and impact of occurrence. At this stage most companies use a risk matrix to categorise the risks. These classifications are not static and require routine monitoring and revision.  

Identifying the risks is the first step towards preventing them, next step is to consider risk mitigation strategies to eradicate or reduce the risk.  

Risk avoidance is where you take measures to avoid the risk from occurring. This may require a change to the standard way of working to reduce the likelihood of a risk happening or the impact should the risk occur in the future. 

Risk reduction approach is where you would take steps to reduce the chance of risk occurring in the future. Let us say your budget is tight and there is a risk you cannot complete a particular project due to a lack of funds. 

Risk sharing is where the risks are shared, the possibility of loss is transferred from the individual to the group. A corporation is a good example of risk sharing; a number of investors pool their capital and each only bears a portion of the risk that the enterprise may fail. 

Transferring the risk involves passing the risk consequence to a third party. This is an underlying principle of the insurance industry. Risks may be transferred between individuals, from individuals to insurance companies, or from insurers to reinsurers. 

Lastly, we have the acceptance strategy, which means accepting the risk as it stands. Sometimes it is more beneficial eventually to take the chance as the risk is extremely small and would have minimal effect on the workings of the company. 

Once the risks have been identified, now it is time to put the above into action and see how you can mitigate risks. Risk mitigation steps need to be practical. It will not help your business if you cannot figure out how to mitigate the risks you are facing. The following five steps will help you navigate a way forward through your risk mitigation process:

Identify any risk that could impact on your project or wider business operations.  

Assess the risks by analysing the likelihood that they will occur and the degree of negative impact on the business.  

Treat the issue by agreeing what mitigating actions you need to take and by putting in place the appropriate strategies. Each risk, its category, and your chosen prevention measures must be recorded in a risk register. 

Monitor the business risk regularly as risks are not static and projects frequently change. Check its category and if the mitigation strategy is working. 

Generate reports of the issues and risks as they happen, allow employees to report risks and hazards at frequent intervals. 

It is impossible to remove all risks from a business, however, early risk identification provides the best chance of mitigating them to levels your business can manage.