In the business world, we oftentimes categorize threats as risks. While the risks we face in business may not always carry the possibility of a loss of life, an unknown risk could cause the death of your business. If you think about it, every business that has ever failed did so because it didn’t know how to respond to a risk that materialized. As a business leader, it’s your job to manage risk in your business. You must understand that your risks are constantly changing. There are environmental risks, digital risks, market risks, political risks, and countless others that may be unique to your industry. It’s important that you Evaluate Risk Annually (ERA).
Evaluating Risk in Your Business
There are four steps to risk management: Identify Risk, Evaluate Risk, Develop a Response Plan, and Execute. Let us take a closer look at each one.
1. Identify Risk
The very first thing you have to do is identify your risks. A risk is anything that could have an effect, positive or negative, on your desired outcome. I typically start by identifying every vulnerability in a project or situation that would cause it to fail. This step is the most important when it comes to managing risk. It doesn’t matter how ridiculous the potential risk sounds. If it can impact your desired outcome, write it down. The goal at this stage is to identify every risk regardless of the probability.
2. Evaluate Risk
Risk evaluation allows you to separate and prioritize the risks you have identified. This way you can focus your attention on the risks that will have the greatest impact. You should evaluate each risk based on the impact it would have and the probability that it will actually happen.
Go through the list of risks you identified and assign each one a value. Rate the impact and probability on a scale from 1–5, with 1 being “very unlikely” on the probability scale and “negligible” on the impact scale and 5 being “almost certain” on the probability scale and “catastrophic” on the impact scale. Then multiply the probability and impact scores to create a priority grade for each risk of Low (1–3), Medium (4–6), High (8–12), or Extreme (15+). Here is an example of what your risk assessment matrix could look like:
3. Develop a Response Plan
Congratulations, you have evaluated the level of impact and probability of each risk and have assigned each a grade. Now is the time to determine how you will respond to these risks. When it comes to minimizing the impact risk can have, the faster you respond, the better off you will be. You should have a documented response plan for every risk regardless of the grade you’ve given it. You need to know what you’re going to do before a risk occurs so you can immediately execute a response. There are four ways you can respond to risks:
Accept: Accept that this risk may occur. These are typically the risks you gave a Low evaluation to. No need to do anything with them because, if they do happen, the impact is not severe or can be easily overcome. When the benefits of success outweigh the cost of failure, accept the risk and move on.
Avoid: If the risk could have a catastrophic impact (Extreme), the best solution may be to avoid it all together. Determine everything you can do to prevent this risk from occurring. If you can’t find a viable solution, you may not want to take on the task or start the project at all. This is the safest option, but it should also be your last option.
Transfer: Look for ways to transfer the risk to someone else. If you’re not skilled at doing a necessary task, hire an expert. By doing so you have transferred the risk of failure over to them (e.g., hiring an accounting firm to manage your business finances).
Reduce: When the impact of the risk is too much to accept and you cannot avoid it or transfer it, find a way to minimize the impact of that risk. A good way to reduce the risk in a project is to bring on partners. Hopefully, you can bring on partners with more experience than you have and thereby reduce your exposure to the risk. They may be able to find a way to help you exploit the risk.
*Bonus** Exploit: This applies more to projects. In some cases, you can actually exploit the risk to bring about a benefit. Put another way, find the opportunity within the risk. For example, say you sell software and a company wants to use your software but their old equipment can’t run your program. You can provide them with new hardware or make a margin by bringing in another company to provide that service.
4. Execute
This is where the rubber meets the road. Proceed with business as usual, constantly looking for any event that will trigger one of your documented risk responses. Move toward your desired outcome while monitoring for risks. If one occurs, execute the response you created for that risk.
BONUS- Document and Learn
During and after the execution of your risk response plan, you should take note of the outcome. Did your response work? What could you have done better? In hindsight, do you see things you could have avoided or opportunities you could have exploited? By reflecting on the experience, you’ll be better equipped to handle risks in the future. The better you get at managing risk, the more comfortable you’ll be taking on more risks.
Risk does not exist in a vacuum. As your business progresses and grows, so do your risks. Therefore, you should constantly be looking at how these changes add or eliminate risk. At a bare minimum, you need to evaluate your risk annually. Over time and through many lessons learned, your risk management skills will improve. The more you go through this process, the easier it gets and the faster you become at recognizing and evaluating risk.
Even though risk is always present and the consequences can be destructive, you can create a plan. There are ways to guard against risks, to prevent them, and to minimize their effect if and when they occur. To speak to someone about a risk assessment or creating a customized plan, touch base with one of our specialists.
