Balancing risk — are your bases covered?
(As originally published in the Financial Post, April 2013)
By David Fabian, Co-Leader, GTA Private Mid-Market Practice, EY
Risk is an important part of business: without taking risks, growth would be difficult. However, the leading companies are not those that take more risks, but those companies that understand and control the risks they’re taking.
Balance the risks and opportunities
The demands on family businesses have changed dramatically over recent years and adaptability and flexibility are key for meeting today’s challenges. The establishment of forward-looking risk management, combined with an effective control system, can help you manage a wide range of risks, including:
Strategic risks — these risks may arise due to internal causes such as conflicts of interest between family and management, lack of talent and the appropriate skill sets, or inefficiencies in business planning and sustainability programs; or from external causes such as unpredictable political environments, supply chains and customer purchasing patterns.
Operational risks — can be encountered through management of human capital, lack of cost control, inadequate physical infrastructure, unexpected supply chain interruptions and even epidemics threatening your workforce. If you are operating internationally, there can be language barriers, logistics problems, security breaches and failure to react to economic fluctuations that decrease product and service demand.
Financial risks — can arise from many aspects of your business, especially when you are globally active, for example: varying governance models and practices, economic instability, currency and interest rate fluctuations, complex tax laws and regulations, major differences between local and international accounting standards, and failure to manage and control capital and operating costs.
Compliance risks — can be caused by inaccuracies in information required by regulatory agencies, as frequent changes in regulations and different local laws make it difficult to keep up with the latest rules. Fraud, corporate deceit and employee theft in family businesses tend to be minimal, but the risk factor can’t be ignored.
To counter the proliferation of risk, companies are being forced to re-evaluate their business processes. In some family businesses, systems and processes have evolved over the years and may require a new efficiency and effectiveness assessment. Your brand values, your ability to function as a fast-moving business, your customer loyalty and your financial stability all rely on you taking a proactive risk attitude and encouraging the same risk appetite throughout your workforce.
There are clear requirements for effectively preventing the potential for error and malpractice; including internal control systems with restricted access rights, master data management and a clear division of roles in operational processes.
To manage risk effectively:
- you need to have an agreed terminology and consistent assessment levels across the company — to enable the fast identification and escalation of serious threat
- you should broaden the scope of your risk assessment to include third-party risk, assessing supplier risk, credit and counterparty risk
- build flexibility into long-term contracts and obligations internally and externally
- implement predictive scenario-based risk planning
Set the tone from the top
Companies should aim to establish an enterprise-wide view of risk across their entire global operations, develop contingency plans for key risk areas and establish an internal audit function and control culture. Your management team or board needs to understand your risk appetite and integrate risk assessment as a core part of future strategic planning and review its scope regularly. Every decision needs to be reviewed against your “risk radar” so that risks are identified early and you can make changes or fully prepare for any consequences.
Good company management and transparency (corporate governance) are particularly essential for family companies; they form important elements in securing the company’s sustained existence and the family’s interests. To balance risk and reward, you need to manage value at risk to a level aligned with your risk capacity and corporate strategies.
Key steps to revitalizing your risk management capabilities include:
- Ensuring that processes for crisis management are well planned and clearly documented
- Broadening risk assessments to include third-party risk
- Involving a broader group of management in scenario planning and employee enterprise risk assessment to avoid assumptions
- Giving management or a board member direct responsibility for managing risks
Protect your assets
To be successful in today’s business environment, fast response is vital, so the continuous availability of critical IT resources is one of your most important success factors. However, only 30% of companies have an IT risk management program in place that is capable of addressing the risks related to the use of new technologies.
The great reliance on web-based transactions, cloud computing, social networking and mobile communications bring great opportunities as well as make your company vulnerable to cyber attacks, data loss, application vulnerabilities, theft of intellectual property, and risks due to reliance on external service providers and offshoring.
Another big risk factor is the solvency of your customers and your supply chain — when the banks tighten their credit availability, you could find that your business is affected directly or indirectly.
Good risk management leads to increased confidence, better decision-making and sustainable growth. Covering all your bases by understanding and controlling your risks can make a difference to your family business for generations.