Identifying and managing business risks | Investopedia

Running a business can be a dangerous occupation with many different types of risk. Some of these potential hazards can destroy a business, while others can cause serious damage that can be costly and time consuming to repair. Despite the risks implicit in doing business, CEOs and/or risk management officers – no matter the size of the business, from small to corporate giant – can prepare for them if they know what they are.

If and when risk becomes reality, a well-prepared business can moderate the risk's impact. Dollar losses, lost time and productivity and the negative impact on customers can all be minimized.

For startup businesses and established organizations, the ability to identify which risks pose a threat to successful operations is a key component of strategic business planning. Business risks are identified using a myriad of methods, but each identifying strategy relies on a comprehensive analysis of specific business activities that could present challenges to the company. Under most business models, organizations face preventable, strategic and external threats that can be managed through acceptance, transfer, reduction or elimination.

Below are the main types of risk that can affect a business:

Building risks are the most common type of physical risk. Fire or explosions are the most common risk to a building.

To manage this risk, and the risk to employees, it's important to do the following:

• Make sure all employees know the exact street address of the building to give the 911 operator in case of emergency.
• Know the location of all exits.
• Install fire alarms and smoke detectors.
• A sprinkler system will provide additional protection to the physical plant, equipment, documents and, of course, personnel.
• Inform all employees that in the event of emergency their personal safety takes priority over everything else. Tell them to leave the building and abandon all work-associated documents, equipment and/or products.

Hazardous material risk from spills or accidents also occur with some regularity. Among the hazardous materials most frequently spilled or released into the atmosphere of a workplace are:

• Acid
• Gas
• Toxic fumes
• Toxic dust or filings
• Poisonous liquids or waste

Fire department hazardous material units are prepared to handle these types of disaster. People who work with these materials, however, should be properly equipped and trained to handle them safely.

A plan should be created and implemented to handle the immediate effects of these risks. Government agencies and local fire departments may help in acquiring information to prevent these accidents, as well as provide advice on how to control them and minimize their damage if they occur.

(To learn more, see Investopedia's Intro to Insurance Tutorial.)

Among the location hazards facing a business are nearby fires, storm damage, floods, hurricane or tornado, earthquake and other natural disasters. Employees should be familiar with streets leading in and out of the neighborhood on all sides of the place of business. Keep sufficient fuel in your vehicles to drive out of and away from the neighborhood.

Liability or property and casualty insurance are often used to transfer the financial burdens of location risks to a third-party or a business insurance company.

Alcoholism and drug abuse are major risks to personnel in the work force. Employees suffering from these conditions should be urged to seek treatment, counseling and rehabilitation, if necessary. Some insurance policies may provide partial coverage for the cost of treatment.

Protecting against embezzlement, theft and fraud may be difficult, but these are crimes which occur frequently in the workplace. A system of double-signature requirements for checks, invoice and payables verification can help prevent embezzlement and fraud. Stringent accounting procedures may discover embezzlement or fraud. A thorough background check before hiring personnel can uncover previous offenses in the applicant's past. While this may not necessarily be grounds for declining to hire an applicant, placement for the new hire in a critical position in which money and cash equivalents are used may not be judicious.

Illness or injury among the workforce is inevitable, and is always a problem. To prevent loss of productivity, assign and train backup personnel to handle the work of critical employees when they are absent due to a health-related concern.

Power outage is perhaps the most common of the technology risks. Auxiliary gas-driven power generators are a good back-up system to provide electrical energy for lighting and other functions until utility power is restored. In manufacturing plants, several large auxiliary generators can keep a factory operational until utility power is restored.

Computers may be kept up and running with high-performance back-up batteries. Power surges may occur during a lightning storm (or randomly), so critical business systems should be furnished with surge-protection devices to avoid loss of documents and destruction of equipment. Offline and online data back-up systems should be used to protect critical documents.

Although telephone and communications failure is relatively uncommon, risk managers may consider providing emergency-use-only company cell phones to personnel whose use of the phone or internet is critical to their business.

Strategy risks are not altogether undesirable. Financial institutions such as banks or credit unions take on strategy risk through lending to consumers, while pharmaceutical companies are exposed to strategy risk through research and development of a new drug. Each of these strategy-related risks are inherent to an organization's business objectives. When structured efficiently, acceptance of strategy risks can create highly profitable operations.

Companies exposed to a great deal of strategy risk can mitigate the potential for negative consequences by creating and maintaining infrastructures that support high-risk projects. A system established to control the financial hardship that occurs when a risky venture fails often includes diversification of current projects, strong cash flow or the ability to finance new projects in an affordable way, and a comprehensive process to review and analyze potential ventures based on future return on investment.

After the risks have been identified, they must be prioritized in accordance with your assessment of their probability.

Establish a probability scale for purposes of risk assessment.

For example, risks may be:

1. Very likely to occur
2. Some chance of occurrence
3. Small chance of occurrence
4. Very little chance of occurrence

Other risks must be prioritized and managed in accordance to their probability of occurring. Actuarial tables – statistical analysis of the probability of any risk occurring, and the potential financial damage ensuing from the occurrence of those risks – may be accessed online and can provide guidance in prioritizing risk.

Insurance is a principle safeguard in managing risk, and many risks are insurable. Fire insurance is a necessity for any business that occupies a physical space, whether owned outright or rented, and should be a top priority. Product liability insurance, as an obvious example, is not necessary in a service business.

Some risks are inarguably high priority, such as the risk of fraud or embezzlement, if employees handle money or perform accounting duties in accounts payable and receivable. Specialized insurance companies will underwrite a cash bond to provide financial coverage in the event of embezzlement, theft or fraud.

When insuring against potential risks, never assume a best-case scenario. Even if employees have worked for years with no problems and their service has been exemplary, insurance against employee error may be a necessity. The extent of insurance coverage against injury will depend on the nature of your business. A heavy manufacturing plant will, of course, require more extensive coverage for employees. Product liability insurance is also a necessity.

If a business relies heavily on computerized data – customer lists and accounting data, for example – exterior backup and insurance coverage are mandatory. Finally, hiring a risk management consultant may be a prudent step in the prevention and management of risks.

(To learn more, read "Insurance Coverage: A Business Necessity.")

The best risk insurance is prevention. Preventing the many risks from occurring in your business is best achieved through employee training, background checks, safety checks, equipment maintenance, and maintenance of the physical premises. A single, accountable staff member with managerial authority should be appointed to handle risk management responsibilities. A risk management committee may also be formed with members assigned specific tasks – with a requirement to report to the risk manager.

The risk manager with the committee should formulate plans for emergency situations such as:

• Fire
• Explosion
• Hazardous materials accidents or the occurrence of other emergencies

Employees must know what to do, and where to exit the building or office space in an emergency. A plan for the safety inspection of the physical premises and equipment should be developed and implemented regularly, including the training and education of personnel, when necessary. A periodic, stringent review of all potential risks should be conducted. Any problems should be immediately addressed. Insurance coverage should also be periodically reviewed and upgraded or downgraded as needed.

While business risks are abound, and their consequences can be destructive, there are ways and means to insure against them, to prevent them and to minimize their damage if and when they occur. Finally, hiring a risk management consultant may be a worthwhile step in the prevention and management of risks.

(For more, see "The Evolution of Enterprise Risk Management.")