What hit me? Your risk-management primer

I read an article recently that suggested that one of the few positive outcomes of 9/11 was that it encouraged businesses to get serious about risk management. Since the terrorist attacks on New York and Washington brought much of North America to a standstill, businesses now recognize that they have to analyze all the risks they face—in logistics and infrastructure, economy, public safety, weather disasters, and so on—and have plans in place to deal with them.

I suspect this impact applies mainly to big corporations. Most small businesses are still just beginning to come to grips with risk management. However, the spate of crises in recent months—Japan’s tsunami, Hurricane Irene, and July’s one-man terrorist attack in peaceful Norway—should convince business owners that risk management is a discipline to be mastered sooner rather than later.

No risk-management scenario could have prevented 9/11, or diminished the destruction of New Orleans by Hurricane Katrina. But being prepared for such eventualities would mean that a company has a system in place for backing up its data on a daily basis, communications protocols for employees and customers should its offices be prevented from opening, and arrangements for backup offices and alternate production facilities.

Such protocols would help businesses work through a wide range of risks, such as power outages, equipment failures, computer breakdowns, work stoppages, tornadoes, blizzards and tsunamis. The CEO of British Columbia Ferry Services Inc. recently noted that the provincially-owned company was better prepared for the March 2006 sinking of its ship, Queen of the North, because it had practiced emergency responses to a potential vessel sinking just two months before. (Despite the fact that BC Ferry Services had never lost a ship before.)

So what kinds of emergency-management scenarios should your company consider? Anything that could affect business as usual:

• Could a flood, forest fire, hailstorm, snowstorm or other natural disaster close your business or devastate part of your community? (Think about the challenges that faced business owners in Slave Lake, Alta., this summer following a devastating forest fire.) How would you cope? How would you communicate with your employees? Who would take charge of the rebuilding?

• Could a product malfunction result in customer injuries, potential lawsuits, and possibly a firestorm of bad publicity that could impact sales in your business? You need production and legal expertise to craft a disaster-response plan, along with a media plan for minimizing the fallout.

• How exposed are you to a sudden shift in commodity prices, energy, or even the Canadian dollar? In volatile times like these, companies should have plans in place to deal with a sudden run of bad luck (think how the 30% increase in the value of the Canadian dollar from 2002 to 2005 took so many exporters and manufacturers by surprise.)

• Do just a few customers account for the lion’s share of your revenues and profits? If so, what would you do if a product flaw, an economic downturn, a price change, a competitor’s new innovation or some misunderstanding suddenly disrupted those relationships and cut your cash flow?

• What are the chances that your business could be disrupted by an infrastructure failure? A damaged bridge or tunnel, a closed airport, a broken railway line or collapsed highway? How would you move your goods and people? Better to figure out alternate routes now then when the pressure’s really on.

Many big companies form risk-management or safety committees to focus on analyzing and mitigating risks. SMEs can do much the same by appointing individuals to take charge of specific risks: a sales director might examine customer risks, while production takes on product liability, and marketing could look after emergency communication protocols. Lawyers, insurance agents and consultants are available to help. Make sure your staff report back on their findings and recommendations, and that all senior staff get copies (and keep backups) of your risk-management scenarios.

Make sure you review your risk policies at least once a year, keeping your eye out for new risks and emerging problems. Trouble comes in bunches. With a little preparation, your company can thrive while your competitors are still wondering what hit them.