It's not enough to know that dangers to a business exist. To ensure the long-term survival of an enterprise, owners and managers must take steps to foil those dangers through selecting and applying the right tools of business risk management.
“Risk management is very important for small and medium-sized businesses," says Jing Ai, associate professor of finance at the University of Hawai'i at Mānoa Shidler College of Business in Honolulu. “Because some businesses have limited financial capacity and ways to secure affordable financing after a loss, proper risk management arranged beforehand can make the difference between survival or demise after a major loss."
Business risk management is not just about limiting the downside, adds Roger Dunkin, vice president of product and development and co-founder of Kennesaw, Georgia-based Riskonnect. (Riskonnect is a governance, risk management and compliance platform vendor.) It's also about being able to take on potentially rewarding challenges that might not be feasible without effective use of business risk management tools.
“When you manage risk and take opportunistic risk, that can be very valuable to the organization," Dunkin says.
Different Kinds of Business Risk Management Tools
Risk management tools come in two major varieties, according to Ai. First are risk controls, which include methods for eliminating or reducing exposure to risk. The second type consists of risk transfer tools.
Risk controls are visible part of most businesses. “Some examples are safety training, installing fire alarm and sprinkler systems and data backup and storage," Ai says.
Keep in mind that while it seems that business owners are paying costs for a risk that may or may not happen in the future, it is almost always less costly to have a risk management plan in place before a loss happens than to wait until afterwards.
—Jing Ai, associate professor of finance, The University of Hawai'i at Mānoa Shidler College of Business
“Basic risk management methods also include risk transfer methods, where businesses find ways to help finance the payment of the losses should they happen," Ai adds. Unlike risk controls, risk transfers seek to reduce the impact of negative events without necessarily reducing the likelihood they will occur.
The most common example of a risk transfer tool is an insurance policy. Examples of insurance used to transfer risk include property insurance, general liability, business interruption, errors and omissions and worker's compensation.
In addition to insurance, businesses may transfer risk by negotiating collaborative agreements with other companies to share resources. One such example is sharing office space in the event of a disaster that would otherwise make it difficult or impossible to keep the doors open. Another example is the hold harmless clause in contracts that releases one or both parties from legal claims due to costs, damages or losses resulting from a transaction.
The Limits of Business Risk Management Tools
Before selecting and applying risk management tools, business owners need to accurately understand their exposure to various risks, says Mike Kuhn, vice president of global accounts at Convergint Technologies, a Chicago-based security systems integrator.
“The first step is to have a professional assessment of your facility or organization," Kuhn advises. “Assess what the risks are and determine what you need to protect: Your brand? Physical building? Intellectual property? People? Once you have an understanding and assessment, it is easier to focus on what needs to be done and what training, systems, etc. are necessary."
A good risk assessment may still identify risks that are hard to manage with the typical set of tools. For example, it is difficult to insure against damage to a business's reputation, Dunkin notes. To manage that risk, companies may need to rely primarily on training employees and establishing a company-wide culture of focusing on customers.
“Everyone has to be a risk manager," he says.
Another hard-to-manage risk is posed by third-party vendors, he adds. Outside vendors often receive keys, badges and logins that could expose a company to loss or damage from cybercriminals and others.
“The defensive posture has to be pushed out not only through your organization but to vendors as well," Dunkin says.
Business Risk Management Trends
Risk management is becoming a more pressing concern for business of all sizes, in part because globalization and universal connectivity expose them to a bigger world of potential risks. Risks such as ransomware, in which cybercriminals render critical computer data unreadable and demand payment for codes to unlock it, didn't exist until recently, notes Dunkin.
Fortunately, advances in technology also provide new tools for managing business risk. Cloud-based storage of vital business data is one example.
“Better, more affordable storage mechanisms are available to and have the capacity for small- and medium-business owners," Kuhn says. “We've seen this grow tremendously in the past three to five years."
Some enterprises are beginning to employ artificial intelligence and machine learning to identify risks and select appropriate business risk management tools, adds Dunkin. The emerging concept of enterprise risk management, in which risks are assessed and managed as a portfolio to improve efficiency and effectiveness, is another promising addition to risk management practices, Ai says.
While procuring insurance and conducting training involves some financial outlays, Ai urges business owners not to focus only on upfront costs of applying business risk management tools.
“Keep in mind that while it seems that business owners are paying costs for a risk that may or may not happen in the future, it is almost always less costly to have a risk management plan in place before a loss happens than to wait until afterwards," she says.
Read more articles on risk assessment.
