Trident ConsultingTrident offers training, consulting and recruiting services to business professionals.

All of life’s endeavors contain an element of risk.  Whenever you drive, there is a risk you will get in an accident.  When you make a purchase, there is a risk you will not be satisfied.  When you get married, there is a risk that it won’t work out.  The list goes on…

However, most of us do not make conscious decisions to manage our daily risks.  Even when we buy car insurance, most of us do not really do so to manage the risk of having an accident.  We typically only by insurance because it is a requirement for financing, or because it is mandatory by law.  Even then most of us buy the minimum required.

In business managing risk is not an option, however.  Indeed, active risk management is mandated by Sarbanes-Oxley in the U.S.  But how risk programs are implemented and managed varies greatly across businesses.  Many companies develop and implement robust risk management programs, and many do not.  Unfortunately, the companies that are most susceptible to risk are typically the least prepared.  I am speaking specifically about small to medium sized companies, and particularly those that are experiencing rapid growth.

Take for instance a small but rapidly growing manufacturing company on the West coast that I recently consulted with.  This company has grown from less than 40 employees in 2005 to more than 500 in 2008.  Its order books have experienced similar rapid growth.  In response to this growth the company rapidly increased its supply chain commitments to secure materials, and expedited shipment of its product to customers without proper testing.  Several remediation efforts later (with still more to come), the company now finds itself strapped for cash and unable to meet its order commitments… and still rapidly expanding its purchases and making the same mistakes made in 2005, 2006 and 2007.

The company obviously lacks an effective risk management strategy.  So what do I mean by “risk management?” Managing risk is about identifying potential risks and opportunities, estimating their potential impacts, and developing plans to manage them.  It is a formalized and ongoing process, not a quick and dirty, one time process. 

Fundamentally, risk is a function of probability of occurrence and likely impact.  Risk management is more than simply identifying potential risks.  Once identified, risks must be rated according to probability of occurrence and their likely consequences.  A mitigation plan for each risk should be developed, followed by a re-assessment of the risk assuming the plan is effectively implemented (the remaining risk is referred to as “residual risk”).  This process is then repeated regularly through the duration of the project. 

Managing risk takes effort, and courage.  Executives must be willing to hear the things they do not necessarily want to hear, and walk away from favorite programs or action plans when the objective assessment of risk dictates.  For companies like the one described above, engaging in formalized risk management can save millions…. Or even save the company.