Risk management is generally not the sexiest aspect of being in business. Plus, if all is going smoothly, it can seem like a waste of time to look at things in a negative light.
Yet contingency plans can make or break your business if disaster strikes.
Let’s explore the risks SMEs commonly face, some of the ways your business can benefit from this kind of foresight, and how to keep your business functioning should disaster rear its ugly head.
Types of business risk
Consider the following scenarios:
- A blackout shuts down everything, from your website to your payment facilities to your CMS
- Your street is blocked off by police for a full day to investigate an accident
- A fraudster steals $500,000 from your primary bank account
- Your entire community is inundated by floodwaters during a storm
- One of your senior staff dies suddenly
While all of these are (hopefully) just hypotheticals, such instances have affected many businesses in the past, and are likely to do so again. How you deal with such events can be the difference between making it through or being forced to close down for good.
“Particularly [SMEs]: as they are growing, they are just too busy growing to stop and think about ‘What if this didn’t happen?’”
As a risk management consultant at Tigertail and the former senior disaster planner for the NSW government, there isn’t much that Rick Stone hasn’t seen when it comes to identifying risks and minimising their effects on organisations.
He says your risks are centred on three key aspects of your business. Understanding each of these components and how they integrate is fundamental to being able to identify risks.
“You have to understand how your business works. In other words, what are the inputs to your business? What are the things that you require to be able to function from day to day?” he tells My Business.
“There will be people; there will be your asset [that] has to be able to continue to function; you need to have supplies of different sorts coming in to do whatever you do with them; you need to have capital; you need to have cash flow; you need to have utilities.”
The next step is to explore your processes, he says.
“Once you understand what the inputs to your business are, you then understand what you do to transform those inputs into the thing that you sell: the goods or the product [or service] that you sell. So what are your processes?,” says Rick, noting that in virtually every business. And the final aspect, he explains, is your outputs.
“At the end of the day, you have to be able to sell to somebody. So do you need to have transport facilities? Do people need to be able to shop on your online web portal? How do you get your goods or your services to your customers?”
This is a process that Rick believes too few businesses understand.
“Particularly smaller businesses: as they are growing, they are just too busy growing to stop and think about ‘What if this didn’t happen?’,” he notes.
Benefits of planning ahead
The continuity of the business is the ultimate goal of developing risk management strategies. Yet, as Rick points out, there are other benefits to undertaking this exercise.
“[Sometimes businesses] discover some really interesting opportunities for cost saving, some really interesting opportunities for doing things more efficiently, for doing things differently.
So it’s a useful exercise at two levels: firstly to help to control and minimise risk, but secondly to ensure that your operation is actually running as efficiently as it can.”
One example is the savings that can be achieved through solar power and other forms of energy generation. Yet, as Rick explains, there are many other possibilities.
“It’s really about understanding risk: if you cannot control it in any other way, it’s important to have the appropriate level of insurance cover.”
“In terms of other cost reductions, often people will look at outsourcing functions. Payroll is a really good example where you can handle that in-house or you can outsource [or automate] it, and often outsourcing is more cost-effective for you. Same with accounting,” he says.
So in removing the risk that comes with a job function being centralised with a single employee, whether through the use of automation or outsourcing, you can also deliver cost efficiencies for your business by reducing your workforce.
As all business owners know, there is no escaping red tape.
Certain aspects of business operational risk also come with their own regulatory and legal requirements.
A major part of this is the health and safety of your staff, visitors and customers.
“Work-related injuries and diseases account for roughly $102 million in Australia each year,” says Katrina McKinnon, community outreach manager at Alsco Australia.
She suggests that all business owners look to meet the legal requirements surrounding health and safety risks by:
- Keeping a close eye on your premises as a workplace
- Clearly displaying emergency contacts
- Testing your evacuation procedures
- Keeping an emergency kit ready
- Devising a communication plan and assigning a go-to person
- Practising your plan to ensure it stays effective as your business grows
Role of insurance
“Insurance is a really, really important part of your risk treatments, but it’s only a part,” says Rick.
As such, he says, it is crucial business owners don’t fall into the trap of thinking insurance will be their saving grace should something go wrong. The common constraints of insurance include:
- Your policy may not cover everything
- There are losses that can’t be insured
- Insurance is designed to cover incurred losses, but prevention is more cost-effective
- There can be delays in the processing of insurance claims and the disbursement of funds
“The thing about insurance is it will cover only what you buy, so you need to be really careful and really clear about what you are insuring and what the coverage is,” Rick says.
“You also need to be really clear that insurance companies will go through due diligence processes before they pay out for a claim, any claim. That might take some time. If you aren’t prepared for the claim to take some time to process and for funds to become available, then that itself can be a cash flow risk for an organisation.”
He adds: “It’s really about understanding risk: if you cannot control it in any other way, it’s important to have the appropriate level of insurance cover.”
Types of insurance
Nevertheless, insurance is a crucial component of any risk management strategy. Be careful, though, to take out the right type of insurance and the right policy for your needs.
Michael Gottlieb, the founder and managing director of BizCover, says the most sought-after type of insurance by SME owners through his platform is public liability and professional indemnity cover.
“Many of these customers begin their search for insurance as they have a contractual or regulatory requirement, most commonly for public liability or professional indemnity,” he says.
Michael says his business offers three main types of insurance protection, which represent a whole range of risks in business: property, legal liabilities and finances.
“Business insurance cover[s] for any material damage from an expected event,” he explains.
“[This includes] fire, theft, storm and accidental damage to your physical premises and physical assets including equipment and machinery, stock, contents and fixtures, as well as cyber insurance for digital assets.”
Legal liabilities, says Michael, are split between public liability (personal injury or property damage); professional indemnity (legal action taken against your advice or service); and management liability (allegations of misconduct, mismanagement or legislative breaches).
There is also business interruption cover for a business’ most important asset: its finances.
“Insurance is a really, really important part of your risk treatments, but it’s only a part.”
Why no news is good news
There are few examples to follow in risk management because they simply don’t get shared.
“You don’t really hear about the success stories because they are still trading and everybody keeps going back,” Rick explains.
“[They] had everything in place ... and the problem has occurred and they have maintained a really strong communications strategy, and have been able to keep their customers reassured that they are still open for business and providing good service.”
What not to do
Rick Stone highlights the role of PR in minimising the impact of a disaster on your business. BP’s Deepwater Horizon oil rig debacle is one example:
“A guy from BP, in the middle of all this drama where many people were suffering all sorts of problems, said ‘I want my life back’. That’s a good example of someone not doing it well.”