The next few chapters primarily concern bigger businesses. Some readers may think I am confusing risk management with general management. The answer is that a good management practice should include risk management, and that good practice is good for more than one reason. Good managers do not worry much about putting things in the right categories. They are more concerned with doing what is best for the business. Of course, much of this may apply to small businesses too, in varying degrees.
Why Do Big Businesses Not Manage Their Risks Better?
There is an article in the Harvard Business Review of June 2012. The principal author was Robert Kaplan.
There were several points in it that I think we might all find worth considering. The report gave several examples of failures of risk management, including the BP oil spill in the Gulf of Mexico and the Banking Crisis of 2008.
The main reason identified was that the culture too often rewards cost-cutters and risk-takers, rather than those who rightly identify risks. In some of the examples studied, it was found that risk management was equated with the compliance function, rather than something the company should want to do regardless of regulation in order to achieve its goals. Risk managers were not given direct access to top management. Indeed, many were silenced when they said things contrary to the collective wisdom of their colleagues. Identifying risks was often seen as being negative, whereas it should be seen as the first step to understanding and controlling the risks. It should make businesses better able to take on the risks once they have been through a proper risk management process.
Three Categories of Risk
Let us consider some more of the report’s findings on how risks should be managed. The first thing is to divide all risks into these three classifications:
- Operational
- Strategic
- External
Let us be clear about what these categories are.
- Operational refers to risks arising when things go wrong in the daily operation of the business. These should be preventable. There should be risk control measures in place, and employees should follow the correct procedures. One under-rated way to minimize mishaps like these is to have a policy to encourage whistleblowers. All too often, the culture is heavily biased against blowing whistles. We should recognize that the whistleblower is doing us all a favor.
- Strategic refers to risks arising from decisions made at the top regardless of how well or otherwise they are implemented.
- External refers to circumstances beyond the control of anyone in the business, such as the weather, changes in legislation, the level of economic activity, or the actions of the firm’s competitors.
A different approach is needed for each category of risk. A good start is to recognize that there are the three groups and to ask whether you are addressing all of them or devoting all your efforts to managing one. Probably operational. Operational risks are probably the best known and most studied.
How Can Strategic Risks Be Managed?
There are different types of strategic risks. These vary according to the nature of the business.
- High risk, slowly evolving.
- Diverse and complex risks.
- A quick-changing risk environment.
Each of these requires a different approach; so, you must first decide on which type you are dealing with.
- Requires a manager with the ability and authority to make the necessary decisions and access to people with the right technical knowledge. It may well also require an external consultant.
- Requires a culture of risk-awareness throughout the business, but also a central risk management team to act as facilitators to other managers.
- Requires collaboration between line managers and embedded risk experts. The latter should support but challenge the former.
The role of top management is to strike a balance between risk, opportunity, and cost, based on information and analysis provided by the line managers and internal and external risk managers.
How Can External Risks Be Managed?
External risks are particularly difficult to manage because of their unpredictability, but ignoring them is not the best approach.
- As with other risks, the first step is to identify them.
- The next step is to ask What if…
- Then, different possible strategies for dealing with such an
eventuality must be examined and an appropriate one (or more) chosen.
One difficulty to be recognized throughout is that various assumptions will have to be made as to what exactly might happen and how it would affect the business. There would also need to be assumptions as to how other organizations or individuals would react. One approach is to conduct a series of war games from time to time to test the business’s ability to respond and to learn lessons before being tested in real life. Sometimes, these can be highly realistic, but often, they have to be confined to desk-top exercises. While no method is foolproof, organizations are generally strengthened by conducting any such exercises.
How to Apply Risk Management to the
Decision-Making Process
The best practices in decision-making are very similar to those in risk management, for good reasons.
Defining the Question: Desirability
This is similar to defining the risk. What is it you hope to achieve, or sometimes, especially in RM, what is it that you wish to avoid? What would success look like? What would be the effect of the risk materializing?
Some serious thought needs to go into this, or you may be treating the symptoms, rather than the disease. Alternatively, you may be thinking too much about what might go wrong, rather than what would be the undesirable consequences of such an event. Are you afraid of flying or only of crashing? Avoiding flying and going by land is not the only solution. It is important at this stage to exclude other considerations such as cost or practicability. Exclude only what is undesirable. Otherwise, you might write off an idea that seems unworkable but might be just what you were looking for. All you needed was to give more thought at a later stage to feasibility.
Considering the Options: Feasibility
This is similar to looking at all the actual and potential controls you could apply to a risk. You should at this stage ask only what is technically feasible. Do not consider cost or such practical concerns as who is available to do it. You might find an idea that is so good when you have considered all the options, that you make adjustments to budgets and structures to make resources available. The only question should be “how far does this contribute to achieving that which we have agreed is desirable” or “how far does this reduce the risk of that which we agree is undesirable.”
The Third Element in the Process Is: Viability
This is where we ask whether the solution is affordable and practicable, given constraints such as time and cost. Considering who is going to do it is also worthwhile if it is actually going to happen. This is similar to evaluating the controls and balancing the cost and other effects of any new controls against the size and probability of the risk.
Two More Phases
When you have considered the aforementioned three issues, you may think you have finished, but do not forget the final phases.
- Implementation. That is action! Do it: do not leave a report on a shelf or saved on a computer.
- Monitoring. An idea is only good if it works. If not, either tweak it or scrap it. Do not carry on banging your head on a wall, although it is a well-known management practice. Learn from your mistakes. Quickly.
It is important to involve a lot of people in the process and to include people who are not closely connected with the activity under consideration as well as those who are. You can be too close to a thing to see it clearly. This brings us to the need to negotiate, which we look at in the next section.
What Is Your Approach to Negotiation?
Negotiation is an essential part of business, as well as of politics and everyday life. It has been said that it is the number one skill needed in management. It is sad, therefore, that many people do not know that there are different kinds of negotiations, and that it is important to adopt the kind most appropriate to the particular situation. I do not intend to look at every possible type of negotiation, but I will point out one important division that should always be kept in mind.
The most popular understanding of negotiation is that which can be likened to haggling in a bazaar. The vendor suggests a price far higher than he expects to get. The buyer offers less than half. They move toward each other in a series of steps and end up with something reasonable. This kind of negotiation is combative. One party wins and the other loses. The vendor wins if he or she gets more than the market price for the goods. The buyer wins if he or she gets them for below the market price. Some say that is capitalism.
There is another model, however, where the aim is to find a solution that is beneficial to both, or all, parties. It is called a win-win situation. The bazaar model could be called a win-lose situation. Different industries have different traditions regarding the type of negotiation practiced. Why?
In many situations, it is desirable to establish a long-term relationship with suppliers and customers. Management and the workforce also should be considered as long-term partners in business from this point of view. Sensible businessmen want a harmonious relationship with others. It is not in your interests for your customers or your suppliers to lose. That could mean they have to cut back, reduce quality, or go out of business. Short-term wins can lead to long-term failures if you drive too hard a bargain. I do not want to be insured by a company that keeps offering such low premiums that it loses money. Will it be there when I need it?
When might you prefer the win-lose model? When it is a one-off situation. When you are not expecting to see the other party again. When you do not care about their future. Grab the money and run! Where does that occur most? One industry where that is the norm is real estate. You want to get as much as possible for a plot of land you are selling. If that leads to a cash flow crisis for the purchaser, what is that to you? And, vice versa.
Think how do you negotiate with your clients and ask yourself whether it is appropriate.
Are You Using All the Three Es of Management to Measure the Performance of Your Business?
We all know it is important to measure how we are doing, not just to give ourselves a pat on the back or a kick up the ... backside, as appropriate. We need to learn what are our strengths and weaknesses, what works and what does not, so that we can do better in future. That is one reason for compiling statistics from within our business, as opposed to looking at other people’s. (They are important too. We need to know about national and local trends in our sectors, for instance.) When we look at the statistics we have about the performance our own organizations, what we can all too easily overlook is that there are three measures we can use, so we have to decide which one is the most relevant to our situation, or whether we could learn more by looking at all three. The three measures are: efficiency, economy, and effectiveness. Let us look at each in turn.
- Efficiency is the one we tend to be most familiar with, especially if we come from a technical background. It measures the relationship between inputs and output. We might measure inputs in terms of cost or by some physical measure, such as materials or man-hours. Similarly, we might measure outputs in terms of sales income or numbers of items produced. It obviously better to achieve a higher output for less cost, so we always want to keep an eye on this relationship to see whether it is changing, and in which direction. However, when we look at the other two Es, we may see why we need to avoid becoming too obsessed with efficiency. There is the risk of failing to see the wood for the trees.
- Economy is about overall costs and revenues. It takes into account the way a change in one cost or benefit can have effects on others so that an improvement in efficiency in one area might lead to higher costs elsewhere. You could improve efficiency in a way that put too much pressure on employees leading to higher absenteeism and faster staff turnover, and therefore higher total costs.
- Effectiveness is about achieving your objectives. It is especially important in the public sector and the third sector, where the aim is to provide a service, rather than to make a profit. An efficient and economical system that failed to achieve your principal objective would not be a success. Even if you are in the private sector, you might find it worthwhile looking at effectiveness as well as the other Es, as annual profits may need to be balanced against long-term growth or market share. In many industries, such as electricity or health services, you might be providing a service to the public even if you are in the private sector, and you might not be in business long if it becomes apparent that you are making profits without providing a satisfactory service.
Obviously, there are many cases where all three measures point in the same direction. A badly managed business will fail by all three measures, and any sensible improvement to working methods is likely to result in a better performance, no matter which one you look at. There are, however, many cases where the three measures give contradictory results. This is where common sense or management ability becomes important. Relying on the wrong measure can seriously damage your business.
I have certainly come across some bad examples of organizations becoming too focused on any one of these three measures to the exclusion of the others.
- In the United Kingdom, most of us know of instances where public sector organizations have obsessed about targets with little thought about cost or efficiency.
- During the 1983 coal miners’ strike in the United Kingdom, one of the big issues was the definition of an uneconomic pit, because the cost to the taxpayer of closing some pits would have been more than the cost of keeping them running at a loss, given the dependence of many local businesses on the mine and the miners.
- I have heard of the success of an insurance claims-handling unit being measured by the average cost of processing a claim, or the average time taken. This thinking failed to take into account whether the claims handler was making correct decisions. It is always quicker and cheaper to pay a claim, rather than defend it, or even investigate it thoroughly. Such a measure would be likely to result in an unnecessarily high cost in the payment of unjustified claims.
When you have collected the relevant statistics about your business, do look at them in the light of all the three Es so as to get an all-round picture of how you are doing, but in the end, the priority or emphasis of each E over the others is a matter only you can decide.
Do the Four Cs Still Apply to Public Sector Management and Could They be of Use to the Private Sector?
There was a time when managers in the public sector in the United Kingdom were expected to regularly review their activities to ensure they were giving and getting the best value for money. The four key steps were known as the four Cs. In this section, we ask whether they have been superseded or whether they are still needed. We go on to consider whether the private sector could benefit by applying the same methodology.
One of the controversial reforms of the public sector introduced by the Thatcher Government in the United Kingdom in the 1980s was Compulsory Competitive Tendering. This meant that public services had to be opened-up to competition from the private sector. Apart from complaints that the competition was, in practice, often unfair to the public sector, and counterobjections that some local authorities resisted real competition by various unfair means, it was also said that the results did not always give the taxpayer good value for money, as the cheapest was not always the best, and existing inefficiencies tended to be enshrined in the tender specifications.
The Labour Government led by Tony Blair was aware of the need to retain as far as possible the benefits competition had brought while addressing many of the serious criticisms that had been leveled at it. The aim was not only to save money, but also to improve public services and make them more appropriate to the needs of the 21st century. The result was a policy known as best value. It was recommended that, to achieve best value, an organization should follow the four steps known as the four Cs.
- Challenge. This was possibly the most important step, but also the one too often passed over in the rush to achieve savings, especially where there were managers who were in the habit of starting with their conclusions before doing their studies. To challenge is to ask what a service or activity is for, or what is the need that it is intended to meet. This should, at least sometimes, lead to a recognition that the need has gone away or is being met elsewhere. It might, on the other hand, lead to a recognition that there are needs, or aspects of them, that the existing arrangements have not been meeting. In other words, just doing more or less of what we are doing might not lead to the best value for that service.
- Consult. Before thinking about how to improve a service, authorities were required to seek the opinions of others. These should include users of their services, existing suppliers, and others who might be affected by the service. How satisfied are they? What problems do they experience? What changes would they want? The dangers of consultation are that consultees might not be concerned about cost, if they imagine someone else is paying, and also the danger of “nimbyism,” or the reaction of “Not In My Back Yard.” Most people do not think about the needs of the wider community and will want certain services putting in someone else’s back yard, for example, waste disposal facilities, prisons, mental institutions, travelers’ sites.
- Compare. Do not act as if you are providing a unique service, unless you are! Look at how other organizations do the same thing, or something similar. Are there lessons to be learned? This does not mean copying everything unquestioningly. What are we doing better than them? What mistakes have they made? What would they have done differently, with hindsight?
- Compete. The time to compete is after you have taken the first three steps, so you know what it is you want from the competition, not just “more of the same only cheaper.” Build improvements and savings into the specification. Even if it is apparent that a full tender exercise would not be justified, get a few quotes to see how you compare on cost. A tender exercise costs time and money and may not be justified, especially if potential savings are only small.
Of course, we are in a new landscape with the need for such dramatic savings all around, but I believe the four Cs are as relevant and needed now as ever, if we are to make the best savings. We want to get the very best value for whatever we are able to spend. We want to make services relevant to the needs of the public. We need to learn from other organizations. However, we need to do all this within the confines of ever tighter budgets and often increased demands.
What about the private sector? While we need to recognize the differences between the two sectors, we also need to recognize that these differences are getting increasingly blurred in the United Kingdom, and you may see similar developments elsewhere. You may be in a company that supplies the public sector or that provides services to the public with some element of government funding. You may be in a business that was once state-owned and has been privatized. There will still be a requirement to achieve certain objectives other than making profits. I hope in any case that we all recognize the need to consider the effects of our actions on the rest of society. Perhaps, best value is relevant to your business. It is probably worth giving each of the four Cs at least some thought in reviewing your business activities. You do review them from time to time, don’t you? Let us take a look at each of them again.
- Challenge. Do you think about your objectives? Do you ask whether the products or services you offer are still the right ones? Are there other (better?) ways you could be providing them?
- Consult. Do you ask what the public wants? Or, do you just give them what you choose to produce? You would not be alone.
- Compare. Of course, you are conscious of the competition, but do you really ask what are your strengths and weaknesses compared with them? Do you recognize the indirect competition? The competition for a motor manufacturer is not only the rest of that industry, it is also the railways and providers of other means of transport.
- Compete. Well, you do not need telling to do this. But, do you only compete on price or do you take a long hard look at the relative benefits of your product and your competitors’?
I think the four Cs of best value are worth bearing in mind whatever sector you are in and whatever your product or service. Try it and see.