Risky business

Floods, security breaches and power cuts are far more likely to cripple a business than a terror attack, yet many companies are far from prepared, says Scott Payton

A global economic downturn threatens the future of thousands of companies across the world. The floods that blighted the British summer of 2007 caused an estimated US$3.3 bn worth of damage. More than seven out of 10 large UK companies suffered from an IT security breach last year. Running a business can be risky - so what can companies do to prepare for the worst?

'Everything starts with getting a fundamental understanding about what risks a company faces,' says James Lewry, crisis and security consultant at Control Risks, an international risk management advisory firm. 'No two businesses are the same,' adds Malcolm Tarling, spokesperson at the Association of British Insurers. 'A multinational company might be exposed to different risks than a small high-street jeweller, for example.'

During this risk identification process, the hazards that a company faces frequently turn out to be very different from what managers expect. 'Very often, executives worry about things like terrorism,' says Dom Chester, a crisis management specialist at Control Risks. 'But the really important potential dangers are things like power interruptions. More traditional business risks don't necessarily sound that terrifying, but are more common, would have a longer-term impact on the business - and could cause it to fail.'

Paul Pilkington, partner and risk management specialist at PricewaterhouseCoopers (PwC), agrees. 'Companies often overlook what's on their doorstep,' he says. 'So often, when things go wrong within a business, it's down to problems that were known about already.'

Crisis of confidence

Of course, the big risk currently on the agenda in every boardroom is the global economic downturn. What can businesses do to prepare for the worst that the financial storm may bring? 'You can't insure against the bottom falling out of your market, but you can insure against the failure of suppliers,' says Tarling. 'Things like trade credit insurance - which has traditionally been something of a Cinderella insurance product - is becoming even more important. Many credit insurers can also advise you on the creditworthiness of potential new business partners.'

Chester says that the economic crisis could ultimately be beneficial, raising awareness of the importance of preparing for business hazards of all kinds. 'It will hopefully bring issues like crisis management and effective risk management to the fore,' he says.

However, as business minds remain firmly focused on the downturn, risk-management specialists warn companies not to lose sight of more perennial business risks. 'These range from a supplier going bankrupt, via crime-related losses and malicious damage, to flooding and other sorts of bad weather,' says Tarling.

Another common and frequently overlooked hazard, says Lewry, is the damage that a poor - or non-existent - crisis communications plan can wreak on a company's reputation. 'When an event such as a product recall takes place, very often the negative impact pales into insignificance when you look at how the event is subsequently handled,' he explains.

Although he agrees that identifying potential risks is important, Pilkington also believes that too many companies fall into the trap of not actually doing anything to protect themselves. 'Risk management is all about identifying, managing and mitigating risks,' he says. 'We often see that companies do the identifying, but don't follow through to the managing and mitigating.'

From the top down

So how should risks be managed and mitigated? Geraldine Rutter, director of the PwC survey and report In Control - Realising return from risk management, urges companies to start by ensuring that a risk-management strategy is led from the very top of the business. 'It's then important to ensure that the strategy is embedded into the culture of the business, and clearly communicated throughout the organisation,' she adds.

Chester agrees, warning companies not to leave risk management in a silo. 'If risk management is farmed out to the security or health and safety department, for example, then you lose a lot of the capability within the company to respond in a crisis,' he says.

When it comes to creating a contingency plan for responding to risks when they occur, Chester advises companies to focus not on the nature of a specific risk, but on its potential impact. 'We would typically divide the potential impact into four categories: people, the environment, assets and reputation,' he says. 'Your crisis response should be tailored to managing, controlling and minimising the impact on those four areas.'

Back at the ABI, Tarling says that the flooding in the UK during the summer of 2007 highlighted the dangers associated with failing to plan fully for the worst. 'A lot of businesses may have made provisions for insurance to cover their loss, but they may not have made provisions for alternative premises, which is crucial following a flood or fire. It's things like this that businesses tend to overlook.'

Another important issue for companies to consider is how much risk they are prepared to accept within their operations. 'Tolerance for risk varies from company to company,' Lewry says. 'For example, for a small company, a £10,000 loss of business may be unacceptable, whereas for a multinational company, it may not be significant at all.'

Practice makes perfect

A classic pitfall is treating risk management as an exercise in theory rather than practice, says Chester. 'Some companies have a very thick crisis management document, but it's never been opened; it's never been practised; and it's never been updated. Plans tend to fall down most when there are key contact numbers that are not kept up to date.'

'The best way to prepare for a crisis is to train through experience,' adds Lewry, who advises his clients to conduct crisis management training sessions twice a year.

Another crucial aspect of risk management, adds Tarling, is understanding what kinds of insurance your company needs. 'Without insurance to cover risk, most businesses would probably fold - particularly smaller firms,' he says.

Looking into the future, the kinds of risks that are likely to rise up risk managers' agendas are those created by the increasing pace of globalisation. 'Companies often now rely on manufacturing facilities that are remote from the rest of their operations,' says Pilkington. 'In the recent past, there have been a number of situations in which quite a lot of trust has been put into remote outsourced facilities, when it turns out that it would have been a lot better if there had been more monitoring over what was going on.' He gives the recall of almost one million Chinese-manufactured toys by US firm Mattel in August 2007 as an example.

Businesses are becoming increasingly concerned about other risks, too. 'Pandemic flu was very much on the agenda following [the outbreak of] severe acute respiratory syndrome (SARS), but then it seemed to drop off the radar,' says Lewry. 'Yet in the last 12 months, it has started to increase in popularity as a framework for crisis planning and training exercises.'

Climate change and an increasingly litigious socio-economic environment are also altering the risk landscape, says Tarling. 'Weather-related losses are rising up the agenda, while fire risk has never gone away. And we do now live in a more litigious society, where businesses are much more likely to be sued. So it's important that you recognise where you would be liable for damages and make sure that you take steps to reduce the risk.'

Ensuring that their workplace is safe and secure is one practical step that firms can take to minimise legal risks, he adds.

However, Lewry argues that if companies have a comprehensive risk management strategy in the first place, it shouldn't need a dramatic overhaul as new potential dangers emerge - be it a new global economic crisis or yet another flood. 'The potential impact of climate change, for example, carries the same types of business risks as other threats,' he says.

Ten tips to avert a crisis

1. Consider cover such as trade credit insurance to protect against failure of suppliers
2. Take advice on the creditworthiness of potential new business partners
3. Have an effective crisis communications plan
4. Ensure that risks are not only identified, but also managed and mitigated
5. Embed a risk-management strategy into the culture of the business
6. Avoid farming risk-management strategies out to more remote departments
7. Tailor crisis response to minimising the impact on people, the environment, assets and reputation
8. Make provisions for alternative premises following a flood or fire
9. Conduct crisis management training sessions every six months
10. Reduce the risk of being sued by recognising where liability for damages could occur

Scott Payton is a freelance journalist and editor