Planning for Unthinkable Events Could Mean Survival

Last week’s terrorism scare has thrown a spotlight on the crucial role of risk management for companies in a turbulent business environment.

Taking risks is part of the cost of doing business. But a company can pay dearly for ignoring the need to identify and plan for those risks. This is especially true for small businesses, which often operate on the edge.

For executives dragging their feet on taking a companywide approach to risk management, last week’s events may add a needed sense of urgency, experts say.

“The job of management is to think of the unthinkable and plan accordingly,” said James Lam, president of risk management consulting firm James Lam & Associates in Boston. The alleged terrorist plot in Britain “is just another example that risk can manifest itself at any time and in any form.”

Figuring out the cost and effect of extraordinary and routine risks is the core of the growing business practice known as enterprise risk management.

The concept has special significance for small companies. Though they are typically unable to afford a full-time risk management officer, they face many of the same hazards as does big business.

And because they often rely on a limited number of products or customers, they have limited ability to balance risk in one area of their business against another area, Lam said.

At the same time, many of their big-company clients are increasingly pressuring them to identify and plan for risks that might affect clients. Those could include a terrorist attack, a computer system crash or the loss of a key employee.

Smart companies of all sizes are learning that they can benefit by managing risks in an active, organized manner.

“Good risk management is good business management,” said Lam, who is the author of “Enterprise Risk Management: From Incentives to Controls,” published in 2003 by John Wiley & Sons Inc.

Companies are increasingly recognizing that effective risk management can help them protect and increase their profit. Of the 271 companies surveyed in 2004 by the Conference Board, 90% said they were developing or planning to develop an enterprise risk management program.

But most companies are still in the early stages of the process, according to the nonprofit business research group. Only 11% of the firms surveyed, which included major corporations such as BP, Standard & Poor’s and Bristol-Myers Squibb Co., said they had fully implemented risk management companywide.

Learning how to identify and manage risk can give a small company an advantage in a complex, volatile and global business environment. It can help the company make calculated expansions into new markets, for example.

“Risk management is like the brakes on a race car,” Lam said. “If you have really good brakes, it gives the driver the confidence to go even faster.”

Effective risk management can also save money. For example, smart risk management can trim the cost of insurance, which is a tool many companies use to help manage some of their risk.

Most companies spend 5% to 10% of total revenues on insurance, said commercial risk manager Rick Vassar, president of Vassar Group in Sterling, Va. So even a small reduction can make a big difference.

“Those savings sink right to the bottom line,” he said.

Vassar gives lots of how-to details in his opinionated paperback, “Hide! Here Comes the Insurance Guy: A Practical Guide to Understanding Business Insurance and Risk Management.” The book was self-published through IUniverse last month.

An effective plan takes time to develop and implement. It has to be an ongoing program. And it has to take into account the interdependent nature of many of the risks a company faces.

That can seem an overwhelming task for busy small-business owners.

“You can see their eyes glaze over” when the topic comes up, Vassar said.

The first step is to understand the five types of risk that companies typically face, Lam said. They are:

* Strategic risk, which affects the ability to cultivate a business in the long-term through expansion and higher profit.

* Business risk, which affects the ability of a company to achieve short-term profitability.

* Market risk, which includes interest rates. An increase could affect a company’s borrowing costs and its cash flow.

* Credit risk, which for smaller companies would include the health of their accounts receivable and the viability of their service providers and vendors.

* Operational risk, which includes failures in processes, technology and people and external events such as terrorism or earthquakes.

Lam’s next book, due mid-2007 and also from Wiley, tells companies how to develop and implement risk management throughout their businesses, he said. Start by deciding who is responsible for risk management, he said. Then identify the key risks for the organization and develop assessment and reporting tools. Online resources, books and outside advisors can help a small company with this step. Finally, use risk information to make decisions or take action.

“The alternative to risk management,” Lam said, “is crisis management, and crisis management is more expensive, time consuming and embarrassing.”

Cyndia Zwahlen can be reached at cyndia.zwahlen @latimes.com.