A lesson that we will learn from the health crisis is the obligation to think about all the possibilities in advance. It is not a question of seeing life in a pessimistic way but of imagining solutions which will allow us not to find ourselves in an impasse. Of course, as we can see, many companies have changed their organization and introduced teleworking, but this was imposed urgently when it should have been considered in advance.
Anticipating risks must be part of the DNA of companies. A poorly anticipated and, consequently, uncontrolled risk can overnight call into question the sustainability of the company, whatever its reputation, its size, its activity and even its seniority. Risk management is therefore a daily job. It requires opening the field of analysis! This involves understanding all of the company’s internal and external risks in the same approach.
1. Have a total approach to risks
Embarking on a risk identification process should lead you to ask yourself questions as varied and heterogeneous as:
- Could the control and governance of your company be threatened in the short or long term?
- What are the counterparty risks weighing on your company (customers, suppliers, financial partners, etc.)?
- What could permanently interrupt your ability to serve your customers?
- What would be the consequence of the simultaneous departure of several key people in your organization?
- Am I sure that those who directly (employees) or indirectly (suppliers, subcontractors, etc.) engage my reputation respect the ethical rules that I have set?
- Are my information systems sufficiently secure and controlled?
- What would be the short and medium term impact of a sudden change in the economic environment (fall of the euro, $200 barrel, etc.)?
- Can the activities of my company threaten the health of my employees and my customers in the short or long term?
- Is major fraud possible?
- Can current technological developments (e.g. the explosion of social networks or artificial intelligence) call into question my business model, bring about new competitors, etc.? ?
This list could go on forever… The objective is to methodically review all the critical elements that constitute my business, and to think about credible scenarios to come up with a shortened list. The key words here are: imagination, perspective, no taboos and critical thinking!
2. Referee and take action!
Once the risks have been identified and characterized, the company must evaluate them and prioritize them according to their importance. This analysis must involve management and, ideally, all relevant managers.
The management committee then sets priorities and determines the acceptable level of risk. It then decides what actions to take to deal with the most significant threats.
Indeed, the company cannot always eliminate all risks. However, it can limit the consequences through appropriate measures and proportionate efforts. In this way, it optimizes its resources while strengthening its capacity to control risks.
Concrete example: An industrial company must anticipate fluctuations in the price of raw materials. To control this risk, it must act on several levers.
Strategically, it can reduce the share of these materials in its products. On the purchasing side, it can diversify its suppliers and secure its supplies.
Furthermore, it can optimize its stocks and regularly update its cost costs. Finally, if necessary, it can use hedging instruments on the markets to limit the effects of price fluctuations.
Tools to tackle a risk
They must be multiple:
- Can I do my best to reduce its probability of occurrence? We’re talking about prevention here. For example, implementing a double signature system on payment transactions to prevent possibilities of fraud.
- Can I reduce the impact if the risk materializes? This is about protection. For an agri-food company, this means, for example, having an effective traceability system which will make it possible to limit and identify contaminated products to be removed from the market.
- Is it possible to transfer the risk to a third party? This is the well-known principle of insurance. But it can also be a contractual transfer: subcontracting is a form of transfer. Be careful, however: a risk is never completely transferable, there always remains a residual risk!
3. Go from static to dynamic!
A business is constantly evolving! New product, organizational change, acquisition, regulatory development, etc. : the company and its environment are constantly moving. So does its risk profile. It is therefore essential to be able to reassess it regularly, to be able to “capture” weak signals and emerging risks as early as possible, and to constantly adjust control systems. In a word: be able to dynamically manage your risks!
Set up a system
- A pilot: A representative in the company must be officially in charge of running the risk management system. It is the role of Risk Manager that is currently emerging and becoming more professional.
- A methodological framework: Associated tools must be established and distributed throughout the organization (risk repository, risk mapping, indicators, monitoring systems, etc.).
- Integrated processes: The main decision-making processes (budget, strategic planning, investment, etc.) must include a risk management component. In other words, every key decision must be made with formal and conscious consideration of risks.
- Managerial accountability: Finally and above all, the organization put in place must ensure that all managers are held accountable for controlling their risks, from the management committee to the department head. Each time a risk is identified and assessed, one (or more) managers must be appointed to implement, where appropriate, a control plan and place the risk under surveillance.
Implementing a global and integrated risk management approach is now one of the key elements of modern governance. In addition to immediate added value in terms of operational control, it above all allowsut to align all stakeholders (shareholders, managers, employees) towards the same objectivekiller: the responsible and sustainable development of the companyrecovery!
