Sales are sexy.  Sales make the world that is your small business turn.  No matter what your business, your business is about sales.  Sales are what allow your small business to turn your vision into reality.  Sales are what allow your small business to deliver your mission.

All the above statements are true.  It you’re not selling you won’t be in business for long; which is why we work so hard to market and sell our products and services.

However, when it comes to protecting your small businesses’ profit margin, sales aren’t everything.  Do we speak heresy?  Aren’t sales everything?  In a word “No.”

Risk management is just as important to the success of your small business as sales management.  But many small business owners hide their heads in the sand when it comes to risk management.  For one, it certainly isn’t as sexy as sales.  Besides, if we spend all our time thinking about what could go wrong that’s time that could have been spent working to get things right – right?

Risks Are Not Problems

Perhaps the most potent turn off when it comes to risk management for small business owners is that the process appears to be such an arduous and complicated task.  Not to mention the fact that most small business owners have little, if any, experience in how to perform a risk assessment. But before we get into that, you might still need a bit of convincing as to why performing risk assessments are just as important as deploying sales campaigns.

Let’s start off by stating that risks are not problems.  A problem is something that has already occurred.  When you’ve got a problem it is real and you react to it by seeking a solution.  A risk, on the other hand, hasn’t happened.  A risk is a possibility that something bad (or good) will, or might, happen sometime in the future.  Obviously we want to lower the risk of something bad happening to our business and increase the risk of something good happening to our business.

When it comes to the risk of something bad happening, it only makes sense to identify what that risk (or risks) might be and then act in ways that lower that risk.  Here’s a simple example:

You need to get something off a shelf.  You notice the shelf where the item is located is two feet over your head.  Depending on what you use to climb on to retrieve the item from the shelf either increases or decreases your risk of falling.  If you decide to use the lower shelves as a make shift ladder there’s a high probability you’re going to fall.  Use your rolling office chair and you decrease the risk of falling, but it’s still a likely outcome.  Use a stable step stool you decrease your risk of falling significantly.

This simple example contains all the basics for risk assessment:

1. Identify potential risk(s)
2. Quantify (measure/rate) the risk
3. Develop a plan or process to respond to the risk

Identify Potential Risks

Potential risks to your small business can be either internal or external to your small business.  Internal refers to things such as employees, facilities, procedures, and processes; basically any risks located within your business.  External risks include things outside your business such as regulations, politics, economic conditions, weather, competitors, consumer behavior; basically any risks that come from forces outside of your business.

There are a variety of tools and techniques to help you identify potential risks such as:

• Surveys (i.e. Customers, Vendors, Suppliers)
• SWOT Analysis (Strengths, Weaknesses, Opportunities, Threats)
• PEST Analysis (Political, Economic, Social, and Technical)
• Mapping business processes
• Scenario Analysis (“What if ______ happened?)
• Brainstorming Sessions

Quantify the Risk

This is where risk assessment for many small business owners can seem to get “too complicated.”   Surely there are indeed complicated approaches to quantifying risk, but they can be broken down into three simple steps:

1. First and foremost, risks need to be assigned a value – meaning you need to establish a dollar amount for that risk.  For example, if you have a customer that brings in 25% of your sales, it’s pretty easy to put a dollar amount on what it will cost your business if you lose that customer.  Or, if you have a young female receptionist you can estimate the cost of her taking family leave should she become pregnant.
2. After you’ve estimated the cost of a particular risk, you then need to rate the risk in terms of probability it will happen.  While there are many resources to assist you in assigning a reasonable cost estimate for a particular risk (i.e. you can estimate the cost of hiring a temporary employee to replace your receptionist while out on family leave) – rating risks is usually a more subjective process.  However, simply rating the probability of a risk occurring as high (100%), medium (50%), or low (25%) is usually quite sufficient.
3. Once you’ve rated the probability of a specific risk it is time to assess the impact it will have on your business.  For instance, if your receptionist going on family leave is estimated to have a cost of $10,000 and you’ve assigned a medium (50%) probability this will happen  you can use a simple equation to assign a risk rating:  $10,000 (cost) × .50 (probability risk will occur) = 5000 (Risk Rating.)  By assigning a numerical value to specific risks you can then rank each risk in order from highest to lowest – this makes it a much easier process to prioritize and respond to risks.

Develop a Plan and/or Process to Respond to Risk

In our example of getting something off a shelf that can’t be reached when standing a small business owner estimated the cost of a workers compensation claim and hiring a temporary employee while their employee’s broken wrist healed.  The small business owner then assigned it a high probability as there wasn’t a step stool located in the office supply room.  When those two variables were placed in our risk rating equation and then compared to other risks, it became a high priority to respond to the risk.  In this case the response was simple – a quick trip to Home Depot to purchase a sturdy step stool.

Depending on a particular risk, there are four basic ways to respond to risk:

Avoid the Risk.  This means changing your process, project, schedule – even abandoning a project or process completely – in order to totally avoid risk by creating zero probability it will happen.

Accept the Risk.  There are some risks that cannot be avoided and that we don’t have any control over.  However, accepting the risk also means not planning to take any action or respond to that risk in any way.  This is most often the response to risks that have low probability/low impact.

Transfer the Risk.  The most common way to transfer a risk is via insurance; for instance, a restaurant owner transfers the risk of a kitchen fire by insuring their restaurant.  You can also transfer risk by contracting.  For example, a business consultant contracts with an economist to perform a market analysis in order to avoid the risk of providing misinformation to a client.

Mitigate the Risk.  This refers to responses that reduce both the probability and/or impact of a risk.  You mitigate a risk in one of two ways:  through prevention or contingency.  For example, buying a step stool mitigates the risk of falling by prevention.  Cross-training your accounts payable clerk to act as receptionist is a contingency response to the risk of your receptionist taking family leave after the birth of a child.  Prevention answers the question “What can we do now to lower the probability/impact of this risk?”  Contingency answers the question “What will we do when this happens?”

Finally, we don’t want to end this discussion of risk assessment without mentioning risks can also be exploited, that is, turned into opportunities.  For example, you may have given losing that customer bringing in 25% a high rating and high priority response.  However, when developing plans to mitigate the risk of losing that high stakes customer, you also identify deepening your relationship with that customer for the purpose of obtaining referrals as an opportunity to obtain additional high dollar accounts.  You also identify developing an overall referral program with the objective obtaining 80% or your business from referrals.