Understanding and Managing Risks - June 2012
KnowledgeBrief concepts referenced:
Risk Management in Purchasing and Supply Management
Supply Chain Risk Management (SCRM)
Risk management is often treated as a compliance issue and an exercise in rule-following. Maximising compliance is, of course, a sensible precaution but rule-based management neither reduces the likelihood of disasters nor their impact. Executives need to understand the distinctions between different risk categories and tailor risk management strategies accordingly.
Risks fall into one of three categories:
1. Preventable risks: internal risks that are controllable and should be avoided – for example,managers’ unauthorised or illegal actions and risks arising from operational process breakdowns.Best managed by: active prevention to help monitor operational processes and guide employees’ behaviours and decisions toward desired norms. It requires a well-crafted mission and value statements, strong internal control systems (separation of duties and whistleblowing processes), and a capable internal audit department to deter bad behaviours and detect violations.
2. Strategy risks: companies must accept some voluntary risks in order to generate superior returns – for example, in R&D activities or new market penetration. Best managed by: open and explicit discussions. Such a system does not prevent risks, but enables companies to undertake risky ventures – with potentially high rewards – that competitors with less effective risk management systems could not.
3. External risks: some outside events are beyond a company’s control, such as natural and political disasters and macroeconomic shifts. Best managed by: focusing on identifying and mitigating their impact.
Action point: Consider how effectively your company handles risks across the three categories:
Conclusion
• Does your company use an integrated culture-and-compliance model for preventable risks, whereby missions/values, standardised operating procedures, internal controls and auditing work together seamlessly?
• Does your company rely on techniques such as interactive dialogues, key risk indicator (KRI) scorecards, and resource allocation to mitigate strategy risks?
• Are external risks ‘envisioned’ using tail-risk assessments, stress-testing, or scenario planning exercises with management teams?
