Risk management for financial performance

You can carry out a risk assessment of your business by looking at your financial and business operations. This should be done at least once a year. Work with your staff and ask yourself these questions:

• What risk could potentially cause an impact to your business?
• How serious would that impact be?
• What is the likelihood of this occurring?
• When is this likely to happen?
• How can this risk be managed?

All risks will have a financial impact on your business. To help reduce the financial impact, set up ways to track your risk triggers and pick up any trends or changes. For example:

• Your gross profit falls by 6%
  • Controls: monitor your monthly gross profit trends closely to spot changes quickly.
  • Treatment: review of material sources; review your staff productivity,
• Your overheads increase by 5%
  • Controls: monitor your monthly overheads-to-revenue trends closely to spot changes quickly.
  • Treatment: review and look for ways to reduce your significant expenses.
• Your accounts receivable days go above 45 days
  • Controls: monitor your accounts-receivable days closely; look for ways to improve your invoicing (both the information you include on each invoice and the systems you use to issue and monitor invoices).
  • Treatment: put your debt collection strategy into action.

Make sure you include:

• internal issues such as staff, skills and your premises
• external factors such as customer demand, trends in the market, general economic conditions and competition.

It can also be useful to categorise risks as reputational, operational or financial.

Work out which risks will have a greater impact on your business's performance than others.

Separate minor risks that will have a small impact from major risks that will require immediate action. For example:

• a single customer defaulting on a payment is a minor risk
• a major supply chain disruption is a major risk.

Analysing risks involves deciding on the relationship between the likelihood and impacts of the risks you have identified.

Consider the likelihood and impact of each risk, and how it will impact your business performance. This will allow you to evaluate and prioritise the resources you are prepared to invest to treat these risks.

At the end of this step, you should have a prioritised list of risks that require further action.

You will need to work out which risks you consider acceptable to be left untreated and which risks need to be mitigated. Consider the '4 Ts'—treat, terminate, transfer or tolerate—when deciding how you will act on risks.

The amount of risk your business is willing to accept is called your risk appetite – this is determined by how comfortable you are with the risks that affect your business.

Once you've identified the risks you consider to be outside your risk appetite (the ones you’re not comfortable to accept), you will need to consider strategies for mitigating those risks.

Mitigation can include everything from controls to prevent risks from occurring to treatment if the risk is unavoidable. Your mitigation plan should consider the severity of the impact. For example, if the risk is a natural disaster, most of the risk management will be in treating the outcome of the disaster.

Having a planned response for each potential risk will help you to minimise the impact if risks occur. Identify when the response action should take place and a target resolution date.

Clearly set out the roles and responsibilities of each staff member for each risk. Everyone should understand what they need to do to help mitigate the risk. Risks will often affect the whole of your business, so make sure you include all staff, or staff from all areas across your business.

Regularly review your risk management plan as part of your ongoing risk assessment process. If a risk happens, review how your planning worked or didn't work. Identify what can be improved and incorporate these into your business procedures and future risk planning.

Establishing processes within your business to reduce and avoid risk can help to achieve better transparency, communication and cohesion for everyone involved. Ensure that your risk management plan covers expected behaviours, activities and any standards or codes of conduct required.