Risky Business!

What makes your company tick? How does it work? How could it break? What can be done to protect it? Underneath the polished, well-manicured image of many companies lies a reality much less appealing. "Red is grey, and yellow, white; we decide which is right...and which is and illusion!" (credit the Moody Blues...I date myself!)

Seriously though, what is right, and what is an illusion? How can the decisions made in our company come back to haunt us? To what extent are we operating under an illusion perpetrated by some, perhaps in the absence of malice, and perhaps not? Do we have enough visibility to know? Are we even asking the right questions?

The punch you don't see coming is the one that hurts the most. Other than by fortunate coincidence, it is impossible to effectively manage risks you are unaware of...even less likely if you have been misled or are in denial. So how do you effectively identify risks that can impact your organization's ability to continue to deliver its products and services to the market?

The first step has to be an understanding of how things really work. This can only happen when you have a genuine curiosity and interest in learning what others do, and how they do it. Questions flow freely when someone is truly seeking to understand. And answers are more forthcoming when a person feels that you truly are interested. People like to talk about themselves and what they do...just not to someone who sends the vibe that they really don't care.

The second step is to understand how things could break. If you skip the first step, the second step simply won't work because you will not have earned trust, and you won't understand the difference between fact and illusion. Assuming you have gained a working knowledge of how things work, a discussion of how things break and how a business manager might respond becomes a very natural and productive conversation. Unfortunately even with the best efforts to this point, beware of parties motivated to mislead you. Business managers and suppliers have strong financial incentives to deliver fiscal results which are often at odds with fiduciary responsibilities. An executive may risk losing a bonus if it is found that they have been irresponsible. A supplier may risk losing a client. The key is to understand the motivations, and be sure to ask questions in a way that ensures you get crisp answers.

The third step is to separate potential "inconveniences" from likely catastrophes. Things happen and most of them don't merit the time and energy to address them. There are operational disruptions that are encountered and addressed in the normal course of business and absorbed in the ongoing cost of doing business. Risk managers have to focus their energy and the energy of all stakeholders on risks that threaten the mission and viability of the firm and/or damage or break the foundation of every business relationship...trust. These are often single points of failure created by efforts to streamline the operation. They are more common than you think. And by proxy of dependencies, more of your business operation is exposed than you might expect.

A good place to look is in your supply chain. A superficial supply chain risk assessment will only identify companies with salient financial risks. What if they consolidated operations so that they could meet the price point your procurement team demanded, and in the process put everything in one location? It happens every day. Effective supply chain risk management must look into the operations of key suppliers to determine what risks are introduced outside of the organization. Loss of a single plant for a large global enterprise may not threaten that company's future, but if that plant was the only place they made a key component you need, it could take you out of the market.

Single points of failure and concentrations of critical mass are common in most organizations. Your mission is to find those risk intersections and make sure that they are managed and mitigated appropriately...but certainly not invisible or ignored!

As we look at our businesses, we need to focus with real curiosity and intent on how things work, so we can understand how they might break and ultimately focus limited resources on making sure that we can take the punches that eventually will come our way. Risk managers, business continuity managers and business leaders in general must see through the illusions or live in a house of cards!

What do you think?