Innovation through risk management

"David Hawley is VP Operations and founder of DMH Solutions Ltd"

David Hawley has worked in risk management and internal audit for a large UK supermarket retailer and for a Big 5 accountancy firm. His specialism is building systems for embedded risk management and for control self-assessment. He now runs DMH Solutions Ltd.

Turnbull reminds the reader that risk brings reward. The objective is not to eliminate risk; it is to defend against the damaging impact of risk and to exploit opportunities presented by it. The risk management process should not be guided down a tunnel of tying down every risk identified; it should demonstrate value by helping management achieve the objectives of the business.

The “innovate” option is interesting because it can bring the greatest value to the business, but it is also probably the risk management option that is least understood and therefore, least practised.

Once a company has identified, analysed and measured the risks to the business and its objectives (following the steps of the Australia/New Zealand risk management standard), it may have an output looking something like the risk map shown below. This particular risk map is for a global, vertically-integrated chocolate company: an imaginary company called World Candy Inc that manufactures chocolate and sells it through company and franchised outlets around the world. To fill in the picture, its headquarters and manufacturing units are located in Omaha, Nebraska.

World Candy’s mission is to be the first thought in people’s minds for gifting and celebrating; this may be for individuals or for corporate. The management see a loss of appetite for the product range to be the major risk to business success. After that, they see breakdown in quality control at franchises to be a major risk – World Candy’s loose product has to be maintained at a set temperature; also hygiene in such an establishment is crucial for customer confidence.

The step after identifying, assessing and measuring, is to “treat” the risk, that is, decide how to manage it. There are a number of models for carrying this out, frequently based on an acronym representing the list of options. A lot of companies simply think of what they will physically do to manage the risk, or else they allocate it to a single person and get them to come back with a solution. Thus, the marketing director of World Candy might have been tasked with going away and coming back with a strategy for dealing with loss of appetite for the product.

A chart of choices for how a risk might be treated can be useful in facilitating discussion and formulating the solution. Rather than sending the marketing director off to mull it over, the chart of choices can be discussed openly before assigning a responsibility. Here is a suggested chart of choices.

General Specific option Example
Avoid: get out of the business Get out of a line of business or out of a country.
Outsource: transfer the operation to an expert in that field.
Accept: live with it Do nothing.
Monitor: keep a weather eye on the situation.
Measure: work out a key performance indicator and track.
Control: put a new or improved control in place.
Insure: cover the potential loss with a policy.
Hedge: diminish risk by covering several options.
Exploit compensate: charge a higher price for the risky business.
Innovate: grab opportunity out of consideration of risk.

One of the high risk issues for World Candy is that of a quality breakdown in the franchises. World Candy has already outsourced operations (by franchising) in several countries as it does not want to have all the employee and operating issues in each of its markets. But if quality is not maintained, and this is crucial to the product, then the global brand may be damaged. The company could threaten to withdraw the franchise from any operator that does not meet the standards; in addition, it could send inspectors to tour the franchised operations. In this case, it might get franchisees to complete a regular quality self-assessment and make the return via a CSA system; it might then validate a sample of those returns.

The other high risk issue is more difficult. Loss of appetite for the product is something that the company may initially be unable to do anything about. Where risks are deemed “uncontrollable” in this or some other fashion, then there is usually scope for the “innovate” option. The simplest mechanism for revealing the innovate option is called reversal. Instead of “loss of appetite for the product”, the risk is restated as “increased appetite for the product”. The team then have to come up with a strategy that could make the new statement true.

Increased appetite could come from a high level of new product development leading to the launch of new products: they could produce ice-cream versions of their chocolate products, develop ice-cream Easter eggs to support the “celebrate” concept, make chocolates with messages inside, make products that are themselves messages written in chocolate. The strategy could be articulated then as something like “achieve 25% of sales from new lines” and this could be measured and reported on.

Another example could come from increasing the appetite for the company’s products by expanding the range of products into other areas of gifting and celebrating in addition to chocolate, but perhaps using the same distribution channels.

In reality, risk management processes and strategy formulation are frequently separate. That is a shame, since there is clearly an interaction between them.

Some real examples of the innovate option in practice include the following:

A supermarket retailer found “home meal replacement” (HMR) a major risk to its future business. In its widest definition HMR comprises ready meals, take-aways and eating out – all of which take business away from the traditional grocer, and all of which are expanding rapidly. The solution was to aggressively go into those markets and try and dominate some aspect of them say, the breakfast market in the eating out sector, and curry in the take-away sector. Instead of trying to defend against the apparent risk that “HMR will take business away from us”, the reverse of this was proposed “HMR will bring business to us”.

A pharmacy business looked at their risk map and were dismayed that the high risk issues were outside of their control since they related to regulation of the sector they were in. “We are regulated” was reversed to “we are not regulated” and expansion into unregulated, but related, sectors became a business priority.

A small, localised charity expressed one of its biggest issues as “business people (who might donate funds) do not take us seriously”. This was the biggest risk to their achieving greater funding, over and above that granted from the local authority. Reversing the issue as “business people take us seriously” led to development of a balanced scorecard to express their strategy, how they were going to achieve it, and how they would measure it. Funds were forthcoming from local business who could see that the money was producing value.

The more companies see that they can get real value from the risk management process, the greater their commitment to the process will become.