Risk management once used to focus on insurance. If you wanted to manage your risks, you bought insurance cover. But, before you can insure against a risk, you have to know it exists - and that's easier said then done. Every business is exposed to a range of risks, and business owners can't be expected to identify and manage them all. No matter how thorough, there will inevitably be some risks that get overlooked. That's borne out by a study veteran risk management consultant Allan Morris was involved in around 1997. He and his colleagues profiled a mid-sized manufacturing and exporting business to catalogue all of its risks. The list ran to more than 700, and only about 20 per cent of them were found to be insurable.
In short, insurance is one part of risk management. It covers some of the financial consequences of some of the diverse risks a business faces. But, if it's to do its job properly, it has to work within a comprehensive risk management strategy.
Nowadays, Morris is a director of Triplejump, a franchise operation specialising in risk management for small-to-medium enterprises (SMEs) and their owners. His colleague, Triplejump managing director Cecilia Farrow, says her job is to make sure business owners - especially small business owners - think about and understand the risks their businesses are exposed to. Once they've done that, they can address them.
Covering the physical risks to the likes of plant and equipment is relatively easy, the harder risks to address are what she calls "human- capital risk".
"Issues covered by human-capital risk include succession planning, skill shortages and loss of key personnel. Small-to-medium private enterprises are exposed to risk related to the loss of key personnel given the high dependence these businesses have on a few key people for driving revenue and profitability, " she says.
Risk management consultancy and insurance broker Marsh backs up Farrow's belief that risk management is more about risks to human capital than bricks and mortar.
In late 2008 it conducted its third biennial report into the risk practices of New Zealand business. It surveyed 113 senior managers across both the public and private sectors, it found their top five risks of concern were: one, a drop-off in demand; two, losing staff to competitors; three, loss of data, data corruption or failure of system security or website security; four, disruption to the business through a major incident such as fire, earthquake, flood or act of terrorism, and five, loss of productivity due to staff absenteeism, stress, low morale and staff turnover.
"It would appear that the phrase 'our people are our best asset' is finally ringing true, " said Marsh chief executive Kirk Williams. "The most valuable asset of a business is the one that poses the greatest risk, and organisations are starting to see how much they would be impacted if they lost or didn't have the right people in place."
He also noted that 36.6 per cent of organisations had no procedures to manage the loss of key staff and 23 per cent had no plan to manage losses due to lower staff productivity. "If your business assets burnt down to the ground tomorrow, the risk would normally be covered by having insurance in place. Human-capital risk is no different. People are the resource that create the most profit and losing them can expose your business financially."
Addressing that latter risk is Farrow's specialty. To show how, she highlighted an import/export company with $10m annual gross sales. "There are two main sources of revenue with 75 per cent of the revenue derived from commodity- based sales to which value is added through a production process, generating 70 per cent of the net profit. The balance of the sales revenue is generated from special production projects and is the high margin end of the business contributing to 30 per cent of the net profit.
"The managing director is a 25 per cent shareholder and is a key person. Like many managing directors of a medium enterprise he fulfils multiple functions. Critically though, he is responsible for the special project sales and the expectation is that these sales would decline on a linear basis over a 12-month period to nil if he was unable to work in the business.
"A 30 per cent reduction in net profit is substantial for any business, but the impact doesn't stop there. The management also anticipates that there would be a 20 per cent reduction in the commodity sales, further reducing net profit by 15 per cent."
So, Farrow's challenge is to enable the company to survive without its managing director. If he were absent with a short-term disability of three to six months, the directors might "take the hit". But if it was for longer, they might want to bring in a contract manager to endeavour to manage the commodity sales and operational performance of the business.
However, this will mean higher overheads because the managing director is not on a "market rate" salary, but is paid below market and topped up by bonuses and dividends.
The higher replacement salary and recruitment costs, combined with the loss of sales and higher costs would significantly cut profits, thereby lowering the business's value.
A grim scenario, but an-all-too- common one, she says.
Figures published by AIG Life in its Business Insurance Guide show that for a firm with two key people, average age 45, there is a 15 per cent chance at least one of them will become disabled for six months or more before the age of 65 and a 27 per cent chance at least one of them will die before 65. With three key people, the disability risk rises to 18 per cent and the death risk to 39 per cent, and for four key people those risks rise to 19 per cent and 48 per cent.
ACC statistics are just as grim. In November 2008, ACC published findings that 1880 businesses a year are forced to wind up because of injury to a key person. Those figures would be higher still if they also included deaths and serious illnesses.
Those statistics prompted Sovereign to launch a Business Earnings Protection cover product just over a year ago. It provides a monthly payment to the business if a key person is unable to work through illness or accident. At the time of the product launch, Sovereign managing director Simon Blair cited figures showing 40.6 per cent of CEOs, 77.6 per cent of business partners and 84.5 per cent of key employees don't have any life insurance in place.
Farrow says insurance has a role to play, but it's just part of the solution.
"The four commonly cited risk-management strategies are retain, reduce, avoid and transfer (insurance), " she says.
"SMEs facing key-person risk are typically not in a position to avoid or retain the financial effect of losing a key person. They therefore need to consider, first, insurance to cover the loss of profit and increase in costs and, second, the implementation of strategies to reduce the dependence on the key individual.
"Some practical steps to reduce the risk include ensuring that business processes are documented, multiple relationships are established with key customers and the business adopts a development programme for other employees.
While she says there's some scope for improvement in some of the products on offer, insurers are providing better choice and more tailored product options.
Wellington risk management and insurance consultant John Sloan occupies a different niche. His work mostly involves reviewing organisations' risk management arrangements and insurance cover, and then recommending changes from strategic policy settings to specific insurance products.
"The heart of risk management remains loss prevention and loss mitigation, " he says. "Insurance . . . it's about picking up some of the pieces by getting financial compensation when a loss has been incurred."
He also points out risk management can cut costs. "If you have a decent risk management plan in place you can negotiate lower premiums, " he says. An example is that having car alarms or immobilisers fitted should mean lower vehicle premiums while a sprinkler system should lower your property premiums.
He stresses insurance cover shouldn't be a case of "set and forget", but it needs to be reviewed. Issues to consider include which risks are insurable; which risks are you "self- insuring", excesses, the basis on which the sums insured are calculated and any changes to your situation or business which could affect your insurance needs or cover.
For example, he says, joint ventures can create issues where both parties assume the other has arranged cover. "As a joint venture is usually a separate legal entity, it needs separate insurance, particularly for property, business interruption, public liability insurance and personnel insurances."
He advises taking the time to ensure an appropriate right sum insured for loss of profits cover.
"Selecting the correct sum insured is where accounting difficulties can emerge. The traditional approach has been to take the net profit then add on the fixed standing charges which would continue.
"These are the fixed charges such as rent, rates, insurance premiums, directors' fees or other fixed charges which still have to be paid whether the business is fully operational, partly operational or not going at all, " he says. Independent
Join the CIO New Zealand group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.