Thinking About Risk: Seven Techniques to Alter Degrees of Risk (for Small & Mid-sized Companies)

Published in the Westchester County Business Journal, January 22, 2018

Failure to plan how to avoid or recover from unwanted risks can put you out of business. And, not taking any risks will also put you out of business. What’s a business to do?

The Wall Street Journal quotes Cathy Bessant, Bank of America’s Chief Operations and Technology Officer, as saying “There is only one way to be fully protected, and that is to shut the place down.” (October 30, 2017, page R6). Consider your enterprise’s day-to-day activities and your strategic initiatives: for example, expanding operations, opening a new facility, introducing new products and services, hiring staff, upgrading technology and failing to upgrade technology. Each comes with some level of risk. By being conscious of these risks, considering the tradeoffs and alternative risk “treatments,” your medium or small enterprise can reduce potential downsides.

Under the auspices of the International Standards Organization (ISO), risk management specialists compiled principles and guidelines to help us think about risk. The standard (known as ISO 31000) makes clear that these are to be adapted for each business and that the context – e.g., your business’s objectives, physical location, political jurisdiction, industry, etc. – is important and different for each enterprise. While the ISO guidance is general, it provides a useful outline of issues for any organization to consider. Adapting the ISO approach, I will ask three questions and outline seven types of responses to the third question.

Question 1: What are your enterprise’s objectives? Perhaps to deliver health care services, to sell books or food, to entertain people or to house them, to educate children or adults, or to manufacture furniture or machine tools, household goods, or office supplies.

Question 2: What are the enterprise’s primary risks? Take time to make a list, including those associated with day-to-day operations as well as current and potential strategic initiatives, and get input from key staffers. Discuss whether these risks are big or small.

Remember that consequences can be positive or negative. Taking risks can bring positive payoffs as well as hiccups and disasters. Risks and consequences range in size and potential severity as well as in likelihood. The point of risk savvy is to sufficiently reduce or moderate the downsides while supporting the potential positive results.

Question 3: What options does are available to the enterprise? To illustrate the seven types of actions to address risk outlined in ISO 31000, let’s create a hypothetical company and perform an obviously simplified risk analysis. Our company is a small, domestic manufacturing company (“SDM Co.”) considering international expansion to better compete with larger, global competitors. The primary risk is that SDM Co. will invest significant time and money and fail to make a profit. Possible problems include difficulty obtaining appropriate staff, local laws and regulations, cross-border trade costs and restrictions on goods or funding, and insufficient access to new markets. Depending on the level of investment required, the failure of this expansion could force SDM Co.’s domestic operations into bankruptcy.

Risk approach: Avoid the risk by deciding not to start or continue with the activity that gives rise to the risk.

SDM Co.’s option: Drop plans for international expansion.

Risk approach: Remove the risk source.

SDM Co.’s option: This approach would be more applicable to a physical risk, such as environmental contamination or a facility in need of repair. Here, the option is, again, to drop plans for international expansion.

Risk treatment: Change the likelihood.

SDM Co.’s options: Research target countries carefully, including competitors, size of possible market, legal structures, and political stability. Consider partnering with an existing company in the target country to gain access to local market knowledge. Hire local experts; consult experts in cross-border manufacturing issues.

Risk approach: Change the consequences.

SDM Co.’s options: Consider acquiring or partnering with a going concern in that market to reduce possible losses. Limit initial investments until SDM can get committed contracts for future work. Work with attorneys to isolate the new venture’s losses from the existing domestic company.

Risk approach: Share the risk with another party or parties (including contracts and risk financing).

SDM Co.’s options: Again, consider a joint-venture. Work with banks to establish low-cost, low-risk hedges for foreign exchange variations. Establish separate funding sources (Bonds? Stocks?) tied only to the new investment.

Risk approach: Retain the risk by informed decision.

SDM Co.’s option: Do the homework, use techniques to reduce or mitigate identified risks, and consider the costs of those mitigation techniques (e.g., a joint venture could reduce the size of SDM Co.’s investment and possible losses but will also decrease its share of the potential profits).

Risk approach: Take or increase risk in order to pursue an opportunity.

SDM Co.’s option: Do the homework, take steps to increase the likelihood of success (e.g., selection of country, product, partners, or financing) and go for it!

Michele Braun directs the Institute for Managing Risk at Manhattanville School of Business (, 914-323-1238) and is always ready to talk risk and payments as Managing Executive of The Crossway Group, LLC, consulting and professional training firm (

Leave a Reply

Your email address will not be published. Required fields are marked *