The COVID-19 pandemic serves as a prime example of external risks that companies face, causing disruptions in supply chains, declines in demand, and government-mandated closures. However, some businesses demonstrated agility, adapting and innovating in response to the crisis. For instance, technology companies like Zoom and Microsoft swiftly adjusted their offerings to meet the increased demand for remote work and online communication.

Identifying Business Risks

Risks are an unavoidable aspect of business. Companies must be equipped to identify, assess, and respond to risks effectively. Broadly, risks can be categorized into three types, each requiring a distinct management approach.

Category 1: Preventable Risks

Preventable risks are internal risks that arise within the company and are controllable. These risks often stem from employees’ unauthorized or unethical actions or from breakdowns in operational processes. While it may not always be possible to completely eliminate these risks, companies should adopt a zero-tolerance policy for any behavior that could cause severe damage.

Example - The Wells Fargo Scandal:

The Wells Fargo account fraud scandal serves as a cautionary tale. Employees created unauthorized bank and credit card accounts to meet aggressive sales targets, resulting in significant financial penalties and reputational damage. The scandal highlights the importance of robust internal controls and an ethical work environment to prevent such risks.

Category 2: Strategy Risks

Strategy risks are risks that a company voluntarily accepts while pursuing its strategic objectives. Unlike preventable risks, strategy risks are often necessary for generating superior returns. These risks cannot be managed through strict rules but require a thoughtful risk management system to reduce the likelihood of their materialization.

Example - Netflix’s Investment in Original Content:

Netflix's decision to invest heavily in original content production is an excellent example of strategy risk. This involved considerable upfront investment but allowed the company to attract and retain subscribers through exclusive shows and movies. Despite the inherent risks, Netflix’s success in this area enabled it to dominate the streaming market.

Category 3: External Risks

External risks are outside a company’s control, arising from natural disasters, political changes, or macroeconomic events. While these risks cannot be prevented, businesses must focus on identifying them early and mitigating their impact.

Example - COVID-19 Pandemic Impact on Businesses:

The COVID-19 pandemic disrupted global supply chains, reduced demand for many services, and led to government-mandated closures. Companies had little control over these factors, and those without robust risk mitigation strategies faced significant challenges.

The Importance of Forward-Looking Risk Assessment

Rather than just reflecting on past events, companies should prioritize forward-looking risk assessments to anticipate emerging threats. This proactive approach ensures organizations are better equipped to handle future risks and opportunities.

Boards and senior management play a critical role in continuously reviewing risks, supported by external experts to provide fresh insights. Forward-looking risk assessments use various methodologies:

• PESTLE Analysis: Helps identify external risks across Political, Economic, Social, Technological, Legal, and Environmental dimensions.
• SWOT Analysis: Examines a company’s internal strengths and weaknesses along with external opportunities and threats.
• Horizon Scanning: Anticipates short-term risks that may impact business operations.
• Scenario Analysis: Evaluates potential sources of significant operational risks.

These frameworks allow organizations to anticipate risks and opportunities while avoiding hidden biases. Incorporating stress-testing techniques is vital for assessing the resilience of business operations under different scenarios.

Conclusion

A forward-looking approach to risk assessment is crucial for ensuring long-term business sustainability. Companies must address internal competencies and foster a risk-aware culture to effectively manage future challenges.