RISKY BUSINESS

EVERY BUSINESS FACES SPECIFIC RISKS, BUT THERE ARE SOME UNIVERSAL TRUTHS WHEN IT COMES TO ASSESSING THEM

Every business faces specific risks, but there are some universal truths when it comes to assessing them.

There is risk in everything we do. There’s no escaping it. Just when you start to feel comfortable, bam, up pops something unexpected or, perhaps worse, something you should have known was coming. Look at all the investors who were lulled into complacency by rising and relatively smooth stock markets in North America and then burned when the correction just about every analyst was predicting arrived in August. The lesson learned, as every Boy Scout knows, is simple: Be prepared.

Of course, there’s no way to predict how things will turn out. Even government-sanctioned monopolies or oligopolies, the most coveted of business models, face plenty of risks, from government changes to public opinion. Just ask Air Canada, which was privatized in 1988 and subsequently had major problems that led it into bankruptcy protection. Or ask Ontario’s Brewers Retail, the provincial-backed monopoly beer retailer, whose foreign owners have been forced to open their doors to the very same craft brewers that are eating into their market share.

Risk, of course, largely depends on the industry, but generally encompasses competitive, regulatory, political and operational components. That said, risk management practitioners say there are some broad rules that can help just about any business figure things out. Gaetano Geretto, founder and president of Pelecanus Strategic Advisory Services Inc. in Toronto, even has developed an acronym for it: IQM, which stands for identification, quantification and mitigation. And, unlike investing, past performance is key in predicting future results.

“Actuaries sometimes get accused of living their lives through the rear-view mirror, but the reality is you need to go on past events,” Geretto says. “Think of all the actuaries who use earthquake data or catastrophic events like storms or hurricanes to get a sense of the amount of loss. You need something to go on to serve as a benchmark, but then you take information and tweak it a bit based on your current circumstances.”

Others in the industry follow a similar path. Carol Willson, an associate partner in the risk practice at Ernst & Young, says the first step is to understand an organization’s strategic, operational and business objectives, which lends context to the risks that are then identified. She says it’s possible for companies to manage risk on their own in an ad-hoc fashion, especially if they have someone initially walk them through the steps. But best-in-class organizations are making the process more formal and disciplined, even to the point of auditing to make sure the process has the rigour and discipline in relation to acceptable standards, such as ISO 31000 by the International Organization for Standardization, and COSO 2004 developed by the Committee of Sponsoring Organizations of the Treadway Commission, an independent private-sector initiative sponsored by five professional associations in the U.S.

A lot of how businesses approach risk is up to the risk tolerance of their owners or executives and board. More risk, more reward, at least in theory. Geretto says the decision for businesses is similar to the ones that people make in their own lives on a regular basis. For example, you will likely take out insurance when you buy a home — something you have to do if you take out a mortgage — but how much insurance is up to you. Having a $500 deductible will be more expensive than having a $10,000 deductible, but you’ll have more peace of mind knowing that just about everything that could happen is pretty much covered.

Likewise, professionals may want to take out liability insurance if they are giving advice in case that advice is wrong and they are held liable for the resulting damage. Entrepreneurs can spread the risk of starting a business by getting more investors. Of course, they would then also share