Given the current economic climate, small-business owners are wondering what risks may lay ahead, and how to identify and manage them. But rather than focusing on risk as a negative, entrepreneurs should consider risks as opportunities, says Max Rudolph, an actuary whose firm, Rudolph Financial Consulting of Omaha, works primarily with small and mid-size companies. He spoke recently with Smart Answers columnist Karen E. Klein about how risk management can help small companies today. Edited excerpts of their conversation follow.
Q: What can an actuary do in terms of risk management for a small firm?
A: A lot of what I do is helping them identify what their risks are from the operational side. Most business owners are aware of certain risks, but almost always we can help them identify some others that they should be thinking about.
Q: A risk sounds like something to be scared about, but you say that risk isn't always bad.
A: We look at risks from both the downside and the upside perspective. For instance, if you're a local hardware store in a recession, you might think about the risk that your sales will go south. But you might also identify a niche where your sales will do better in a recession, and emphasize that.
Q: What are some typical risks facing small companies?
A: We break them down into categories. There are operational risks, like fraud, losing employees, or what you'll do if one of your key employees becomes disabled. Then there are financial and insurance risks and strategic risks, such as how you as the business owner are going to achieve your goals if your long-term business plan doesn't work out.
There are some particular risks in today's business climate for small companies, such as what you'll do if your bank is not able to roll over your business loan. In that situation, you can minimize the risk by diversifying your bank accounts and developing relationships with other bankers in your community.
Q: How often should business owners assess their company's risk?
A: When we go through an enterprise risk-management project with a company, we look at it again a year later and make revisiting it a process that evolves over time. Each time you look at the plan, you change it and tweak it based on information from the real world.
How it Works
Q: What's the process of risk analysis?
A: We sit down with all the department managers and ask them, "What are you worried about today?" "What's keeping you awake that you know could happen in the next six months to a year?" We try to get input from as many different areas within the company as possible.
From their answers we draw up a list of risks and we prioritize them, ranking them by frequency and severity of the risk. We come up with a top three or five in each department. Then we talk to the CEO and the CFO and ask them the same questions, as well as "What are the risks to accomplishing your five-year and your 10-year business plans?"
Once we know what the major risks are, we can come up with a strategy for managing them through setting up a risk-management culture within the company.
Q: Does a small firm have to hire an outside consultant to do an initial risk analysis?
A: No, not at all. Primarily it is an internal process, though it is helpful to have an outside perspective. A small firm might check with a local university and see if it can tie in with an intern program. The Society of Actuaries has a directory where you can find a professional in your area. It doesn't have to cost a lot.
Q: Often, companies fail because they take on a big risk thinking it's a positive—such as acquiring another firm or starting a new product line—but it turns out negative. How can they avoid such missteps?
A: If the CEO buys into the risk-management culture, everybody in the company will be considering risks and how to manage them. I love the idea of having one person in the company become a "commonsense officer" or a "chief skeptical officer" who is encouraged to challenge the CEO about taking on new risk but won't get fired for doing so.
Q: Is there a positive side to the tough economic times we're facing, in terms of reacquainting business owners with the concept of risk management?
A: Unless we have tough times periodically, it's really hard to implement risk management. If things are good all the time, people just view risk management as a cost, or an annoyance. It should be thought of as optimizing the company's potential for the future.