Investment - Articles - The Necessity of Risk Analysis in Enterprise

 Knowledge (of the Unforeseen) is Power: The Necessity of Risk Analysis in Enterprise

 By Randy Heffernan, Palisade Corporation

 
 In the commercial environment, businesses make decisions daily, irrespective of whether they are operating in a boom or a recession, and regardless of their sector. Each decision has an associated level of risk — where to invest, what product to produce, what quantity, which vendor to use, what price to charge, what marketing activity to pursue. The list is endless. These decisions have potentially business-critical consequences. However, many organizations do not take a strategic approach to decision-making.

 
 Few people would deny that the last few years have seen their fair share of catastrophes. In 2010, the volcanic ash cloud in Iceland caused major disruption to travel plans and wiped millions of dollars off the revenues of many companies. Also in 2010, the ramifications of the Gulf of Mexico oil spill, from lost livelihoods to strained political alliances, seem likely to be felt for many years. In 2011, the Japanese earthquakes and subsequent nuclear disasters disrupted economies around the globe. Closer to home, the United States were struck by devastating tornadoes in the Midwest and Hurricane Irene along the East Coast.

 
 These are “black swan” events. They have severe consequences but are highly unlikely to occur. They are also difficult to predict accurately - even with the best practices and software tools used by experienced risk analysis professionals. However, they serve a useful purpose in raising public awareness of risk - and potentially offer useful lessons in when and how it can be mitigated.

 
 Given the state of the current global economy, there has been a lot of talk about the need for “proper risk analysis” lately. The concept of risk analysis and management has been around for many years, but still is not well executed within many industries. Today, organizations are focusing on methodologies that can help them assess the risks more accurately. By exploring the full space of possible outcomes for a given situation, effective risk analysis can both identify pitfalls and uncover new opportunities. Instead of taking a siloed approach to managing risk, organizations should address risk holistically. All risks are interrelated, and so too must an organization’s risk modeling. One of the key concepts to pay attention to is the necessity to model correlations – or dependent relationships – between risks. For example, it is unrealistic to assume that what goes on in the legal risk department is not going to affect what happens in R&D risk.

 
 Increased use of risk analysis in the form of quantitative risk management (QRM) and decision-making under uncertainty (DMUU) is helping organizations to be prepared for unforeseen risk. But what are QRM and DMUU? Simply put, QRM and DMUU mean thinking more quantitatively, with numbers and probabilities. It means recognizing the fact that uncertainty exists in nearly every decision accounting for it in a quantitative way. One good example of this is the use of Monte Carlo simulation, which is an analytical technique that evaluates and measures the risk associated with any given venture or project. It is a computerized mathematical process that allows users to define uncertain variables in their models and see, as a result, a range of possible outcomes and the probabilities they will occur. It can show the extreme possibilities – outcomes for the most risky and the most conservative – along with everything in between. The technique works by substituting ranges for values for uncertain inputs in a model, then sampling from those ranges over and over to record new outcomes each time. This is the simulation itself, and the result is a range – or distribution – of possible outcomes and associated probabilities. It is a highly flexible tool used extensively in risk management to gain insight into what could happen so that resources can be allocated more effectively, better strategies designed, mitigation plans developed, and better decisions made.

 
 The technology is simple to use and available on any desktop computer, even as an add-in to the common spreadsheet. As a result, risk managers are currently in an ideal position to progress a cultural change towards making risk analysis an integral part of corporate operations. These tools, combined with the current public awareness of the need for better risk management, make now the ideal time to affect organizational change that can benefit companies for years to come.

 
 While there are many benefits of conducting risk analysis, key advantages include:

 
 1. Identifying pitfalls and uncovering opportunities you didn’t know existed
 2. Understanding the risk factors that are the most important and have the biggest impact on the bottom line
 3. Targeting specific variables to avoid wasting resources on low-impact or extremely unlikely events
 4. Improving credibility, making your case more persuasively to upper management, corporate, investment banks or other stakeholders when funding is needed or advancing a project
 5. Getting buy-in from those on your team when implementing a project

 
 The downfalls of not conducting risk analysis can be significant. Not to oversimplify, but it can be argued that the entire financial crisis had roots in improper or nonexistent risk analysis. Risks were ignored for the sake of short-term profitability. Not employing risk analysis strategies means ignoring what could happen and allowing an organization’s business model to be disrupted by the surprise of unexpected—yet inevitable---emergencies and disasters. Consider the following guidelines when creating organizational risk analysis strategies:

 
 Embrace risk management
 Risk management is not an optional extra. It is a business critical tool that is an asset and an integral part of the project. Company culture – not just an isolated department – must be developed to embrace QRM and DMUU in order that everyone understands their benefits and the need for them.

 
 Invest budget
 Business tools cost money, but managing risk is an investment, not an overhead. Allocating resources and making it a formal business process should be seen as an insurance policy that, by identifying potential risks, can protect the organization against unexpected costs in the future.

 
 Communicate clearly
 As with any organizational change, it is essential that everyone is clear on the new processes. Create a common risk language - using numbers, not fuzzy “what-ifs” - that everyone can understand to avoid misunderstanding and ensure a consistent approach to risk and decision analysis.

 
 Illustrate with numbers
 Qualitative assessment is essential, but numbers are more powerful. For example, talking about the percentage chance of meeting a deadline or budget is much clearer than discussing how it “probably” will or won’t happen. This is critical for avoiding miscommunication regarding assumptions. For example, Monte Carlo simulation provides the actual probabilities of various scenarios occurring, and is a good way to illustrate the consequences of different courses of action.

 
 Create structure
 Create the right organizational structure. Individuals and groups need clearly defined roles, and must take responsibility for their own area of expertise.

 
 Think laterally
 No enterprise operates in isolation, so other external variables must be included in the decision-making model and process. For example, even a small rise in fuel costs could have a major effect on revenues if raw materials need to be transported across long distances.

 
 View the complete picture
 Political, cultural and social risk factors can be explored by involving all stakeholders. Investing time and money in consultation and research ensures that businesses have a clear idea of the complete environment in which they operate, and therefore minimize the chances of products and services failing.

 
 Report and review
 Risks, and their management, must be reviewed regularly - and the program amended if necessary. Instigate a reporting process in which risks are clearly identified and prioritized.

 
 Learn new tricks
 Being risk aware does not mean being risk averse. Businesses should be careful to avoid “the way we've always done it” approach, instead keeping up-to-date, learning new tricks and being prepared to be bold.

 
 Supply evidence
 Back up the commitment to a thorough QRM and DMUU program with documentation on why it works. This validates the budget and buy-in requested at the start. And it's good for business - organizations this thorough are guaranteed a competitive edge.

 
 Paying close attention to the way risk models are constructed is the key to ensuring an accurate outcome. It’s important to look at all the outcomes, and re-examine the assumptions underlying the models. Ask questions such as “Which probability distribution do I use? How do I properly model my situation? What is the worthwhile analysis to do?” before embarking on a risk analysis project. Simulation is easy; making sure your model is accurate is the most important step.

 
 Randy Heffernan is vice president of Palisade Corporation, which specializes in risk and decision analysis software. Its most well-known product is @RISK, which adds into Microsoft Excel and provides Monte Carlo simulation, optimization, and other risk analysis techniques that aid in QRM and DMUU.