Only 44% of small businesses stick around four years or more. One big reason so many go away: Poor risk management.
Fortunately, help is on the way from the guys at VC Experts (subscribe to their email here).
They’ve published a helpful how-to on the art of risk management from Akira Hirai, the founder and managing director of Cayenne Consulting. With permission, we’ve excerpted the best bits below.
The Risk Management Framework
“Risk Management” is the art and science of thinking about what could go wrong, and what should be done to mitigate those risks in a cost-effective manner.
In order to identify risks and figure out how best to mitigate them, we first need a framework for classifying risks.
All risks have two dimensions to them: likelihood of occurrence, and severity of the potential consequences. These two dimensions form four quadrants, which in turn suggest how we might attempt to mitigate those risks:
Once we know the severity and likelihood of a given risk, we can answer the question: Does the benefit of mitigating a risk outweigh the cost of doing so?
Quadrant A: Ignorable Risks
Cost effectiveness is an important consideration in deciding how we face up to risks. Risks with relatively minor consequences and a relatively low likelihood of occurring — those in Quadrant A of our framework — obviously aren’t worth spending a lot of time worrying about.
An example of a low-likelihood, minor-consequence risk might be the possibility of getting a flat tire on your way to a routine meeting. Assuming you service your car regularly and you drive on maintained roads, a flat tire might cause you to be late to a meeting once every 10 years. It’s not a big deal.
Quadrant B: Nuisance Risks
The next category of risks are those we call “nuisance risks” — little things that often seem to go wrong, but whose impacts are easy enough to minimize through straightforward changes in behaviour. There are countless examples of nuisance risks and simple solutions:
- The printer runs out of toner while you’re preparing the proposal for the customer meeting that starts in 30 minutes. Solutions: don’t wait until the last minute, and always keep extra toner on hand.
- Your lead engineer gets the flu three days before the scheduled release date of your first customer beta. Solutions: create a development process free of dependencies on any one person, and build in contingencies for the fact that almost everything seems to take twice as long and cost twice as much as you originally expect.
- You knock a mug of coffee into your laptop keyboard and coat your hard drive in cream and sugar, making your marketing plan inaccessible. Solution: use software to perform automated daily backups so that you’ll lose, at most, a day of work if you destroy your computer.
With a little common sense, nuisance risks shouldn’t cause any lost sleep.
Quadrant C: Insurable Risks
Risks that could have major consequences but are relatively unlikely to happen are often insurable. Insurance is the practice of spreading the cost of an improbable loss across a group, so that no single individual bears the entire cost of a disaster. Everybody pays a premium to the insurance company, and the insurance company pays claim benefits when one of its customers experiences an insured loss.
Here are a few common forms of insurance and the risks they cover:
- Property & Casualty Insurance can mitigate losses from fire, theft, and natural disasters;
- Key Executive Insurance can mitigate losses from the death or incapacitation of a management team member;
- Liability Insurance can mitigate lawsuits resulting from product defects or on-site injuries to visitors;
- Errors & Omissions Insurance can mitigate lawsuits from disgruntled customers; and
- Directors & Officers Insurance can mitigate lawsuits in cases of negligence, harassment, or discrimination.
Even uncommon risks are often insurable. Some underwriters specialize in writing unusual policies: event cancellations due to adverse weather; or injury to specific body parts (early examples include Jimmy Durante, who insured his nose for $50,000, and Fred Astaire, who insured his legs for $75,000).
Quadrant D: The Company Killers
Now we come to the Company Killers: the risks with both a relatively high likelihood of occurrence and major consequences. These risks can sink startups and Fortune 500 companies alike. The survival of your venture depends on your ability to identify and mitigate the company killers.
The thing that makes company killers so deadly is that there are so many of them. Individually, they may seem manageable, but collectively, they represent a true challenge for any entrepreneur.
For example, suppose you manage to distill your world down to just 10 company killers and you think you’ve eliminated 90% of the risk in each category:
- There’s a 90% chance that you’ve identified a genuine market need;
- There’s a 90% chance that your addressable market is as big as you think it is;
- There’s a 90% chance that you can actually implement your innovation;
- There’s a 90% chance that you can figure out how to sell it for more than it costs you to make it;
- There’s a 90% chance that you have assembled the right management team to do the job;
- There’s a 90% chance that you manage to stay one step ahead of the competition;
- There’s a 90% chance that you don’t get sued into bankruptcy;
- There’s a 90% chance that you won’t get buried in regulatory red tape;
- There’s a 90% chance that you don’t run out of money; and
- There’s a 90% chance that nothing else goes wrong.
You might take comfort in the fact that any one of these risk factors presents only a 10% chance of sinking the company.
However, the probability of surviving all 10 risk factors (making a technical assumption that the 10 risk factors are statistically independent of each other) is:
90% × 90% × 90% × 90% × 90% × 90% × 90% × 90% × 90% × 90% = 35%The key insight here is that a company that is reasonably good at managing individual risks might have a marginal chance of surviving overall. That’s why “reasonably good” isn’t good enough — risk management must be among the entrepreneur’s core competencies.
Identifying & Mitigating the Company Killers
Companies flatline when the cash runs out and total current liabilities (i.e., bills due now) exceed total liquid assets. Risk management is all about identifying and mitigating the uncertainties — especially the company killers — that surround cash flows.
Uncertainty plagues businesses in countless ways, but we can group most company killers into the following categories:
- Market Risks
- Competitive Risks
- Technology & Operational Risks
- Financial Risks
- People Risks
- Legal & Regulatory Risks
- Systemic Risks
These categories are neither exhaustive nor mutually exclusive. Some risks span several categories. Let’s look at some examples.
Market risks refer to whether or not there is sufficient demand for what you have to offer at the price you set. Many inventors have died penniless, clinging to the belief that the market would beat a path to his door if he designed the better mousetrap.
Fortune 500 companies spend billions on market research, and every year, they introduce products that are an instant flop. On the other hand, in 1943, the president of IBM allegedly predicted, “I think there is a world market for maybe five computers.”
Unless what you sell is a commodity, there is no easy way to know how the market will receive any new product. Feedback from friends, surveys of potential customers, focus group testing, and beta testing are all useful techniques for helping to gauge market acceptance. However, nobody — not you, not your best friend, not your venture capitalist — can know for sure whether people will spend money on your solution until you actually try to sell it.
One way for entrepreneurs to mitigate market risk is to avoid perfection. It’s a fallacy to think that any product will ever be “finished” in the sense that it will make all users completely happy. When your product becomes good enough to make some customers reasonably happy, get it into the market where it can start generating cash flow and feedback.
As Steve Jobs put it, “Real artists ship.” Until real customers start using and talking about your actual product — as opposed to some mock-up you test in a focus group — you have no real way of knowing what you are doing right and what you are doing wrong. Release — observe — improve — repeat.
Every venture has more competitors and fewer competitive advantages than it thinks. If there is money to be made by satisfying a pressing need in the marketplace (is there any other way to make money?), you can be sure that plenty of others are gunning for that same consumer dollar.
Business is a contact sport, and some of your competitors will play rough. They’ll copy your business model. They’ll try to out-innovate you. They’ll try to out-spend you on marketing. They’ll start price wars. They’ll start rumours about your product. They’ll try to do an end-run around your patents. They’ll try to steal your trade secrets. They’ll try to poach your best people. Just because you’re paranoid, it doesn’t mean they’re not out to get you.
To stay ahead of your competition, you must continuously ask yourself — and your trusted advisors — what others might do to try to beat you, and then develop appropriate defenses. Know your Strengths, Weaknesses, Opportunities, and Threats — S.W.O.T analysis isn’t just a business school exercise. Figure out what you do better than all of your competitors — whether it be price, features, quality, or some other advantage — and focus on maintaining your leadership in that category.
Technology & Operational Risks
It’s one thing to say you’re going into the business of making and selling widgets. It’s quite another thing to master the actual mechanics of making and selling widgets.
Technology and operational risks broadly cover everything having to do with execution: Can your team finalise the product design on a limited R&D budget? Will your product work as intended? Can you find reliable vendors? Can you manufacture it? Can you optimise the logistics of product distribution? Can you create an effective product support infrastructure? Will your firewall prevent hackers from stealing customer credit card numbers? Do you have a backup plan to keep your company running when an accident destroys some key equipment in your data centre?
When it comes to execution, there’s no substitute for experience. It’s all about careful planning and watchful management by people who know what they’re doing. Businesses started by rookie entrepreneurs blow up disproportionately because they don’t know how to avoid even some more obvious land mines.
Mistakes are inevitable; we all learn from our mistakes and become better over time. However, research by Gompers, Kovner, Lerner, and Scharfstein (Performance Persistence in Entrepreneurship, Harvard Business School, 2008) suggests that entrepreneurs with a track record of success have a much higher probability of future success (30%) than first-time entrepreneurs (18%). (The paper studied entrepreneurs who raised venture capital, and defined “success” as having or registering for an IPO.) Learning from past mistakes is important, but if you really want to increase your chances of success, then find some co-founders who have succeeded in the past.
The end of the road for any business is running out of cash. Some days, when you’re an entrepreneur, it seems like all roads lead there.
For startups, the biggest financial risk stems from not having a Plan B in case investors and lenders say no (or don’t say yes quickly enough). Many entrepreneurs fail because they make the mistake of betting everything on being able to secure outside financing.
It’s true that many types of capital-intensive businesses do require significant startup funding. But if you’re a rookie entrepreneur, the odds of finding an investor willing to take a huge risk on you are slim. It may be more prudent to start a business that requires a more modest amount of initial funding. You’ll also want to have two separate business plans: one for growing the business if you happen to succeed at finding an investor, and one for bootstrapping the business if you have to go it alone.
If you do succeed at raising capital, the next trick is to figure out how to start generating enough revenues to cover your costs before you run out of money. If you thought raising capital was tough, you’re in for a surprise.
Financial risks don’t disappear once your business is up and running. Any number of things can adversely affect the cash flows of operating ventures: Customers can default on your invoices (credit risk). The cost of your raw materials could skyrocket (commodity price risk). A strengthening dollar can reduce the net profits from your international customers, or a weakening dollar can jack up the cost of your offshore manufacturing operations (exchange rate risk). A spike in interest rates could raise the cost of your working capital (interest rate risk). A plunge in the value of stocks or real estate you pledged as collateral could cause your bank to cut your credit lines (asset price risk).
Entrepreneurs quickly discover that it’s impossible to raise money when you need it, and everybody wants to give you money when you don’t need it. One way to mitigate financial and other risks is to take funding when it’s available and keeping it in reserve for a rainy day.
People are, at the same time, the most crucial and least predictable element of any business.
The right combination of experience, contacts, and temperament among the founding team can vastly increase a venture’s odds of success. Failure to recruit, motivate, and retain the right partners can spell doom.
Companies fall apart when it develops major rifts: when one faction wants to move one way, while others seek a different result.
As an entrepreneur, one of your most important responsibilities is to establish a clear vision and culture that the entire team can rally behind. Everybody needs to row in the same direction. Everybody needs to be able to tolerate each other for 80 hours a week. You must manage strong egos, mediate personality clashes and disagreements, and rein in rogue team members.
A company is only as strong as its weakest link. Don’t let personal relationships cloud your judgment: your old college roommate might be a good marketer, but she may not be the best person to market your specific product to your specific target market. If you discover that a member of your team isn’t going to work out, you need to fix it quickly before the situation gets worse.
Legal & Regulatory Risks
Lawyers get paid the big bucks to keep you out of trouble. So do other specialists, if you happen to be in a heavily regulated industry like pharmaceuticals or air travel.
The list of possible problems with legal or regulatory roots is almost endless: tax complications stemming from your choice of legal entity or state of incorporation; disputes arising from poorly structured agreements; lawsuits filed by a competitor alleging misappropriation of trade secrets by one of the hotshot programmers you recently recruited from them.
The first step towards mitigating legal and regulatory risk is to learn enough about the subject so that you can fully appreciate what you don’t know. The Entrepreneur’s Guide to Business Law by Constance Bagley and Craig Dauchy is a great place to start.
The second step is to retain the right attorneys — usually, one for corporate matters and another for intellectual property matters. You must manage them effectively and follow their counsel when it makes sense (many legal decisions come with degrees of risk and reward that you need to balance). Finally, you must keep your attorneys informed of what’s happening in the business so that they can address potential problems before they get out of control.
Systemic risks are those that threaten the viability of entire markets, not just a single firm within a market.
For example, rising default rates in the subprime mortgage market, and the subsequent domino effect among financial institutions created by linkages embedded in mortgage-backed securities and credit default swaps, have had a profound impact on the global financial system.
There are plenty of less widespread, but no less real, examples: A spike in the cost of fuel is squeezing the entire passenger airline industry. The availability of low-cost skilled labour in emerging economies is challenging the viability of many domestic manufacturing businesses. A suspected case of mad cow disease can corral beef sales for months or years.
Pragmatic Risk Management
Creating a pragmatic risk management plan is straightforward in concept, if not in execution. Prepare a table with the following seven columns:
- Risk Factor: List anything you can think of that could cause substantial harm to your business.
- Type: Assign the risk to one of the categories described above, e.g. market risk, competitive risk, technology & operational risk, etc. Assigning a type can suggest who might be best qualified to manage that particular risk (for example, your CFO might be responsible for looking after your firm’s financial risks).
- Likelihood: Think of the relative likelihood of manifesting this particular risk factor. Simple descriptors like high, medium, and low should be sufficient.
- Consequences: Describe what would happen to the company if this risk factor manifests itself.
- Mitigation Tactics: List the things you can do either reduce the likelihood or minimize the impact of the consequences if this risk factor manifests itself. Note that just because a tactic is available, it doesn’t mean you should employ it.
- Mitigation Costs: For each mitigation tactic, think about the implementation cost.
- Status: Once you have assembled the first six columns, you need to decide which mitigating tactics, if any, you need to implement. Your choices will depend on your personal risk tolerance — there’s no right or wrong answer. Whatever actions you do take, you should document them in the Status column of your risk management plan.
As you develop your risk management plan, you should obtain input from your entire senior management team, as well as from your advisors and board members. We’ve all made different mistakes and learned different lessons, so it will be helpful to obtain multiple perspectives. Like your business plan, your risk management plan is a living document. You should review and revise it regularly as your circumstances evolve.
Finally, although it’s important to develop a risk management plan, you shouldn’t obsess over it. Anticipating every possible risk factor is neither possible nor practical. That’s because no matter how smart we are, and no matter how carefully we assess the situation, we can’t think of everything.
Consider the startups that manage to attract venture capital: these are promising firms, flush with cash, operating in a “hot” and growing market, run by gifted entrepreneurs, with a demonstrated ability to meet important milestones, carefully chosen through a highly competitive selection process by experienced venture capital investors, watched over and mentored by advisors and Board members who have “been there and done that.” With all of these factors going in their favour, the majority of VC-backed firms still fail!
Pragmatic risk management isn’t about trying to anticipate and mitigate every possible source of risk. It’s really about two things:
- Engaging common sense to recognise and mitigate the most obvious risks in a cost effective manner, using some of the techniques described in this article; and
- Developing a culture of responding to unanticipated developments — that is, putting out fires — in a calm, rational way.
Don’t let risk paralyze you. Entrepreneurs are, by definition, risk takers. Strong risk management is an important source of competitive advantage. You can beat the odds and build a thriving and rewarding venture by learning to recognise and mitigate risks.
Cayenne Consulting, launched in 2001, provides advisory services to entrepreneurs who are preparing to raise capital. Cayenne’s services include business plan development, financial forecasting, strategy development, market research & analysis, competitor research & analysis, presentation development, interim management, capital formation strategy, executive coaching, company valuations, and turnaround consulting.
Cayenne has served clients in a range of industries, including alternative energy/green tech, software and Internet, telecommunications, media & entertainment, education & e-learning, medical devices, biotech & pharmaceuticals, healthcare services, commercial & residential real estate, manufacturing, aerospace, financial services, and consumer products and services.
Cayenne has an unparalleled track record of success. Over two-thirds of the clients who retained Cayenne to develop a business plan and supporting materials, and who subsequently made a genuine effort to raise capital (or effect an M&A transaction), succeeded in doing so.
To learn more, please visit the company’s website at http://www.caycon.com