Risk, risk, risk, risk, it's the current hot topic on the cocktail circuit. Well, perhaps not, but it should be. Whether it's the global meltdown of 2008, the failure of a local business or a bad outcome in your personal or professional life, it is mostly likely that the inability or unwillingness to properly appreciate the risk inherent in a course of conduct, investment or enterprise has resulted in a party being exposed to the chance of significant injury or loss. Couple that exposure to risk with a failure to properly identify the magnitude of a potential loss or to take action to mitigate such loss, and you have the recipe for unanticipated outcomes of unanticipated severity.

Most recently, the near collapse of American International Group ("AIG") illustrates how an oversized bet by a small group can tank a global behemoth. In an inaugural lecture on a course covering the recent financial crisis, Jeremy Siegel, a professor of finance at Wharton, noted that approximately 95% of AIG's business units were profitable when the company collapsed. This stable and thriving business was, he noted, undermined by a decision made by AIG's new products division to insure mortgage-backed securities. The bet made on that new product, by a division that employed approximately 80 of AIG's 125,000 employees, went so spectacularly wrong that AIG required a bailout, equivalent in amount to 2-3 times the 2007 GDP of Costa Rica, to survive.

If AIG's story is at one end of the scale, you likely can recite your own example of more modest businesses that failed because they did not full appreciate or address the risks they faced. After considering the story of AIG and your own local experiences, it probably doesn't take much convincing to have you agree that a lack of appreciation of risk, and the failure to take steps to mitigate risk, play material roles in many business failures.

Depending on the nature of your business, stage of development and the industry in which you compete, the exercise of identifying and managing risk varies in complexity. But like other aspects of your business (e.g. growing revenue), dealing with risk is easier if you approach it in a systematic and thoughtful fashion. Here are a few suggestions.

The first step in identifying risk is to have a clear understanding of your business – its value proposition, business goals and strategies. Once you know where you want to go and have a deep appreciation of the steps you need to advance your business, you can start to identify what might go wrong. The obstacles to success will likely be varied including overcoming technical challenges in advancing technology, competition and even your own internal structures.

Once you've gotten through the exercise of laying out your roadmap for success and the most visible obstacles, you can then undertake the more detailed work that is required to have a healthy appreciation of the risks you face. A good next step might be to properly identify your assets and determine their value to your organization (both as an asset in your business and for alternative purposes) and consider the steps that are required to preserve and maintain ownership and control over these assets. For example:

  • All patents should be properly filed, prosecuted and maintained. Aside from providing benefits to you from the product development and value enhancement perspective, and acting as a deterrent to competitors, sufficiently broad patent coverage may also provide you with opportunities to license or sell a patent to a party who has a use for the technology outside of an area that you to exploit;
  • Intellectual property which is not patented but otherwise protected by copyright ortrade secret law, should be protected by appropriate agreements executed by all persons who contributed to the creation of that intellectual property such that the enterprise has clear ownership and unfettered discretion to deal with that intellectual property; and
  • Other assets, such as leases or long-term supply agreements, need to have keyobligations identified and systems put in place to ensure those obligations are met (one of the most extreme examples that I've come across of failing to take these simple precautions involved a manufacturer who did not renew a lease within the permitted time period and found themselves faced with a landlord asking them, no doubt in a very polite manner, to remove their plant from the property).

After identifying your assets, the next step should come as no surprise – identify your liabilities. You will most likely know what your monthly obligations are to employees, landlords and suppliers. Now go the next step and understand what your obligations will be if you wish to terminate any of these relationships. Having an understanding of your obligations to terminated employees or the exposure you might face in seeking to end a contract is important information for identifying what flexibility you might have in making changes to your business.

A final suggestion is to consider the use of a tool imposed on public companies by regulators. Public companies are required to undertake a systematic assessment of risk. This assessment is in the form of a management discussion and analysis ("MD&A") of the financial information published annually and quarterly by each public company. Private companies may find benefits in utilizing the MD&A disclosure form published by North American securities regulators as a roadmap for reviewing their risks. Please click here to access the Canadian form of MD&A. Taking a few examples from this form will illustrate its usefulness as a tool to guide the review.

While MD&A is intended to help current and prospective investors interpret a company's financial statements, properly prepared it also serves to reveal information which is not reflected in those statements. This information includes contingent liabilities, off-balance sheet financing transactions and other contractual obligations, trends and risks that have affected the business and are reasonably expected to affect it in the future, and the quality and potential variability of earnings and cash flow. It is this narrative assessment of the matters not fully reflected in financial statements that provides an opportunity to systematically review risks faced by the business. Some of the areas touched upon by MD&A include the following:

  • A discussion of the specific economic factors currently affecting or expected to affectthe company's industry and performance, with particular references to:
    • demand for products and services,
    • selling prices or other revenue drivers,
    • changes in borrowing costs, exchange rates and commodity prices, and
    • strategies that might be implemented to deal with these changes;
  • An analysis of the company's ability to generate sufficient cash and its access to the financial resources needed to meet operating needs, with particular reference to:
    • identifying the cash necessary to fund current operations and meet debt obligations,
    • commitments or planned expenditures necessary to maintain growth and performance targets,
    • future cash needs associated with known trends and uncertainties,
    • any adverse movements in working capital accounts such as accounts
    • receivable, inventory and accounts payable, and
    • plans that one has to meet any expected working capital deficiencies; and
  • An assessment of the risks involved with holding certain financial instruments (if you had the misfortune of investing any significant cash reserves in asset-backed commercial paper, and then found those reserves unavailable to you when needed because the market for this security had been frozen in Canada, you - like a local mining company that suddenly found it had no access to the cash it had raised in the public markets to fund mine development – will appreciate the importance of estimating risks associated with financial instruments).  

As recent events have shown, even the most sophisticated of parties can get risk identification and analysis wrong. But by systematically analyzing your business to identify risks, at least you have a chance of taking steps to mitigate key risks and either avoid or lessen the consequences of a bet gone bad.