Most business leaders are “value creators” who seek to uncover opportunities in the risks they face. Sixty-two percent of the nearly 4,000 respondents to PwC’s 2023 Global Risk Survey fall into this category, led by those in retail (72%), business services (70%), and energy (70%).
On the other side of the spectrum are “value protectors,” whose north star is mitigating and minimizing risks. Respondents in government and public services (55%), transport and logistics (50%), and pharmaceuticals and life sciences (47%) were most likely to fit this description.
Both approaches have benefits. In fact, they’re complementary, a natural outcome of the fact that all enterprises face risks as they strive to maximize the opportunities in front of them (and over the horizon).
“For better or worse, anticipating, mitigating, and ultimately minimizing risk is a mission-critical function for every business leader,” says Karim Allana, founder, president and CEO of California-based engineering firm Allana Buick & Bers (ABB).
With more than 20 offices in the U.S. and Mexico, hundreds of employees, and countless clients and vendors, ABB company must navigate a dizzying set of interlocking, ever-changing risks, Allana says.
Whether it’s a multinational engineering firm, a family-owned manufacturing concern, or something else entirely, you owe it to your own business — and all whose livelihoods depend on it — to get a grip on the various types of risk it faces. Here’s what to watch for.
- Compliance Risk
All businesses must abide by relevant laws and regulations in the jurisdictions where they do business. Enterprises in more heavily regulated industries, such as finance and healthcare, typically face higher compliance burdens and heavier penalties for noncompliance — up to and including criminal exposure for individuals involved in egregious violations.
How to Manage It:
“Follow the law” might sound like trite, unhelpful advice given the complexities involved in any compliance regime, but it’s a good start, Allana says. It’s possible to invest in more efficient and effective compliance processes without cutting corners, he adds.
- Financial Risk
Some describe “financial risk” as any type of risk that has the potential to harm an enterprise’s bottom line. However, this is an overly broad frame that could encompass just about any type of risk, including those described elsewhere in this article. So it may be more helpful to think of financial risks as those directly relating to the management of your company’s finances and obligations, Allana says.
How to Manage It:
Managing financial risk means keeping everything aboveboard, financially speaking, and being careful with your company’s capital. It includes but isn’t limited to following generally accepted accounting principles, managing company and counterparty debt appropriately, and (for businesses selling internationally) hedging currency risk.
- Reputational Risk
This is another broad category of risk that often flows out of other types of risk. Its effects can be difficult to discern at first and may build on themselves. Their full extent may not be obvious until it’s too late.
“Reputational risk can affect a company’s relationships with its customers, investors, employees, and partners and can lead to decreased sales, difficulty retaining talent, and loss of market share,” says Dina Gerdeman, American Express Business Class contributor.
How to Manage It:
Prevention is the best defense against reputational risk. Monitor your “mentions” on company review sites like Glassdoor, a wide variety of social media platforms (not just LinkedIn), and in digital news media.
If this feels like too much for you to handle, retain an outside public relations firm for assistance. And if and when an acute risk threatens your company’s reputation, such as an event that injures or sickens your customers or members of the public, hire a crisis communications consultant.
- Strategic Risk
Also known as “future risk,” strategic risk can describe any exposure to uncertainty, which is of course inherent in running a business. Major subtypes of strategic risk include product risk (the risk that a competitor’s product will outcompete yours in the marketplace), technology risk (the risk of more fundamental disruption due to technological advancements), and macroeconomic risk (the risk of being caught off-guard by business cycle shifts).
How to Manage It:
It’s impossible to avoid strategic risk entirely, but you can minimize it through holistic, long-range business planning that accounts for a vast range of contingencies, including those deemed unlikely to occur. Remember, in the fall of 2019, few anticipated the advent of a world-changing pandemic within the year.
- Operational Risk
Operational risk covers the various risks — anticipated or otherwise — that create short-term business disruptions, leading to more significant financial, reputational, and legal ramifications down the road. They include but are not limited to accounts receivable issues, a pattern of negative customer feedback (or an “acute” event like a viral social media post), weather-related disruptions, and much more.
“Operational risk management involves identifying, assessing and mitigating these risks to reduce the likelihood and impact of potential losses,” says Cole Stryker, editorial lead for AI models at IBM.
How to Manage It:
As with strategic risk mitigation, careful planning is important. Specifically, game out contingencies for every operational risk you can dream up and ensure you have a business continuity plan that is ready to deploy as soon as the need arises.
- Legal Risk
Legal business risks encompass threats that may expose your business (or its shareholders, employees, and other stakeholders) to lawsuits or criminal proceedings.
Broadly speaking, legal risks include contract disputes with customers and vendors, potentially illegal or tortious activity by employees or officers, company liability for customer injuries, and issues related to labor or regulatory relations. Some risks can be categorized as legal and compliance-related, but the distinction is comparatively less important than mitigating the damage in the first place.
How to Manage It:
Managing legal risk requires a multifaceted approach, says Jeffrey Wolff, risk management expert with Reveal.
Leaders should prioritize information governance to reduce legal exposure, monitor cyber vulnerabilities and quickly identify intrusions, regularly review and amend contracts, make contingency plans for inevitable legal disputes, and use technology to manage risk and speed time to resolution.
On this last point, “technology lets corporate legal teams detect and manage risks quickly and efficiently, preventing their organizations from suffering greater losses than necessary and showing regulators and stakeholders alike that they’re compliant and responsible,” Wolff says.
It’s a Risky World Out There
If you can understand and master these six forms of business risk, you’ll be better prepared than before to guide your enterprise into the future. Unfortunately, you still won’t have all the answers.
It’s not just that there are other forms of risk not mentioned here. Seasoned executives like Allana could tell you all about those, and perhaps you’ve encountered a few yourself. The crux of the matter is that while the various situational risks businesses face might “rhyme,” and thus open themselves to some amount of categorization, no two incidences are exactly alike.
The supply chain challenges you’re facing today might bear some resemblance to the ordeal your competitor went through last year, but it’s just different enough that applying the exact same lessons your competitor learned — if they’d share, that is — might lead to more problems than it solves.
By all means, learn as much as you can from those around you and those who came before. As long as you understand that in a world filled with just-so risks, you’ll need to make your own luck in the end.
