Are you the one with the big sign? You know, the one that says 'The Buck Stops Here'. Or does the buck just drop in on you because you provide the assurance information? With the growth in the public accountability of senior managers, perhaps it is time to take a closer look at this buck and where it can come from.
European ResearchRecent research on European mid-sized companies shows that 4 out of 10 have no formal policy for risk, although those in Belgium, Germany and the UK claim to be the best prepared. The survey, commissioned by Marsh, shows that mid-sized firms' top five concerns are strategic and operational in nature – increased competition, losing key staff to competitors, changes in customer demand, wrong strategy due to lack of market data and staff absenteeism. There were fewer concerns about hazard and financial risks, with pollution, product liability, employee injury, non-compliance with tax laws and loss of suppliers due to debt being considered the least important.
Some interesting differences in the attitude to risk by country emerged from the research.
Of the entire UK business population of 3.7m enterprises, only 25,000 were medium sized (50 to 249 employees) and less than 7,000 were large (250 or more employees).
The Companies House definition of a small company is one that meets at least two of the following conditions.
Medium sized companies must meet at least two of the following conditions.
The EC definition has the same employee number thresholds, but higher financial thresholds.
SME special interest sites
bizplus.ie
clearlybusiness.com
office.com
bdosx.ie/startbusindex.html
startups.co.uk/
better-business.co.uk
businesszone.co.uk
businesslink.org
scottish-enterprise.com
sbgateway.com
bigwales.com
hie.co.uk
investni.com britishchambers.org.uk
fsb.org.uk
ukonline.gov.uk
ukonlineforbusiness.gov.uk
sbs.gov.uk/statistics
Unless you work for one of those rare companies that is self sufficient, your business will depend on the goods and services produced by others. What kind of companies are they? How big are they?
You rely on these other businesses to provide you with the resources and expertise you need to enable you to thrive in your business. Their ability to manage their risks may affect your contingency plans and the level of assurance you can give regarding your own business risks. The better they manage their risks the less chance there is of a herd of bucks rushing headlong to arrive on your desk.
So what does size have to do with it? Everything, including the level of confidence that you can place in any risk assessment information supplied to you.
Introducing SMEs
The name says it all – Small to Medium Enterprises. You may think that such businesses have nothing to do with you. But are you sure?
SMEs may be small but there are a lot of them – 3.7m in the UK alone. In fact, SMEs are the fastest growing sector of most economies in the world. In the UK they:
Somewhere along the line you are probably working with an SME.
This can be excellent news. According to the Confederation of British Industry (CBI), SMEs are hot and sexy, frequently on the cutting edge of technology and able to react quickly to market trends and new opportunities.
So what is life like in an SME? Management in SMEs tends to be concentrated in a small team, sometimes an individual manager – 1.1m UK SMEs do not have any employees. The team does everything: running the business; marketing; financing; compliance; troubleshooting; hiring and firing and every other thing that needs to be done.
For many SMEs, tasks like long term planning and risk management take second place to day to day business needs and the copious amount of government regulation. They can even get squeezed out altogether.
However, changing regulations, global markets, higher customer expectations and the pace of technological innovation mean that the SME sector now requires greater management expertise than ever before. Failure to properly address risks can be devastating and rapid for unprepared small companies. From this you might expect that their required skill set would include good risk management practices - so how are they doing?
Ready or not?
Seemingly the majority of the SMEs, including those with over 50 employees, have no formal risk mitigation plans and are lagging behind larger organisations in their efforts to develop formal procedures for identifying and mitigating high impact risks. Therefore, there is a good chance that your SME business partners have not identified their high impact risks. This failure to manage their risks could very well end up in your lap. What would happen if your SME partner went out of business, or, in the case of single consultants and experts, simply did not turn up? Are you ready for that?
There is no single source for SME statistics, and those that do exist tend to be about 18 months old, because of the difficulty of collecting and collating all the information. This makes it difficult to get a true picture – it could be a lot better or a lot worse – or just very different. However, one way of getting a better grasp of what is going on is to look at the SME special interest sites on the web, the Government advisory services, national and regional business links, Chambers of Commerce and specialist business papers.
You also find help with venture capital, credit, financial, pension, and human resource risk. But if you are looking for specific SME advice on strategic, business and operational risk, there is not much around. All that I could find was IT Risks in the form of BS7799, Data Protection and an article on Turnbull on the Irish Business Plus web site.
The good news is that, in the Health and Safety arena, the developmental process is well along the learning curve, with SMEs showing increasing levels of awareness and expertise in risk assessment and management, reflected in emerging good practice and effective risk management systems.
On the face of it, it may be years before business, strategic and operational risk form part of SMEs' formal plans. This means that you dare not make assumptions about your SME partners. You will just have to ask them what do they do.
Catching up
On the assumption that asking questions of your SME partners causes them to do something, what is it likely to be? The answer is it's anyone's guess.
The figures show that most SMEs suffer from the dual constraints of budget and time. Not surprisingly, as a rule of thumb, the smaller the SME, the less time and money available for training.
For example, a recent study of Irish SMEs showed that almost half had no formal budget for management development, and that training was mostly informal. If the health and safety experience is any guide, the usual practice is to pick things up from books, articles, or from someone they know.
SMEs can also find it difficult to find the right kind of training – training that is accessible, affordable, relevant to their circumstances, and that can be tailored to people with little time to spare.
A helping hand
Although it is tempting to regulate risk management, the CBI warn that SMEs are in danger of floundering under the weight of compliance work they need to do for current government legislation. Any additional burden could well destroy the very innovation and flexibility that can make SMEs such a vital component of the economy.
As an alternative, it might be best to encourage a philosophy of self regulation and goal setting, in order to identify and manage high impact risks. It is essential that SMEs are convinced of the business benefits of good risk management. On the bright side, risk managers have fought that battle before.
But remember, small is different. SMEs are likely to have significant resource constraints, both financial and human. They are unlikely to be able to spend much time on any risk management process or on follow up actions.
So what can you do for your SME business partners? You can start by improving your relationship with them. Strategies include:
There are two very important points to remember. Make it easy, painless and fast; and keep it simple.
Too much trouble?
If you lack the resources to actively help, what can you do about getting assurance that your SMEs are managing risk effectively or even adequately? How can you gauge the knock on effect? Just ask:
The final question is one you need to ask yourself. 'Is it likely that my SME is keeping their bucks at bay?' Or alternatively, 'How lucky do I feel today?'
Rosie Harrison is a risk and security manager and a practising executive coach and mentor, E-mail: roharuk@yahoo.co.uk
