Risk management for financial performance

Business risk management involves closely monitoring potential risks. Anything that could negatively impact your business can be a potential risk, and most risks will come with financial implications. Risk management is about identifying these issues and developing strategies to reduce or address them. You can also use scenario planning to think ahead and develop responses to situations your business may face.

On this page

    From a financial perspective, the best way to monitor risks and the ‘triggers’ that cause them is to use financial ratio analysis including trend analysis and industry benchmarking based on data from your financial statements.

    For example, if you discover that your sales have dropped, you should analyse why this happened by reviewing your financial statements and identifying any trends, as well as comparing your figures against benchmarks. This will help you address the issue and manage any associated risks.

    Calculate your business’s financial ratios regularly. In challenging times, such as when you’re working in a difficult economic climate or have uncertainty with your cash flow, you may choose to calculate your ratios on a weekly basis.

    Use risk management to monitor performance

    Business risk management can help you:

    • take advantage of risks that are worth taking. Compare the level of risk against potential benefits to determine if it’s one worth taking
    • prevent unacceptable risks being taken (where the level of risk outweighs the potential benefits)
    • turn risks into business opportunities
    • monitor and drive business performance by being as prepared as possible for external financial, operational and reputational risks that are outside of your control.

    Risk management plans

    Developing a risk management plan is an essential part of running a successful business. A detailed risk management plan will:

    • identify potential risks and what could cause them to occur (risk triggers)
    • assess the impact of potential risks
    • identify what you can do to remove or reduce the impact of the risk (control measures).

    You won’t be able to remove the impact of all risks, even with strong control measures in place. A good risk management plan should help you develop strategies to manage unavoidable risks. Look to develop key performance indicators (KPIs) that you can use to track your identified risk triggers. This will allow you to quickly address any future financial impacts.

    It is important to remember that planning for risks is about putting control measures in place before the risks occur.

    Your risk management plan should include:

    • a list of potential risks
    • a list of potential triggers that will cause a risk
    • risk ratings based on the likelihood of the risk occurring and its impact on your business
    • a planned mitigation strategy that considers
      • controls for before the risk
      • treatments for after the risk
    • time frames for implementing the mitigating controls
    • required resources
    • who is responsible for ensuring the strategy is implemented.

    Developing a risk management plan

    Follow these steps to develop a risk management plan for your business.

    Examples have been included to demonstrate the impact of certain risks.

    You can carry out a risk assessment of your business by looking at your financial and business operations. This should be done at least once a year. Work with your staff and ask yourself these questions:

    • What risk could potentially cause an impact to your business?
    • How serious would that impact be?
    • What is the likelihood of this occurring?
    • When is this likely to happen?
    • How can this risk be managed?

    All risks will have a financial impact on your business. To help reduce the financial impact, set up ways to track your risk triggers and pick up any trends or changes. For example:

    • Your gross profit falls by 6%
      • Controls: monitor your monthly gross profit trends closely to spot changes quickly.
      • Treatment: review of material sources; review your staff productivity,
    • Your overheads increase by 5%
      • Controls: monitor your monthly overheads-to-revenue trends closely to spot changes quickly.
      • Treatment: review and look for ways to reduce your significant expenses.
    • Your accounts receivable days go above 45 days
      • Controls: monitor your accounts-receivable days closely; look for ways to improve your invoicing (both the information you include on each invoice and the systems you use to issue and monitor invoices).
      • Treatment: put your debt collection strategy into action.

    Make sure you include:

    • internal issues such as staff, skills and your premises
    • external factors such as customer demand, trends in the market, general economic conditions and competition.

    It can also be useful to categorise risks as reputational, operational or financial.

    Work out which risks will have a greater impact on your business's performance than others.

    Separate minor risks that will have a small impact from major risks that will require immediate action. For example:

    • a single customer defaulting on a payment is a minor risk
    • a major supply chain disruption is a major risk.

    Analysing risks involves deciding on the relationship between the likelihood and impacts of the risks you have identified.

    Consider the likelihood and impact of each risk, and how it will impact your business performance. This will allow you to evaluate and prioritise the resources you are prepared to invest to treat these risks.

    At the end of this step, you should have a prioritised list of risks that require further action.

    You will need to work out which risks you consider acceptable to be left untreated and which risks need to be mitigated. Consider the ‘4 Ts’—treat, terminate, transfer or tolerate—when deciding how you will act on risks.

    The amount of risk your business is willing to accept is called your risk appetite – this is determined by how comfortable you are with the risks that affect your business.

    Once you've identified the risks you consider to be outside your risk appetite (the ones you’re not comfortable to accept), you will need to consider strategies for mitigating those risks.

    Mitigation can include everything from controls to prevent risks from occurring to treatment if the risk is unavoidable. Your mitigation plan should consider the severity of the impact. For example, if the risk is a natural disaster, most of the risk management will be in treating the outcome of the disaster.

    Having a planned response for each potential risk will help you to minimise the impact if risks occur. Identify when the response action should take place and a target resolution date.

    Clearly set out the roles and responsibilities of each staff member for each risk. Everyone should understand what they need to do to help mitigate the risk. Risks will often affect the whole of your business, so make sure you include all staff, or staff from all areas across your business.

    Regularly review your risk management plan as part of your ongoing risk assessment process. If a risk happens, review how your planning worked or didn’t work. Identify what can be improved and incorporate these into your business procedures and future risk planning.

    Establishing processes within your business to reduce and avoid risk can help to achieve better transparency, communication and cohesion for everyone involved. Ensure that your risk management plan covers expected behaviours, activities and any standards or codes of conduct required.

    Scenario planning

    Scenario planning is about thinking ahead and developing responses for what might happen in the future. The aim of scenario planning is to identify situations that you’re likely to face, based on both your decision making (things you can control) and external factors (things you can’t).

    It allows you to visualise a range of possible scenarios and build your awareness around what could happen. This can help you to develop strategies for how your business will pivot, survive and adapt when experiencing risk.

    Using scenario planning to benefit your business

    Scenario planning can help your business:

    • develop mitigation strategies or responses for risks identified in your risk assessment or plan
    • identify potential threats and positive opportunities for your business
    • deal with uncertainty and develop a framework to follow.

    Scenario planning can help your business predict potential situations and put contingency plans in place. For example, given the impact of recent health emergencies/pandemics on many businesses, you may choose to plan for the possibility of similar situations, and how health management measures and border closures have the potential to affect your trading and sales.

    Don’t limit yourself to only predicting worst-case scenarios. Think about the impacts if your business suddenly has a huge increase in demand, or if you’re presented with an opportunity for growth.

    To use scenario planning as a successful business tool, think about the following:

    • Don’t overwhelm yourself: There are an unlimited number of scenarios you could run for every risk. Focus on the most probable scenarios which will cause the largest impact or opportunity for your business, rather than trying to plan for everything
    • Think about internal and external situations to scenario plan: Scenario planning is particularly valuable for external situations where you’re unlikely to have significant control over an outcome. A PESTEL analysis can help you determine how political, economic, social, technological, environmental and legal factors can impact your business or industry.
    • Don’t limit your risk assessment plan: Don’t build your business strategy or risk assessment process around only 1 scenario. Scenario planning should give you a greater awareness of the range of possibilities that your business may face and allow you to make strong decisions to protect you from all possible threats.
    • Use multiple perspectives: If you have a team or staff, take advantage of their unique viewpoints. The way they view your business operations and procedures may provide you with valuable insight. Forecast the effect of each scenario on your business and use this as a guide for shaping your future business strategy.

    Also consider...