Last week's terrorism scare has thrown a spotlight on the crucial role of risk management for companies in a turbulent business environment.
Taking risks is part of the cost of doing business. But a company can pay dearly for ignoring the need to identify and plan for those risks. This is especially true for small businesses, which often operate on the edge.
For executives dragging their feet on taking a companywide approach to risk management, last week's events may add a needed sense of urgency, experts say.
"The job of management is to think of the unthinkable and plan accordingly," said James Lam, president of risk management consulting firm James Lam & Associates in Boston. The alleged terrorist plot in Britain "is just another example that risk can manifest itself at any time and in any form."
Figuring out the cost and effect of extraordinary and routine risks is the core of the growing business practice known as enterprise risk management.
The concept has special significance for small companies. Though they are typically unable to afford a full-time risk management officer, they face many of the same hazards as does big business.
And because they often rely on a limited number of products or customers, they have limited ability to balance risk in one area of their business against another area, Lam said.
At the same time, many of their big-company clients are increasingly pressuring them to identify and plan for risks that might affect clients. Those could include a terrorist attack, a computer system crash or the loss of a key employee.
Smart companies of all sizes are learning that they can benefit by managing risks in an active, organized manner.
"Good risk management is good business management," said Lam, who is the author of "Enterprise Risk Management: From Incentives to Controls," published in 2003 by John Wiley & Sons Inc.
Companies are increasingly recognizing that effective risk management can help them protect and increase their profit. Of the 271 companies surveyed in 2004 by the Conference Board, 90% said they were developing or planning to develop an enterprise risk management program.
But most companies are still in the early stages of the process, according to the nonprofit business research group. Only 11% of the firms surveyed, which included major corporations such as BP, Standard & Poor's and Bristol-Myers Squibb Co., said they had fully implemented risk management companywide.
