In considering the critical decisions we discussed in Part 1, it is advisable to do so using a proper risk management process. This is an ideal opportunity to implement such a process if you do not have one already.
When facing enormous challenges, complexity and constant changes, the basic steps in the risk management process will help to slow things down and provide the clarity you need to react appropriately.
Most importantly, it will remove the noise and help you and your organisation avoid going into “fight or flight” mode.
Analyse your risks by setting them in the risk context, considering three areas: the external environment (high uncertainty, low control), the transactional environment (moderate certainty and control) and the internal environment (high certainty and control).
Analysing risks in this context assists greatly to distinguish between “risk” and “uncertainty” and reduces personal risk perception “cognitive mistakes”, such as relying too much on the past as an indicator of the future.
- In the external environment, the President, as part of the governments response to mitigate the potential devastating impacts of the virus, has provided the key response steps to contain the spread of the virus and to help those infected. Review each step and evaluate its impact on your business.
- At a transactional level, the World Health Organisation (WHO) and the South African National Institute for Communicable Diseases (NICD) have also provided valuable information in terms of how to deal with the virus from a prevention, containment or treatment point of view. These guidelines will inform your decisions regarding employees and other stakeholders.
- Internally, you have full control and can make decisions regarding how to deal with employees, customers and other key stakeholders in how you respond to the risks posed by the virus.
Make a list of all the risks (based on risk context) that may result from the virus. These would be all the “uncertain future events” that may impact your business objectives. Some of these may be a direct result of factors beyond your control, such as reduced patronage if you are a restaurant owner.
Analyse each risk identified in terms of causes, consequences and impacts on your business, both quantitative (e.g. financial) and qualitative (e.g. reputation, brand, emotional strain on employees).
It is critical to understand clearly how much staying power you have (in the form of reserves to sustain losses for an extended period). Therefore, evaluate each risk in terms of your business’ risk appetite and risk bearing capacity.
This part of the process must also be used to prioritise risks in terms of which will receive the most attention and which risks will be dealt with in future, as more information unfolds.
For example, there could be a risk that your employees become infected and will need time off work to recover. Evaluate the impact on your business if you face 20%, 30% …80% of your staff infected at the same time.
Risk treatments are simply to avoid the risk (e.g. staff working from home), treat the risk (e.g. providing hand sanitizes, masks and other safety gear to protect employees as well as customers) or transfer the risk (e.g. through insurance, although not all policies cater for contagious diseases).
This step is more critical given the volatility and speed at which the situation is changing on a day-to-day basis. Monitor actions that you have decided on.
Hold daily sessions with your team to evaluate what works and what does not work and adapt decisions and plans accordingly.
As a small business, this process may seem too much work or even difficult to implement. T
he inclination is also to implement many actions (which may make you feel better), but many may not add any value and send you chasing a “red herring”. A “gut feel” approach to managing risks may be faster but will not help you in identifying blind spots. You could end up spending more money on mitigating actions that may not be necessary, had you evaluated the probability and impact of the risk.
Lastly, this article is by no means an exhaustive analysis of what must be done to mitigate the impacts of this risk. It is mainly aimed at using the risk management process to help you evaluate and deal with your own individual circumstances.
Think outside the box!