Five Steps to Managing Risks
Risks to your business can arise for many reasons – interest rate or price increases, your competitors’ activities, injuries through hazards in the workplace, skilled staff leaving or natural disasters such as bushfires. Managing those risks is an important part of running your business.
Risk management is a systematic process of making a realistic evaluation of the true level of risks to your business. Before risks can be properly managed they need to be identified – you can begin with these questions:
- What can go wrong?
- What can we do to prevent it?
- What do we do if it happens?
A good plan is to develop a risk register to document each potential problem, its level of seriousness, what is required to fix it and who will fix the problem.
It’s generally not possible to eliminate all risk unless you choose to avoid the activity completely. So you need to ensure the remaining risk is managed according to recognised methods.
Risk management is a series of ‘well-defined steps which, taken in sequence, support better decision making by contributing a greater insight into risks and their impacts’. (Australian Standard AS/NZS 4360 Risk Management)
Step 1:Identify all hazards – these may be financial, physical, staffing, environmental, legal and so on. (e.g. possible theft of cash, floors at entrance become slippery when wet, critical skills held by only one staff member, waste pollution, ineffective contracts).
Step 2: Assess and prioritise the risks these hazards create, deal with highest priority risk first (e.g. event may be very likely to occur but have a trivial consequence through to rarely occur but have an intolerable consequence. Small equipment being damaged might be in the first category while serious injury to staff or clients would be in the second category).
Step 3: Decide on measures to control the risks (e.g. eliminate the risk, substitute a venue, change the way it is done, use personal protective equipment)
The Hierarchy of Control model is commonly used for this stage of the risk management process.
- Elimination – If you eliminate a hazard you completely remove the associated risk.
- Substitution – If the hazard can’t be eliminated, minimise the risks by substituting process that has less potential to cause injury. e.g. less toxic cleaning chemicals.
- Engineering – Build some protection (e.g. a barrier)
- Administration – You may be able to reduce risk by upgrading training, changing administrative actions e.g. putting up signs).
- Personal protective equipment – When you can’t reduce the risk of injury in any other personal protective equipment (such as gloves or goggles) as a last resort. This is the least effective method of control.
Step 4: Implement appropriate control measures.
Ensure the changes haven’t introduced new hazards.
Step 5: Monitor the control measures and review the process.
For many activities, the identification of risks could be considered under the headings of ‘people’, ‘equipment’ and ‘environment’. Examples of risks associated with ‘people’ could be the lack of necessary skills or inadequate fitness. Risks associated with ‘equipment’ could include inadequate clothing for the season, and insufficient or incorrect equipment. Risks associated with ‘environment’ could include adverse or unseasonal weather, sudden changes in river levels or high winds.
For the activity being undertaken and the group involved, foreseeable risks should be noted and strategies should be developed to avoid or minimise these risks. The strategies should be included in the activity plan.
Emergency Management Plan
Your Emergency Management Plan may need to detail the action you expect your staff and clients to take in the event of some of these hazardous events occurring. Examples may be internal fire, external (bushfire), loss of power or water, client missing, accident involving staff or client.
Insurance is away of transferring the risk (or at least some of it) away from your business to another – the insurance company. Insurance is not a substitute for risk management, it is another tool. Insurance companies are going to expect you to have taken reasonable steps to avoid a ‘risky’ event – good work practices, proper maintenance, staff training, etc.
You should consult your insurance broker about the types of insurance available and the cost benefit to you. Insuring against your building burning down is probably good sense. Is insurance for broken windows cost effective if the excess is nearly the cost of a broken window?