Risk, Part 2 — Safeguarding Your Daily Business Operations

IN A NUTSHELL: Part 2 of a 3 Part Series: Think analytically about potential weak spots in your ongoing business operations to identify potential vulnerabilities and to proactively develop contingencies. Part 1 of this series can be found here. Part 3 of this series can be found here.

Most companies rely on a complex network of interwoven systems, processes and business relationships to support their daily operations.  Whether your company is small , somewhat self-contained and relatively simple, or a large complex globally distributed manufacturing operation, you are highly reliant on a number of interlinking pieces which must mesh perfectly for your company to run continuously as designed.  No one is truly self-sufficient in today’s global economy.  Take a look at the number of different accounts in your Accounts Payable ledger if you don’t believe me.  A lot of things have to go 100% right every day for your company to run smoothly.

The economic downturn has had a devastating impact on almost every company.  Many companies are failing or have ceased to exist.  The companies which have survived have almost universally taken drastic actions to reduce costs, reduce employment levels, elminate waste and streamline their operations.  While this is undoubtedly healthy for these firms and for the economy as a whole in the long run, one unavoidable but potentially under-appreciated aspect of this LEANing out is that the risk profile of most companies has increased to some degree.  Typical cost savings strategies such as reducing inventories, lengthening preventative maintenance cycles, lowering general employment levels, reducing delivery frequencies, etc. are all smart cost saving moves, but all have the impact of  increasing the risk level of that company’s ability to execute its mission flawlessly.  Although each individual action may be negligible, if your company relies on 50 other supporting cast member companies / partners to conduct your line of business and they have all increased their likelihood of failure by 1%, your overall “rolled throughput yield likelihood of success” level has decreased by nearly 40% as a result (99%  ^ 50 = 60.5%).

It’s helpful to reassess all the cogs in all of your wheels and to think through the likelihood of a failure in any piece that could cause a business interruption.  A good brainstorm of  “What could possibly go wrong?” around the standard  “5 M’s” of an Ishikawa or Fishbone Diagram may get you started on a list of things to consider:

• Machine: Equipment breakdowns, Inability to get critical spare parts, Drifting machine performance, etc.
• Materials: Lack of supply from key suppliers, Sole source vulnerabilities, Quality issues due to material substitutions, Supplier bankruptcies, etc.
• Man: Key talent defections due to other family or economic issues, Trade secret leakage, Downsizing / job consolidation performance impact, etc.
• Methods: Shortcuts on procedures due to downsizing, Poorly documented crisis mgmt procedures, etc.
• M-vironment / Mother Nature: Interruptions in utilities, Lack of  Logistics / Freight carrier availability, Longer lead times due to capacity reductions, etc.

I don’t think you have to be overly exhaustive in this brainstorm, but you and your team should be able to come up with 30 – 50 things which are potential issues to consider.  Please do not get lulled into the trap that “that could never happen to us”.  For many companies, Fragile is the new normal.

Once you have a laundry list of potential issues, you need to screen them to determine which ones you really need to deal with and plan for.  Although rigorous, the best tool for segregating the critical issues from the less worrisome possibilities is the Failure Modes and Effects Analysis.  A detailed analysis of the use of this tool is far beyond the scope of this post, but you can find a good overview from the American Society for Quality Control.  In essence, with an FMEA you are objectively ranking three critical dimensions of each potential failure mode in your business on a scale of 1 (least risky) to 10 (most risky):

• Severity:  This issue is of only temporary or minor impact (1) ==> This issue could literally shut my business down (10)
• Occurrence:  This issue is highly unlikely (1 in 100,000 chance)  to occur (1) ==> There is a very real chance (>50%) that this could occur (1)
• Detection:  I can certainly detect this immediately if it happens and I have a plan to deal with it (1) ==> I probably will not detect this until it is too late and by the way I do not have a recovery plan (10)

I don’t think you need to be overly picky on these ratings but I would advise applying them as consistently as possible with some measure of team collaboration.  Once you have established ratings for each aspect of each potential failure, multiply them to obtain a composite Risk Prioritization Number (RPN), which will be a number between 1 and 1000.  I recommend that you and your team develop solid plans for any risks with a composite RPN over about 300 and for any issue with a Severity rating of 7 or above.  In general, you will be developing plans to reduce the likelihood of Occurrence or the ability to Detect and Deal with the Issue, as the Severity can only be reduced by redesigning your business model in most cases.  You can find a number of useful Excel templates and guidelines for conducting an FMEA at the FMEA Info Centre.

I urge you to keep this exercise in perspective.  You are assessing business continuity risks, not designing a Lunar Lander Module.  Don’t  get stuck in the weeds as you brainstorm or prioritize.  You don’t need to overdo the precision and complexity of the analysis, but I hope that you will find that open minded brainstorming, objective assessment and then a structured prioritization tool like FMEA may help you proactively implement risk mitigation plans that improve the likelihood that your business continues running “without a hitch”.  Good Luck, and please share your experiences in the comments.