All businesses involve risk, but there are steps you can take to minimise problems. Nick Sterling explains how companies should embrace risk management.

Risk management should be seen as a good thing. It is a live business tool that should not just be taken out of a box when a decision needs to be made - it should be used all the time as part of the business plan.

Many companies fear the risk management process - this is often because they start the procedure too late, rather than having it as an integral part of the business culture. Starting the process early lets a company plan for risks and can eliminate some risks completely.

Preparing a plan

There is no standard model for risk management, every firm has different procedures. It is more a philosophy or a culture. It is about being honest in assessing your firm's abilities and challenging yourself, your people and business constantly.

Operationally, the process should start before a company bids for a contract by asking open questions and not closed ones. An obvious question would be: has the firm got the people who can do this job? That is a closed question resulting in a yes or no answer.

A better question would be: how do I resource this contract? This is an open question that requires a more thorough analysis and provokes other questions, such as whether you need to bring in resources, if such resources are available and how much they would cost.

Risk management can also help with a company's overall business plan. It is easy to say you want to be a £30 million turnover business within three years; the challenge is planning to achieve that and analysing the risks involved so that they can be overcome.

The risk assessment process here would look at everything from geographical location to types of client and the market sector in which you want to work. These would lead to other questions. Say, for example, that you decide you want all your work to be in London. How can you secure sufficient workload? What are the effects on the business of working in one geographical area? What is the competition in London? And so on.

Answering these questions honestly will let you focus on the specific and potential risks that you could face. You can than analyse those risks and either eliminate them or decide not to proceed. The result will be that you will be in the desired market, working where you want and for clients who are more likely to work with you than against you. This creates a greater likelihood of sustaining a viable business.

Choosing the right client

Regarding the type of client you want to work for, these days it is relatively easy to do financial background checks to see if a firm is a good payer, solvent and creditworthy. But the risk assessment should go deeper than that. Talk with other firms that have worked for the client. Determine if they are the type of firm that will always be haggling you down on the quotes, are quick to hit you for costs on delays and so on. What are the implications to your business if they are late payers? Taking all of this into account, is it the right decision to work for such a firm?

In all contracts problems will arise; what is important is how you deal with these. Some clients will put a wall up and say it is up to you. Others will work with you, have a dialogue and try to solve the problem together. They are the better clients to work for.

This is why doing a risk assessment before the contract is signed is beneficial. If the potential client is not willing to sit down at this point and go through the risks that might come up and plan with you how to deal with them, it may be a better option to walk away.

For example, say you are installing a new bathroom and discover asbestos panels part-way through the installation. Removing these will cost time and money in identifying the type of asbestos and removing it safely. If you are on a fixed price and duration contract this could cost you money.

What are the implications to your business of the cost of delays and carrying out this work without being paid? If the discovery of asbestos was in the risk management plan at the start, you would have an agreement with the client about what happens should this occur.

Covering the basics

A risk management assessment should also take in some of the nitty-gritty elements of your own business, such as making sure daily back-ups are taken of your computer systems. Where should you keep those back-ups? What is your recovery plan should a disaster happen?

It should also look at your supply chain. Do you rely on one supplier? There is nothing wrong with that if you have built up a good relationship with them, but do you have a plan in place should something happen to that supplier?

A good discipline is to create a risk register, both within the terms of a particular contract and as part of your general business operations. This needs some lateral thinking. It should list every possible problem that could arise and have actions detailing what you would do if those did occur.

Each element should be marked as a high, medium or low risk level and should be regularly reviewed, with greater focus on the high-risk elements. The costs associated with the risks should be included. In terms of a contract, this information should be shared with your clients.

Risk management is your most valuable tool. If used properly and regularly, it will significantly lower the risks to your business, making it stronger, more profitable and ultimately more sustainable. And that has to be good!

Risk management in practice

A recent scheme at St Catherine’s Hospital, Doncaster is a good example of how risk management can benefit a contract. The hospital wanted to replace its central boiler, which had been in use for nearly 40 years.

In a £500 000 contract, m&e contractor Powerminster had the job of replacing this with seven boilers spread around the site. In planning the work with the NHS Trust, Powerminster produced a risk management assessment. This came into play right at the start when residual asbestos had to be removed in some areas.

“There were some basic things in this,” said Paul Barratt, head of estates at St Catherine’s, “such as carrying out controlled shutdown work out-of-hours.” Although a hospital works around the clock, some areas such as kitchens and laundries have periods when they are closed; it made sense to do work during those periods so they would not be denied services.

The risk assessment also covered the physical installation of the boilers. For example, a number of 1 MW boilers were to be installed in a basement plantroom and the risk plan looked at what could go wrong and how to prevent problems occurring. This resulted in measures such as arranging access, putting barriers in place to keep the public away, checking that the crane was suitable and making sure that the boilers would fit.

Such measures became vital with the replacement of a 660 kW steam generator in the laundry. Measurements taken showed that even when stripped down the boiler wouldn’t fit through the available gap. While this could have been a serious problem, as it was found during risk assessment it meant that the operation could be planned in advance. The solution was to temporarily remove some of the brickwork and mount the boiler on a trolley to enable it to be positioned.

A risk assessment of ventilation in the plant areas raised the possible problem of a gas leak. Natural-gas sensors were thus installed that will automatically turn off the gas and all electrical equipment should a leak be detected. The risk plan also asked what if the sensor is faulty and turns off the gas when there isn’t a leak? To cater for this a bypass system was installed to restore the gas supply if this happened.

The net result of planning for risks meant that problems that could have arisen did not. “As a result”, said Barratt, “the project went incident-free.”

Steps to avoid risk

  • Make risk management an integral part of the business
  • Ask open questions that require analysis rather than a yes or no answer
  • Consider every aspect of a contract before signing
  • Work with potential clients to draw a risk assessment plan

  • Create a risk register of worst-case scenarios and what you would do if they happened