Using a Risk Register to manage risks is this week's I Hate Numbers podcast

When it comes to risk management, most business owners and entrepreneurs think of insurance policies and legal contracts. While these are both important aspects of risk management, they're not the only ones. In fact, there are a number of other tools that can be used to help you identify and manage risks, both big and small.

One such tool is a risk register. Let's look at what a risk register is and how you can use it in your business.

• Firstly, a reminder of what risk is
• Secondly, the benefits of a risk register
• Thirdly, how to build a risk register
• Fourthly, quantifying risk with examples
• Lastly, how to use a risk register

Conclusion

So there you have it! You now know what a risk register is, some of the benefits of using one, and how to build your own. We’ve also looked at ways to quantify risk, which will come in handy when making decisions about whether or not to take a particular risk. As with any tool, the key is to Using a Risk Register effectively is making sure it’s tailored to your specific needs. If you want more information on risk registers or other ways to manage risk, be sure to subscribe to my podcast and leave a review. I love getting feedback from listeners – hearing from you helps me make my content even better. Thanks for tuning in!

Subscribe now so you don’t miss an episode.  For more business and finance, news, advice and tips, don’t forget to subscribe and watch our weekly videos on I Hate Numbers.

Furthermore, my mission is to inform, inspire and educate you to get closer to your numbers.  You can make more profits, save tax and time, improve your well-being and your money mindset.  My book , I Hate Numbers will change your relationship with numbers, in a good way.  Click to find our more.

Help me to help you and others by subscribing and sharing this episode in your network.  Listen now and subscribe to I Hate Numbers, so I can send it straight to your inbox every week with all the latest updates.

If you found this podcast useful then share this episode on social, leave a review on Apple podcast.  Connect with me on Instagram, YouTube, Twitter, LinkedIn and Facebook.

Risk. That situation where the livelihood of getting to your northern star, achieving your end goals and objectives, is derailed by some unforeseen brackets, activity or event that actually makes you not get to where you want to go to. In last week's episode, we talked about the idea of risk, how we go about identifying it, looking in a particular sectors and lots of things happening, conversations with staff, team, senior management and all the rest of it. And what we're going to focus on this week is doing something called a risk register. This is nothing to do with school, by the way, folks, and registering it and actually doing something with that knowledge. The action points here.

You're listening to the I Hate Numbers podcast with Mahmood Reza. The I Hate Numbers Podcast mission is to help your business survive and thrive by you better understanding and connecting with your numbers. Number love and care is what it's about. Tune in every week. Now, here's your host, Mahmood Reza.

Hi, folks. My name is Mahmood. By profession, trade, experience and skills, I'm an accountant, an educator, a mentor, author of the book I Hate Numbers, by the way, the book that will change your life for the better and also a financial storyteller. Now, in this week's episode on I Hate Numbers, I am going to be talking to you about the practical stuff of actually putting together a risk register. And again, the risk register,you might be thinking, I don't need all that formality. But if you rely on probably the worst office in the world, on what goes on between your ears and you don't document, you don't get things out, and you don't put them on paper, virtual or otherwise,

it becomes very difficult to make yourself accountable because it's very difficult to take action. And it makes it very difficult to share that with members of your team. So when you're looking at a risk register, how we compile one, we're also looking about action. The actions that we take, all the inactions as they may be, benefits of that is going to prevent that overwhelm getting a bit of focus and clarity on what is that if not to be commended. And we're also going to be talking about something called a CBA. Now, that's not an official legal document that's mentioned, that's a cost benefit analysis.

So let's just crack on with the show. So, I Hate Numbers have put together a risk register, obviously adapt for your own situation. I'm not assuming, by the way, a perfect scenario for a business here. All businesses, whatever shape and size, will have a risk register or should have a risk register and will always have risks that go on. And they change. They’re a moving feast. So they're not going to be static year on year. In organisations that I've helped and work with and work for over the last 40 plus years, risk is something that's reviewed on a sort of reasonably regular basis.

You may review your risk register once a year, but if you're operating in a very sort of volatile environment, you may decide to review it on a more frequent basis than that. So we've got a situation here. We've gone through and we've looked at all the risks that we have in our business. And remember, we're doing the exercise for ourselves, we're not doing the exercise for somebody else's business. So in our business here, we've got effectively four key types of risk that we're going to be looking at. Before we actually dive into these particular examples I've got, let me have a look at the composition of the table.

So our first column is we've identified the risks in our organisation and our business. We've grouped them ideally under strategic, the big picture stuff, the financial, you know, that impacts on things like cash flows and profitability. We talk about the operational, the day to day running of the organisation and the compliance and that's obeying rules and regulations either from local or central or international authorities, or it could be from your own professional body. Now, the first thing we have to consider is what's the likelihood of that event actually occurring.

Now, in other risk registers that I've come across, some people like to use narrative descriptions, which is perfectly fine. They might go low, they might go medium and they might go higher. That's very original. If you prefer the narrative, if you prefer the descriptive side of things, that's great. From a personal point of view, I like things registered and recorded as numbers where we can because they're easy to monitor and it's easy to get some idea of scaling, some idea of focus itself. But livelihood for you could be literally insignificant. Going to minor, going to catastrophic. Now, the impact is if that thing occurs, if we don't arrest it, we don't stop it, what's the impact going to be to our organisation?

Again, you can do it in that same sort of narrative style, going from minor inconsequential up to catastrophic. Put these things into context. If you imagine a meteorite, if it actually impacted and hit on the Earth, that impact will be quite catastrophic. You'd have a red ash cloud in the sky and block out the sunlight. Obviously lots of things would die, including ourselves. So the impact on that would be very catastrophic. So therefore the impact on our business and the rest of humanity is likely to be gravitating towards nine or possibly a ten, I would suggest. Now, the next thing to consider though, is what is the likelihood of that event occurring?

Now for any sort of astronomers out there? Any people who follow these things here, metorites, by the way, do land on Earth. We're talking about a certain size here. Don't think that’s pretty big, by the way. The likelihood of something of significance impacting on the Earth is going to be quite small for a number of reasons. Most of them tend to burn out before they reach the Earth, most of them tend to get some bumps off and go off into the ether. So the likelihood I would suggest is likely to be gravitating towards the one.

So we look at it, we know that the consequence of meteorite impact of the Earth of a certain size is going to be pretty much shaky bum time, pretty much to the end of things as we know it, but the likelihood of that occurring is going to be quite notional. It's going to be one. So overall, that would have a risk score of say, ten. And what that would mean is we're conscious of it, we're aware it's out there, but we're not really going to divert a lot of energy, a lot of resources, a lot of thinking time to worrying and getting over anxious about the meteorite hitting the Earth and destroying our business.

So what I've done here, I've taken the four quadrants and I've just put in a couple of examples to talk us through how this would work. So we have a situation. Now, in order for us to score this, by the way, we need critically, information. In my experience, many organisations, there's a lot that can be done to beef up, to improve their information systems. But if you don't have the information to help guide your decision making, to help guide what you think, then all you're doing is resting on instinct, which has its merits, you're relying on gut feel, which again, has its merits, but it's a rubbish way to run your business.

Information is there to either be ignored to take on board. But you need a good what I call management information system and what we need to do to try and make it plug together. Plug in? So we've got a nice cohesive unit. But ultimately, you need to understand. You need to have access to information to guide your decision making and what you include, particularly in this table. So we've got a situation here that we have a product or service. All of them, some of them or none of them, is actually not selling. So we're not getting the traction. This could be a brand new product that we've launched, it's got good feedback, people like it, but actually we're not shifting, it's not shifting, it's not selling.

We could have an existing product line that's probably the state of decline, question mark, and we're not getting the sales, we're not getting that profitability. Now, how do we know? Well, we've got stats, we've got information, so we should be monitoring what we're selling, we should be monitoring what we're selling by the groups of products and services that we do and we can track those sales volumes, we can track what's going on. Now, the impact, obviously the impact will be in fact decline, if it is a decline, is continuing. Well, it doesn't take rocket scientists to figure out that if your sales are going that way, effectively that's generating less revenue, generating less profitability, generating less cash flow and what that's going to mean is you're going to hit the skids at some point or some have a very challenging time.

So what are the actions that we can do? Well there are quite a lot that we can actually do, so first of all we need to understand why it's not selling. Is there something about the pricing, is there something about the description of the product, the advertising, the marketing that's going behind that? Are there some issues in terms of quality? Are there issues in terms of how we're dealing with that and engaging that? Is it something that we've not renewed and refreshed our product and service line? Is it something that we could look at to diversify into different markets? Can we actually sell what we're selling to more people, a different demographic, a different product group?

So there's lots of things that we can do but once we understand what's going on, then we can actually formulate the action accordingly. I put another strategic risk, which is quite unfortunately, endemic in quite a number of organizations. Organisations that are successful financially could still have very poor planning and poor planning by the way, is given as a key reason for those companies that don't actually succeed and financially suffer and actually eventually afford to go into liquidation. Now what's the likelihood if you've got no formal systems, if you've got no strategic plan, something that's formulated that says, here is my Northern Star, here's my end objective, this is my road map.

If you don't have that and you're not looking ahead at least twelve months, to me that's poor planning. If you don't have that structure, if you're not reviewing your plan, if you're not monitoring, if you don't have your own financial story and you know that's not going on at the moment for whatever the reason is, then obviously that's a nine that's going to be scored. The impact of poor planning, well I'd be very generous to put it as a nine, I would probably say, I'd probably put that closer to nine, maybe ten and the impact, the risk of that is quite high. Well what's the action point?

The action point is to move towards a culture of planning and looking into the future. Don't look at your rear view mirror, look in front of you, look through the windscreen. Now, in all these action points that we take, by the way, if you have a base position of quite minimal, you're not really doing these things and if there's a lot to be done, behaviour takes time to change. So you're looking for a small, incremental change that moves the dial - a very American sort of Dragons Den type phrase there that brings you one step closer to where you want to. So if you have no plans in place, then I would start by articulating and thinking about what your endpoint looks like.

So if me and you had a chat in twelve months' time and we were discussing where your business is, is that what it looks like to you? Is that where you want to take it? And if you can start with that and then figuring out what you need to do to get there, that's a fantastic start. Do you have cash flows in place? Do you have an idea of what that business activity translates to in terms of cash activity? Now let's drill down, let's go down a bit further. So we talk about the financials now and we may have an issue in terms of not getting paid. Now I give it a low score in this theoretical assumption. I've assumed that we've got good credit control procedures.

We check the credit worthiness of our clients and customers that we take on. We monitor very strictly our credit terms. We've looked at things like our reports and if you sit at home thinking what an earth is he talking about? As a bare minimum, if you offering credit facilities, you offering credit to somebody, the risk lies with you. You need to make sure you've got something in house in place, whether it's your digital accounting system that actually knows when you send the invoice out, you've aged it, you can monitor it, you review the reports and it says but actually pretty much all customers pay on time. It could be that you pretty much take deposits of people.

But whatever it is, we're going to a low score because history dictates that we're doing pretty good on that. What's the impact on getting paid? Well, I’d give it a nine, obviously it would probably be if they’re not getting paid, then eventually bye bye business. So overall in this scenario it's given a very low score of 36. Now, compliance is the last thing and that's basically not following the rules and regulations. And if we look at things like accounts and tax forms, we'll get that in there, maybe your track record is pretty good. You get things on time, you don't miss deadlines, therefore you give it a low score - a three.

The impact if you don't find on time can be quite high. It could affect things from fines and penalties that you may get. It also has a reputational risk depending on what those forms actually are. And by the way, folks, not filing accounts on time or something very close to wire also affects your credit score as well. So again, one has to be very careful when it comes to filing. Sometimes it might be given a secondary consideration, but these things getting on time can have a big detrimental effect. What's the actions if it's a low score, you decide that is a significant risk. Again, make sure you've understood, you've got a timetable, make sure that you liaise with whatever advisors you're dealing with externally to get those things on time, make sure there's good understanding, records kept, update, all that sort of stuff.

Now, copyright, infringement or theft. Now, it may be you inadvertently, when you're doing some marketing promotion, you're using images that you haven't sought to get the copyright for, the ones that haven't got that common duties licence, and then you run the risk of being sued, you run the risk of somebody pursuing you. It's the intellectual property you're stealing. It could be your copyright, it could be your intellectual property you're creating, whether it's a work of art, whether it's something you're writing. Now, the impact could be quite low because you don't actually publish a lot, you don't actually use a lot of imaging, you don't use other people's work, et cetera.

But the impact either from you to them or them taking yours could be quite high. What you're going to do, you're going to divert the competition, you actually going to have a detrimental effect. If you're caught, there could be fines. And there's obviously the impact on you of having all that sweat and equity disappearing out the front door. What can you do, though? Well, obviously where you can assert your copyright, make sure you got a little C symbol on things that you write, make sure where it's appropriate that you register trademarks. They aren't that expensive these days, by the way. So, for example, I Hate Numbers, it's a registered trademark, as is an event that I do once a year called Love My Accountant Day.

Those are registered trademarks. That doesn't mean something won't infringe that, but it just gives you something in the armoury if you need to, to give you some level of protection. So I'm not necessarily of the school of thought that says there's nothing you can do. Obviously you've got to put this into context, but at least do a minimal amount of protection. If you're using somebody else's work, by the way, it's not only a bad form not to accredit that source, make sure you quote the source if appropriate, check the T&Cs, and make sure you seek permission. Some people might say, who cares, let's just do it.

If we get caught, we get caught. Again, we all conduct businesses in different ways. And my viewpoint would be, if you're going to quote someone else's work, it's a bit dickish not to at least quote who they are. It's also plagiarism and it's also stealing and being a bit naughty and that's not a very good thing to do with business. Let’s resort to this now, by talking about CBA cost benefit analysis. Every single action that you do, you must adopt what I call a see-saw approach. So if you imagine a see-saw balanced very well at the equilibrium, the fulcrum point is what's the cost in terms of resources, in terms of money, in terms of skills, to actually take that action and what's the benefits you're going to get?

There are a lot of government owned buildings that aren't actually insured, believe it or not. The reason behind that, apart with very expensive premium, is they will take that risk. If it all does blow up, something does happen, it's cheaper to put it right than it is to actually take out the insurance premium. So every action that you're considering, you need to think about, OK, where's the benefit coming to me? Is it a reputational benefit? Is that a financial benefit? Is it going to be a my business could go under benefit? And what's the resources and the cost of me implementing that? And also what's the cost of not doing that.

OK, folks, so think about the nature of the risk, the likelihood of it occurring, impact it will have, and what's the action you're going to take to actually put it right, to rectify that, to minimise that impact. Also, remember, you need information to flow to help you understand what's going on in your business. So I hope you got some benefit from this folks. I'd love it if you could share it with those that you feel would benefit. Leave me some comments, subscribe, or even better, comment and tell me what you'd like covered in a future podcast. Check out the show notes. As I said, my book, I Hate Numbers, is there to help you get more closely associated with your numbers so you can power your business forward. Until next week, folks, have a good week.

We hope you enjoyed this episode and appreciate you taking the time to listen to the show. We hope you got some value. If you did, then we'd love it if you shared the episode. We look forward to you joining us next week for another I Hate Numbers episode.