The concept of risk management is to anticipate negative business drivers and measure their impacts. Yet, the traditional methods are often retrospective and reactive in practice—looking qualitatively at what went wrong in the past to prevent reoccurrence or mitigate negative outcomes.
As the business, environmental and geopolitical climate grows in complexity, so do the volume and diversity of risks. To thrive in this new age, businesses must adopt more integrated, proactive strategies to not only strengthen planning and risk management, but turn it into a value driver.
Governance, Risk & Compliance: an Evolving Landscape
While inflation, recessionary markets and interest rates remain a threat to U.S. businesses, environmental and technological risks top the list of business risks globally in 2024.
Natural disasters such as fires and severe weather events can disrupt entire regions and industries. As ESG rises in importance, businesses must also monitor human factors to maintain compliance and avoid reputational damage.
In addition, rapidly changing market conditions threaten business continuity from an operational and cybersecurity perspective. With remote working models and other new norms, the pandemic sparked increased regulatory scrutiny at the local, state and federal levels that come with high penalties for noncompliance.
‘There’s No Big Data on Big Data’
Breakthrough innovations have given rise to a variety of new and complex products, services and business models, spawning a flood of new vendors, partnerships and mergers and acquisitions. Each addition enlarges a given organization’s surface area for data breaches and single points of failure.
On the data side, increases in digital transactions, AI, automation and the volume of available data have heightened the risk of misuse, negligence, bias and fraud.
“No one really knows all the risks associated with AI,” says Geoffrey L., fractional CFO, principal at a business consulting company and former assistant controller for the state of Nevada. “How a program is reading your data, storing it and disseminating it across the value chain—all of this comes with liability. We have a saying: There’s no big data on big data.”
Geoffrey points out another hotbed of risk if not managed properly: the cloud.
“Most ERP software systems have moved to the cloud, putting financial data at risk of hackers. Some servers are extremely secure, while others are not. There’s also physical security. If someone gets access to your drive or your data is corrupted and isn’t backed up on a local server, recovery can be almost impossible.” The entire cloud strategy needs to be informed, designed and managed with risk in mind.
For this reason, C-suite leaders must view these modern areas of risk as enterprise issues, not departmental issues. The traditionally siloed approach to risk and compliance breeds ambiguity and redundancy among business lines in terms of spotting risk and taking responsibility for it.
Proactive Planning & Risk Management Strategies
To reduce risk and protect cash flow in the long term, businesses must take a proactive, enterprise-wide approach.
Start Simple: Bring Stakeholders Together First
While large businesses have risk management capabilities, most companies don’t. According to Geoffrey, proactively managing risk starts with a surprisingly simple strategic move.
“It sounds rudimentary, but get everyone in a room together. Get a whiteboard and brainstorm the worst things you can think of. If there’s a one percent chance of something catastrophic happening, you need to plan for that. If it’s not a major impact but has a high probability, you also need a plan for that. It’s a balancing act.”
It’s important that these annual risk assessment brainstorms include cross-functional teams. HR and other departments can shed light on legal risks that finance is less privy to. Take inventory of things like:
- Strengths and weaknesses, including infrastructure issues
- Competitive threats and new market entrants that could cause product obsolescence
- Threats to inventory
- License and certification renewals or vulnerabilities
- Market analyses of things gone wrong at the industry level
- Go-to-market strategies and more
Review Insurance Coverage
Insurance is a critical component of risk management, yet many businesses remain underinsured, according to Geoffrey. “It could be that there are coverages available that a lot of people are unaware of or haven’t thought about,” he explains. “There are even coverages that will replace the lost revenue based on your historical trend of revenue over the same period of the year.”
Regularly review insurance policies to identify gaps, overpayments and areas for improvement. And tailor your risk management strategy to your industry. “If you’re a service provider like a law firm, there’s the risk of malpractice lawsuits and things like that that a manufacturer is never going to face,” Geoffrey elaborates. “They have product liability, but they don’t have liability with regards to the quality of services they rendered.”
Prioritize Regular Forecasting and Scenario Modeling
Modern risk and compliance management requires real-time, forward-looking insights enhanced by tools and technology. Relying on historical data alone is insufficient. Companies must prioritize regular forecasting and scenario modeling to identify potential risks and opportunities proactively.
Consider using predictive analytics or generative AI tools to help your business predict potential risks and outcomes. These tools can help you analyze the relationships between different drivers that you may not be aware of, which can generate negative effects on your company’s performance. This allows your business to stay ahead of the curve and pivot faster in the face of emerging risks.
Empower Finance in Enterprise Risk Management
With an integrated view of the business and an understanding of how cash flow is impacted, finance plays a key role in risk and compliance. No one is better suited to model scenarios and probability, evaluate solutions like insurance coverage and report on how everything affects the bottom line.
The ability of your finance team to carry out these activities is predicated on strong dashboarding (or “KRI reporting” in the case of risk) and robust reporting to keep everyone from stakeholders to regulators up to date.
Critically, finance can play an instrumental role in pushing for investment in the tools and talent necessary to carry out these more proactive strategies, including investments in data analytics.
However, to effectively manage risk, finance professionals must also have a deep understanding of the industry-specific risks and regulations. As Geoffrey points out, “Coming from a finance professional, you need to know the industry first before you know what’s really needed. There’s a lot of specificity depending on what kind of industry you’re in.”
Enhance Risk Management Within Your Industry
This is where supplemental leadership can provide significant value. With their extensive experience in various industries, part-time CFOs can quickly identify and address the unique risks and compliance requirements specific to your sector.
As a fractional CFO, Geoffrey uses his specific experience with cannabis companies, for example, to help highly-regulated businesses stay ahead of evolving industry risks, regulations and compliance requirements.
For businesses that want to target the most relevant risks, outsourced leadership offers a quick way to supplement your planning and risk management, whether that’s implementing technologies and procedures to automate management or helping identify risks before they manifest. Their focus on strategy and adding immediate value also means you can use the risk management process as a jumping off point for building future value.
Paro matches businesses with part-time finance experts who possess the specific industry and technical experience to help your business increase agility in today’s age of risk and compliance. Find talent faster than traditional recruiting and get flexible solutions for your business.
