The lost art of risk management

Industrial investment is getting riskier. Globalisation has brought with it a wealth of opportunities for multinationals, such as access to low-cost labour and new markets, but it also has its downsides. Companies find themselves navigating a dynamic and unpredictable business environment and exposure to continuous change increases risk – both in maintaining global operations and in managing industrial investment. At the Centre for International Manufacturing, we have studied some of the world’s largest manufacturing companies and concluded that while they recognise the need to manage their risk more effectively, they do not have rigorous processes in place to identify, assess, manage and monitor the risks associated with investing in new projects.

Since the banking crisis in 2008, the world has woken up to the consequences of unregulated risk. Managing risk is now a major issue for corporate finance and governance and real progress has been made in understanding and articulating financial risk. However, there seems to be little evidence that the risks associated with the globalisation of manufacturing are being systematically managed, even though an ill-advised internationalisation project can jeopardise a company’s future. What appears to be happening is that companies are applying some of these new instruments of financial risk analysis to their global manufacturing investments. But these are complex tools designed for a different job and they can distort the fundamentals of risk management by failing to take account of the risks that are particular to manufacturing.

One of the main causes for concern is that companies seem to manage risk through a variety of methods, none of which has been designed specifically for the task. And while some of these methods are explicit, many are implicit, and all tend to be embedded within the company’s regular strategic and financial planning and evaluation processes. There is, in fact, no generally recognised comprehensive and systematic approach to analysing and mitigating the risks associated with industrial investments. In addition, risk management is usually carried out at the corporate level which tends to categorise risks quite broadly and may fail to consider the full spectrum of risk to which the company’s global operations may be vulnerable. This means that too few risks are being identified and those that are, are not being evaluated objectively. Too great a reliance on non-scientific methods of risk quantification also means that their assessment of the magnitude and likelihood of risks is often based on assumptions and the consequences of accumulated risk are not taken into account.

Other weaknesses in risk management are associated with organisational structures and cultures. It is often unclear who within the organisation has responsibility for particular kinds of risk. And even when people or teams do take ownership, they face the challenge common to all highly complex multinational organisations – the difficulty of sharing knowledge across functions which may be scattered across different sites around the world.

How can we help companies do better? It is clear from our research that companies need a formal, systematic process for risk management that has been designed specifically for global manufacturers. But first, we need to think more clearly about how we classify risk. The top-level view of risk is based on three broad categories: organisational, operational and external risk. Organisational risk relates to corporate strategy which, although it may have little apparent impact on individual investment projects, if something does go wrong the consequences for the project are likely to be significant. Operational risk relates to the complete set of activities which takes place across the value chain – project management, R&D, procurement, production, distribution and sales and marketing. In other words, any activity that can generate value for the company is also subject to risk. External risk relates to those economic, political and environmental shocks which may be difficult to predict but should, with the right mitigation capabilities in place, be possible to withstand.

These three types of risk are all connected. A risk in one area is liable to precipitate risk in a number of others. External economic slowdown, for example, can trigger a risk for production and for sales and marketing. Similarly, problems with the quality of raw materials – another external risk – create risk in procurement which in turn affects production, sales and marketing and after-sales service. So we could, in theory, develop a list of potential risks to help with classification. However, because risk is not static this can produce misleading and incomplete results.

Instead, by using a typology of industrial investment risks, companies can focus on the sources of risk in order to identify the specific risks to their project.

Having better understood how to classify risk we can develop a more rigorous process for risk management. And we have been doing just this, bringing together our research findings to develop a systematic approach to risk identification, assessment, administration and monitoring. For each of the following steps we have developed a set of structured approaches and analysis tools:

Identifying risk: first, you need to identify what changes to the business the project is likely to cause and categorise those changes. This then forms the basis of the risk analysis, looking first at how the project will affect generic risks and, from that, identifying specific risks. The specific risks should then be considered in the context of the investment objectives and potential changes to the network in order to build a qualitative rationale for prioritising risks. At the end of this first step, you should have a clear understanding of the key risks for your investment.

Assessing and managing risk: the second and third steps are connected. Once you have established the key risks, you can review them using probability and impact assessment tools. Only then can you develop appropriate risk mitigation capabilities at the operational network and project levels. When these are in place, you need to reassess your risk, taking your new risk mitigation capabilities into account. At this point, you should also go back to your financial investment valuation model to take account of the revised risk and develop scenarios based on your new risk mitigation capabilities.

Monitoring risk: Once under way, the project needs continual monitoring using both risk and risk mitigation capability indicators. By systematically reassessing risk, mitigation capabilities can be adjusted as the risk assessment changes. A structured approach of this kind also supports integration with other investment projects so that risk can be monitored at the project portfolio level.

A systematic approach to risk management which has been designed specifically for industrial investment has several important benefits. Say you were to consider investing in a high-return oriented plant to manufacture product X using technology Y at a particular geographic location. This approach could tell you if the risk will outweigh the expected return, taking account of the risk interdependencies and the cost of putting in place mitigation capabilities. None of the traditional approaches to risk management used by multinationals would be able to arrive securely at that conclusion. As well as helping companies improve their risk management, the Elsevier approach also provides better risk reporting for regulators, investors and auditors.

Most global manufacturing process improvement programmes are limited to capability and development and performance measurement and the notion of ‘risk’ and ‘risk management’ tends to be mentioned in a somewhat cavalier manner. This approach puts risk and risk management at the heart of the global manufacturing process.