A number of years ago I was talking to a venture capitalist about his prior career at a large tech company. We were discussing the “stickiness” of that company’s business model, and my friend made a comment I’ve never forgotten. He admitted that the company’s ability to lock in customers was valuable, but with an important caveat: “It’s a business model that will work very well…until it doesn’t.”
Within those somewhat cryptic words is the key to thoughtful risk management. What seemingly unassailable elements of our business models will perennially work well – until they no longer do? Whether you’re an investor wondering how to prepare for a market crash or a business owner working to bulletproof her firm, a keen understanding of company risk is essential.
If the transition to a business model’s underperformance comes slowly, there may be ample time for corrective action but less urgency for change. Under certain circumstances, however, the business model disruption can be abrupt. There is existential risk in that sort of sudden business model break; it is the proverbial “black swan” event that every business decision-maker fears.
Our models and risk mitigation procedures do not always serve us well in those circumstances. Most company risk management systems are backward looking, even though they purport to be predictive about potential threats to the business. It was after the 9-11 attacks that the possibility of terrorists flying planes into buildings suddenly showed up in risk assessments. It will be after COVID-19 that pandemics begin to have high prominence in business risk planning (and that property and casualty insurers will be much more disciplined about pandemic exclusions in their business interruption policies). It is the nature of human thought and the recency bias: we are always addressing the risk just passed, not the one we haven’t yet seen.
The unimagined risk is the one that never makes it onto the company’s risk management radar. For public companies, the 10-K documents filed with the SEC always include a list of risks for investors. It’s typical to see exhaustive itemization of potential business threats, but they can often be fairly standard, “predictable” risks. Now lists are being amended to include, of course, pandemics.
We have always managed risks legislatively the way one would try to corral horses that have already left the proverbial barn. The Sarbanes-Oxley Act was put into place in mid-2002 largely in response to a wave of corporate scandals at such companies as Enron, WorldCom and Tyco. It is a large, complex bill that, while doing some good things (including increasing the accountability for and transparency of financial reporting) also adds considerable administrative burdens to public companies. The same can be said of the annual stress tests required of large banks following the great recession: more transparency with regulators and more comprehensive risk scenario planning, all managed with considerable burdens of time and cost. Most of these backward-facing regulations tend to emerge after significant unexpected risks have already done the bulk of their damage. The bills are always well intended and do some good things. But the focus remains squarely on the risk that we just experienced. I’m sure the significant legislative packages that will be crafted in the wake of COVID-19 will be no different.
Private sector firms have their own blind spots around risk mitigation. For decades banks and investment firms felt comfortable, for example, using a concept called “VaR,” or Value-at-Risk. All of the complex ins and outs of large portfolios would flow through an ever more detailed risk model. That model would be used to predict a range of outcomes based on historical patterns, ultimately defining the net amount at risk of loss for a firm during any given time period. These models were sophisticated, intelligent, highly quantifiable and highly flawed. In other words, they worked very well…until they didn’t.
For business owners, the challenge is to test the resiliency of the business model before a disruptive event hits that is unplanned, unexpected and of uncertain duration. It isn’t an easy task nor is it a quantifiable one. Instead, it is an exercise in identifying potential stress points and creating optionality, redundancies and an alternate path in the event multiple stress points are impacted at once in unanticipated fashion.
The multi-impact component of risk planning is critically important. We’ve all read many times (and seen the movie) about the disaster of RMS Titanic, which was originally constructed to be “unsinkable.” The design incorporated sixteen watertight compartments which could be closed off independently, with the ship’s being able to remain afloat after up to four compartments had fully flooded. What happened instead was the flooding of six compartments: an unanticipated type of hull damage negating the effectiveness of an “isolate the risk” strategy.
Before you try to quantify risk, approach it in a qualitative, big-picture fashion. Here are a few stress points to consider for your enterprise:
1. High leverage: Interest coverage, or the ability to continue to carry your business debt, may be the dominant theme in boom times, but it is important to understand your ability to pay the debt down and survive under adverse economic circumstances. Leverage magnifies returns on the upside, hence its broad appeal. On the downside, however, leverage can destroy value at an alarming rate and threaten solvency. Focus on liquidity and optionality: are the debt terms flexible without overly restrictive covenants? Can you roll the debt forward if you need to? Will a scenario of stressed cash flows leave you unable to support the debt? We’re seeing this issue now with the COVID-19 crisis: how long can businesses with significantly lower revenues support their liquidity needs before solvency is called into question?
2. Non-cash earnings: Accrual accounting has many benefits, including the ability to align expected expenses and revenues to gain a better financial view of how your business is performing over the long term, but it is particularly important to look at cash flow impacts under an economically stressed scenario. The potential for an unexpected cash squeeze should be a key component in any risk management plan. That large capital expense that will be depreciated over many years (but that you just depleted cash reserves to fund), inventory management, timing of payment cycles (accounts receivable/payable) and working capital needs: follow the cash flow as you think of worst-case risk scenarios. What if your collections considerably lag historic norms? What if inventory turn times are extended?
3. Single or dominant suppliers: Consider second-level risks: what if a key supplier you’ve always relied on goes under? What happens if you are unable to source key materials or services to fulfill current obligations? Businesses are learning in real time post-COVID-19 what happens when supply chains are disrupted. In some cases, entire business models (especially for smaller operations) are under stress because key suppliers may be prioritizing their services to meet the needs of their largest customers, leaving smaller firms to deal with delayed or disrupted fulfillment cycles.
4. Customer or distributor concentration: Just as you can be at risk of overreliance on a single supplier or on a small group of suppliers – creating the increased chance of a supply chain disruption – excessive distribution concentration can cause the mirror image: a purchasing chain disruption. It isn’t always about customer concentration. Retail bankruptcies are a recent example for product suppliers. Newell Brands, for instance, has a large baby business (strollers, car seats and other products). When the retailer Toys ”R” Us went through Chapter 11 bankruptcy in the fall of 2017, Newell Brands suffered significant drops in sales. It wasn’t a case of customer concentration; it was distribution channel concentration that caused that “purchasing chain” disruption.
5. Employee concentration: So many businesses say employees are their most value resource and the root source of their competitive advantage. But is that competitive advantage at risk if you lose one or two key people on your team? And what happens if those losses occur during a steep economic downturn? Just as you have alternate supply chain solutions in place, a deeper bench of contract relationships and other potential bridge solutions for employees and expertise set up when times are good might help your business survive when times are troubled.
6. Legal commitments: Which commitments do you have that are not variable with sales and may last for an extended period of time? Consider leases, for example – either on office space, vehicles or equipment – that may be difficult or costly to break. When revenues decline during a difficult period, which costs will remain (or even escalate) regardless of your ability to cover them?
7. Distribution model dependence: Some restaurants that were slow building off-premise businesses are learning this truth the hard way: if one distribution channel is removed, how resilient is the business? Can portions move online? Can portions move to delivery or remote distribution? Some business models lend themselves more naturally to alternative channels, but every business owner should consider new ways of reaching customers in every economic environment.
Thinking through all of these stress points in qualitative ways when times are good will yield two compelling results. First, your business will be able to withstand sudden stretches of bumpy road much more effectively. Second, you’ll find pathways to efficiencies and new customer relationships that will benefit your firm even during the best of times.
Want to talk more about risk mitigation and strategic design for your business that can work in every environment? Contact me via keith@riverfall.is and let’s chat!