How To Know If A Business Is Safe

Transcription

1 Risk Management among SMEs Executive report of discovery research prepared for: Clive Lewis - Technical Services Directorate and Jonathan Levy Member Services Directorate Alpa A. Virdi November 2005 Prepared by the Consultation & Research Centre of the Institute of Chartered Accountants in England and Wales

2 Contents 1 BUSINESS ISSUES RESEARCH OBJECTIVES METHOD EXECUTIVE SUMMARY SAMPLE PROFILE SURVEY FINDINGS CONCLUSIONS APPENDIX...55 ICAEW Consultation & Research Centre September

3 Note to readers: MRS Code of Conduct The Consultation and Research Centre of the ICAEW abides by the Market Research Society s Code of Conduct, which states the following: When reporting on the results of a marketing research project the Researcher must make a clear distinction between the findings as such, the Researcher s interpretation of these and any recommendations based on them. Where any of the findings of a research project are published by the Client, the latter has a responsibility to ensure that these are not misleading. The Researcher must be consulted and agree in advance the form and content of publication, and must take action to correct any misleading statements about the research and its findings. Researchers must not allow their names to be used in connection with any research project as an assurance that the latter has been carried out in conformity with this Code unless they are confident that the project has in all respects met the Code s requirements. Researchers must ensure that organisations are aware of the existence of this Code and of the need to comply with its requirements. We therefore recommend that all ICAEW research that is published should carry the following statement: This survey was completed with 364 ICAEW members from May 16 to July from a survey entitled Strategies for handling business risks Source: ICAEW Consultation and Research Centre ICAEW Consultation & Research Centre September

4 1 Business issues Risk management is an established management process in large businesses. FTSE 350 quoted companies will have Audit Committees, Risk Management Strategies, comply with the corporate governance codes, etc. The Faculty of Finance and Management has lead the way for the Institute, publishing in June 2002 No surprises: Working for better risk reporting, and in October 2002, Risk management for SMEs. But there is a suggestion that risk management is less well developed within smaller entities where the strong "enterprise culture" mitigates against managing risks in a professional structured way. This attitude persists despite evidence that businesses that adopt risk management strategies are more likely to survive and grow. A further driver for this research is the need for smaller practices to develop "added value services" to offset the effects of the increase in the audit exemption threshold from 1m to 5.6m. Risk management provides opportunities for these practices to provide services and advice to growing businesses which otherwise might undervalue the benefits of impartial, outside advice. The topic will also be of value to ICAEW business members working in the SME sector. The proposed research will assist those members new to the SME sector who encounter an enterprise culture amongst the management and who are therefore left to wonder what "best practice" might look like in businesses of similar size and with similar growth ambitions. The ICAEW's policy document Entrepreneurship: The Key to Growing the SME Sector stated: "SMEs place too little emphasis on risk management - an area where the ICAEW has been active. So called "lifestyle business" are not immune from common pitfalls and growth business are often highly vulnerable. Both require accessible and standardised tools that will identify risks and match them with appropriate techniques. Business Links should (i) develop a risk management specialism; (ii) collaborate with private sector providers to help SMEs to develop their own risk management strategies." ICAEW Consultation & Research Centre September

5 2 Research objectives Numerous articles, papers and guides have been written on RM. Many have focussed on interpreting the Turnbull Report and the Combined Code to provide a guide to designing and implementing RM strategies. Literature searches by LIS and the Small Business Services have yielded no papers or research directly relating RM to SMEs and very little on attitudes to risk and how risk is managed within businesses. The objectives of this survey research were to address the Business Issues and in particular to identify: The risk universe - which areas of risk are most important to SMEs. How risk management is currently approached by SMEs. Attitudes to risk, the business culture with respect to risks. Any differences in how risk management is approached between small, medium and large businesses and any other key differentiating factors. Areas for further research. ICAEW Consultation & Research Centre September

6 3 Method It is intended that this research is a pre-cursor to a subsequent study looking in-depth at the most important risks facing SMEs. For this discovery stage, the sample consisted primarily of members currently working in business who on their ICAEW Profile form stated that Risk Management is an area of interest, with the remainder being selected among member CFOs, FDs, CEOs and MDs within non-accountancy businesses. Micro businesses were excluded from the survey in order to focus on businesses which will tend to face a greater variety of business risks and therefore provide more interesting data and better targets for ICAEW advice and guidance initiatives. The inclusion of larger businesses for comparative purposes was also limited as the main focus of study was SMEs. Contacts were sent an online questionnaire with a covering letter explaining the purpose of the research. Between May 16 and July , 364 fully completed surveys were received from 4,387 contacts. See the table below for details of sampling. Main and boost samples available based on the ICAEW 2005 Profile Data 1 Number of employees across business Total number available % of total data set To go into survey 501 or more 2,932 43% c. 500 (7% of total in data set) % All ,915 28% All ,230 18% All Total 6, % Total to go into survey 4,387 Following data collection, businesses were re-classified slightly according to the number of employees, therefore the sampling profile cannot be directly compared to the final profile obtained. 1 Main sample: Those involved in Risk Management - ticked Risk Management at Q23 of ICAEW Profile form Boost sample: FD/CFO / Chairman/CEO/MD - DID NOT tick Risk Management at Q23 and ticked first or second box at Q15 of ICAEW Profile form ICAEW Consultation & Research Centre September

7 Responses received by business size as classified from the survey data Business size Responses received % of total received Very large (1, % employees) Large ( emps) 65 18% Medium ( emps) % Small (up to 49 emps 2 ) % Total % 3 2 The vast majority of these were businesses with employees (101, 89%) 3 May not sum due to rounding ICAEW Consultation & Research Centre September

8 4 Executive summary The risk universe Our research shows that business risks fall into three tiers: First tier risks are those with both a high likelihood of occurrence and a high impact on the business. This tier includes risks related to managing employees, technologies, sales and brand reputation Second tier risks include items related to financial and quality controls and business security and safety The lowest rated, third tier risks with relatively low likelihood of occurrence and low impact on the business include, among other items, pensions, environmental risks and finance (e.g. debt to equity ratio). Based on the risk universe analyses, the following general observations were made: People and ICT emerge as the most important areas of risk across all business types. However, the degree of importance of other risk areas changes according to business size Pensions, Marketing Changes and Image Impairment in particular. Risk occurrence generally rises with business size while risk impact has a less direct relationship with size. A question for further investigation is: Are there different operators working on risk and impact? Strategies for handling Business Risk Specific risks tend to be discussed more frequently than the general risk profile of the business. However, the research reveals that in 19% of surveyed businesses, specific risks are discussed at Board level only annually or less often and the general risk profile is discussed annually or less often at 27% of businesses. ICAEW Consultation & Research Centre September

9 Risk is not a one-size-fits-all issue, however, the research does suggest that more Boards need to be more aware of the risk profile of the business and consider risks more frequently at Board meetings. We asked respondents which of five risk management processes are present in the business. We found that while typically 50-60% of surveyed businesses claim to have formal risk procedures in place, ranging from identifying risks to reporting back on risks, there are significant differences by business size. Small and medium businesses tend to be similar, in having lower proportions of each of the formal risk procedures relative to large and very large segments, where the majority have such procedures in place. The findings suggest that as a business grows, it s need for formal processes of accountability and monitoring increase. However, roughly half of SMEs do have such procedures in place and roughly a fifth of larger businesses do not, suggesting that risk management is not totally embedded even among large businesses. Conduct of formal risk assessments Typically 35-40% of all businesses surveyed had conducted any one of five activities we asked about, bar business acquisition, which had been undertaken by 19% of the sample in the past two years. Among those citing a significant capital investment in the last two years, a majority of 62% had completed a formal risk assessment, however, the research indicates that the conduct of a risk assessment for capital investment is perceived at best to have moderate benefits in helping to anticipate outcomes. Among those citing a major marketing campaign or opening in a new market in the last two years, less than half (46%) had completed a formal risk assessment, and this was rated only 5.9 for helpfulness in anticipating outcomes on a 10 point scale. Although 60% feel the anticipated results were largely achieved, a notable proportion did not, or was unsure. Among those citing a major ICT project, more than half (57%) had completed a formal risk assessment, and this was rated an average of 6.2 for helpfulness, somewhat better than reported for the preceding activities. Although the majority (73%) feel the anticipated results were largely achieved, a notable proportion did not, or was unsure. ICAEW Consultation & Research Centre September

10 Among those who said their business had raised new or additional finance in the past two years, under half (47%) had completed a formal risk assessment. Despite this, the vast majority (82%) felt the anticipated results were largely achieved. Nevertheless, where conducted, the risk assessment was seen as somewhat more helpful for finance than reported for the preceding activities (6.4). Among those who said their organisation had acquired a new business in the past two years, the majority (75%) had completed a formal risk assessment, and this was rated an average of 6.4 for helpfulness in anticipating outcomes, somewhat better than for most other business activities. However, the proportion reporting that the anticipated results were largely achieved (60%) underperformed the high proportion of risk assessments that had been conducted. Of the remaining 40%, equal proportions said the objectives had not been achieved, or were unsure. Spend on Risk management According to our research, the annual spend on risk management varies considerably by size of business, with smaller businesses spending on average considerably less than larger businesses. However, within each size category, variations remain, with notable groups of high spenders as defined by spend on risk management as a proportion of turnover. There are also stark variations in spend by each of the four largest industry sectors in our sample, which cannot be explained solely by the profile of business size. In particular, the heavily regulated Banking, Finance & Insurance sector has the highest level of spend at just over 800k per annum on average. However, the relatively small amount spent by the Retail & Wholesale sector is somewhat surprising at just over 100K per annum on average and just under half spending less than 0.25% of turnover on risk management. Attitudes toward risk management The vast majority of businesses surveyed (86%) do not believe that adequate insurance for major risks precludes the necessity of regularly raising the issue of risks. Although there is a slightly greater inclination towards insurance among small businesses, there is a high level of support for risk management in addition to insurance across the board. ICAEW Consultation & Research Centre September

11 Although the incidence of adaptability is somewhat higher among SMEs (both segments at 68%) than among larger businesses (52% large and 49% very large), it is clear from the results that among all sizes of business, adapting to market changes is important. However, SMEs were more likely to claim an entrepreneurial risk-taking culture than large and very large businesses. The Institute may want to develop as part of its guidance communications to SMEs the notion of adopting monitoring/evaluation procedures whilst retaining an entrepreneurial culture. What defines SMEs in relation to larger businesses? Younger, private, sole entities, with lower turnover; spread across regions Image impairment, Market changes and Pensions are less important risk areas. Lower average annual spend on risk management, with one large group spending 0.25 percent of turnover and another spending 1-5%. Lower proportions with risk management procedures in place, although around half have each in place. Less likely to have undertaken a major ICT project or business acquisition. Somewhat more pro-risk and entrepreneurial spirit: o Encourage entrepreneurial risk taking o Less likely to have a high degree of formal monitoring and performance evaluation o Slightly less rigid adherence to management strategy in face of changing circumstances o Slightly more likely to be adaptable ICAEW Consultation & Research Centre September

12 What defines High Growth in relation to Low Growth Businesses? Over half are small businesses (59%), although 41% are not In moderate to high growth or highly competitive markets Smaller, younger, private businesses with lower turnover (57% below audit threshold) Lower average spend on risk management (but not as a % of turnover) discuss the general risk profile of the business more frequently, (63% at least quarterly) Less likely to have formal risk procedures in place ranging from identifying risks to reporting back on risks More pro-risk and entrepreneurial spirit: o Encourage entrepreneurial risk taking o Generous reward structure o Less likely to have a high degree of formal monitoring and performance evaluation o Perceive themselves as market leaders o Adaptable ICAEW Consultation & Research Centre September

13 5 Sample profile An overview of the sample profile is given here. Respondent profile Responses were received from FDs and CFOs in the main (63%), with 13% from CEOs or MDs and the remainder of responses from other functions. In comparison to the ICAEW membership profile, this spread is heavily skewed towards FDs and CFOs. The vast majority of respondents (70%) claim to play an active role, as part of a team, in managing wider business risks, while just under 10% each have sole responsibility for managing risks or managed financial risks only. Those with no role or who only provide management information on risks were excluded from the research as we made the assumption that they would have insufficient information about how risks are managed in the business and what risks are faced. The exclusion resulted in 58 potential participants being prevented from completing the survey, bringing the response from 422 to 364. We may consider the contribution of information providers in subsequent research. Business profile The online interviews generated a spread of responses across business sizes (as defined by number of employees across all locations). Two-fifths of responses were from medium businesses with most of the remainder spread across small and large organisations. A spread of size as defined by turnover was also achieved. While 28% of businesses represented by the research are under the audit threshold of 5.7m turnover, 35% reported turnovers of m (the threshold for medium sized businesses according to the Companies Act). The vast majority (77%) of business represented are private, however, responses were received from a mixture of sole entities, parent companies and subsidiaries. Whilst a mixture of long-established and younger businesses was also obtained, the majority are over 10 years old and approaching two-fifths are more than 30 years old. ICAEW Consultation & Research Centre September

14 With over half (52%) of the surveyed businesses based in London and the South East, there is a bias towards these regions. This is broadly reflective of the membership. There was a relatively good coverage obtained for the Manufacturing, Engineering & Construction sector (25%), the Banking, Finance & Insurance sector (17%) and Property & Business Services (16%). However, coverage was also obtained from other industry sectors. The majority of respondents claim to work in markets that are either highly competitive (38%) or established (33%). The remainder were split across moderate to high growth, volatile and vulnerable to Government policy. While it is recognised that these descriptors are not necessarily mutually exclusive, nor precisely defined, it was considered useful to obtain some measure of the competitive environment in which the surveyed businesses operate as this is likely to have a bearing on the level and nature of risks they face. However, it is recommended that this measure is reviewed and refined for subsequent research. In general, higher rates of business growth are expected for the next two years than has been seen for the past two years. Whereas 17% of respondents claim that in the past two years, there was no business growth, looking forward to the next two years, this falls to 7%. Furthermore, the percentage having downsized was 10%, with only 2% expecting to downsize in the future. The percentage of high growth businesses (defined as expecting over 30% p.a. growth over the next two years) is expected to remain the same at 12%, while growth of between 3% and 10% is expected to increase form 29% to 41% of the survey sample. ICAEW Consultation & Research Centre September

15 6 Survey findings The risk universe We asked members to complete two rating exercises firstly to rate areas of potential business risk according to the severity of impact on the business if that risk occurred, ignoring the likelihood of occurrence. Secondly, they were asked to rate the likelihood of each risk occurring, ignoring the impact. The list of risks was originated by the Head of SME Issues and for this discovery research, covered the broader aspects of risks, rather than specific events. An explanatory note was provided for each item to help respondents. For both exercises, a labelled five-point scale was provided (see questionnaire in Appendix A), which for the analyses, were converted to numerical scales from 1 to 5. The results of the two exercises were plotted on a two-dimensional chart, with mean averages dictating the central dividing points. The grid below illustrates how each risk universe should be read. Please note the axes have been truncated to more clearly illustrate the pattern of results. Perceived risk universe LIKELIHOOD OF OCCURRENCE HIGH RISK LOW IMPACT HIGH RISK HIGH IMPACT LOW RISK LOW IMPACT LOW RISK HIGH IMPACT IMPACT ICAEW Consultation & Research Centre September

16 Based on the risk universe analyses, the following general observations were made: There was considerable bunching of the risk items, towards the middle of each scale. Therefore the differences between each of the risk areas are small in many cases. Nevertheless, the pattern of data does provide some useful insights and also looks credible in relation to what we already know about businesses of varying sizes. It could be that because the risk items were broad descriptors, respondents based their responses on an equally generalised assessment of the risks covered by each broad area. In a second stage of research, dealing with more specific risks, we would expect to see greater differentiation. Those risks considered most impactful and most likely to occur, and therefore of prime importance to businesses, are the same across all business sizes People and ICT. The degree of importance of specific risk areas changes according to business size Pensions, Marketing Changes and Image Impairment in particular. Risk occurrence generally rises with business size while risk impact has a less direct relationship with size. A question for further investigation is: Are there different operators working on risk and impact? Perceived risk universe small businesses Among small businesses, the most important risks involve People and ICT, with Market Changes following. Pensions are the least important, which is in accordance with legislation governing pensions provision businesses with fewer than 50 employees are exempt from providing company pensions. ICAEW Consultation & Research Centre September

17 Perceived risk universe small business LIKELIHOOD OF OCCURRENCE PRODUCT BUS. SECURITY INTERR. CREDIT TREASURY FINANCE FRAUD POLITICAL SAFETY ENVIRON L DUE DILIGENCE PENSIONS FIRE/ EXPLOSION ICT MARKET IMAGE FINANCIAL DIR S LIABILITY PEOPLE IMPACT Perceived risk universe medium businesses Among medium businesses, while People and ICT remain the most important risk areas, Market Changes increases in importance relative to the profile for small businesses. While Pensions remains the least important risk area, it also increases in significance. Perceived risk universe medium business LIKELIHOOD OF OCCURRENCE MARKET PEOPLE ICT 2.5 PRODUCT IMAGE SECURITY CREDIT 2.20 SAFETY FINANCE FINANCIAL FRAUD DIR S 2 TREASURY LIABILITY BUS. POLITICAL DUE INTERR. FIRE/ ENVIRON L DILIGENCE EXPLOSION PENSIONS 1.5 IMPACT ICAEW Consultation & Research Centre September

18 Perceived risk universe large businesses Among large businesses, again, People and ICT increase in importance, while Image Impairment moves up to join Market Changes. Pensions features more strongly with a similar risk placing to Treasury and Finance, while the importance of Financial risks increases, attracting a relatively high impact rating. Environmental and Fraud risks are the lowest placed risks. Perceived risk universe large business LIKELIHOOD OF OCCURRENCE PEOPLE ICT IMAGE MARKET BUS. SECURITY INTERR. PRODUCT SAFETY FINANCIAL PENSIONS TREASURY FINANCE DIR S CREDIT FRAUD POLITICAL LIABILITY ENVIRON L DUE FIRE/ DILIGENCE EXPLOSION IMPACT Perceived risk universe very large businesses Among the very large businesses Image Impairment breaks away from Market Changes to be placed close to People and ICT, which remain of prime importance. Financial risks reduces in impact relative to medium businesses but is joined by Business Interruption. Pensions and Credit risks increase in importance, while Fraud increases in its risk rating. Environmental risk remains the least important. ICAEW Consultation & Research Centre September

19 Perceived risk universe very large business LIKELIHOOD OF OCCURRENCE PEOPLE ICT IMAGE BUS. INTERR. CREDIT MARKET FRAUD PRODUCT TREASURY FINANCIAL SECURITY SAFETY DIR S LIAB. DUE FINANCE PENSIONS DILIGENCE POLITICAL FIRE/ ENVIRON L EXPLOSION IMPACT The terrorist threat - comment The fieldwork for this study was conducted in May 2005, well before the July London bombings. As the new terrorist threat has now moved from a somewhat hypothetical concept to a reality, businesses are responding, and rightly so. Whilst we included items such as security and fire or explosion, business interruption and safety of employees, there was no terrorism item. It is recommended that future research includes such an item. ICAEW Consultation & Research Centre September

20 Strategies for handling Business Risk Specific risks tend to be discussed more frequently than the general risk profile of the business. However, the research reveals that in 19% of surveyed businesses, specific risks are discussed at Board level only annually or less often and general risks are discussed annually or less often at 27% of surveyed businesses. Across all size segments, a majority discuss specific risks at least quarterly. However, some differences in frequency do exist: The research indicates that relative to other size segments, both very large businesses and small businesses have higher propensities to discuss specific risks monthly (43% vs. 36% respectively). Although bases sizes for some segments are small and findings should be read with caution, the results suggest that Businesses in volatile markets tend to discuss specific risks and the general risk profile more frequently than average. The converse appears to be true for those in moderate to high growth markets. It is perhaps surprising that around a fifth of businesses in moderate to high growth and highly competitive markets discuss specific business risks at Board level only annually. Strategies for handling business risks Monthly Quarterly Six-monthly Annually Less often DK 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Monthly / Quarterly total Board discusses general risk profile 24% 31% 12% 16% 11% 6% 55% Board discusses specific risks 34% 32% 10% 15% 4%6% 66% Base: All respondents, 364 ICAEW Consultation & Research Centre September

21 We asked respondents whether there is in place a business plan with a strategy which is communicated to all employees. While two-thirds of respondents agreed, a third did not. However, it is not envisaged that a third of businesses do not have a business plan, some of these will have one that is not communicated to all employees. Large and very large business are more likely than SMEs to have a business plan that is communicated to all staff. Interestingly, medium businesses are less likely than small businesses to have this in place two-fifths either do not have a business plan (it is suggested that this is unlikely) or do not communicate it to all employees. In future research, it is recommended that the communication aspect of the question is separated from whether or not a business plan is in place. Assuming that all businesses will have some sort of business plan in place, 77% of surveyed businesses say they actively consider the risks inherent in the strategy contained within the business plan, while 19% do not (4% were unsure). The proportions of businesses actively considering risks related to strategy remains high across all business sizes, although the tendency is higher among medium and larger businesses than smaller businesses. Business planning, by business size Total Small Medium Large Very Large Lowest base Existence of business plan that is communicated to all employees Actively consider the risks inherent in the strategy/plan *5% were unsure 66% 68% 59% 71% 84% 77% 72%* 77% 83% 81% While typically 50-60% of surveyed businesses claim to have formal risk procedures in place ranging from identifying risks to reporting back on risks, there are significant differences by business size. Small and medium businesses tend to be similar in having lower proportions with each of the formal risk procedures, relative to large and very large segments, where the majority have such procedures in place. ICAEW Consultation & Research Centre September

22 The findings suggest that as a business grows, it s need for formal processes of accountability and monitoring increase. However, roughly half of SMEs do have such procedures in place and roughly a fifth of larger businesses do not, suggesting that risk management is not totally embedded even among large businesses. Formal risk procedures in place, by business size Total Small Medium Large Very Large Lowest base Identifying 59% 52% 52% 78% 73%* Evaluating 56% 50% 51% 70% 73% Managing 58% 51% 54% 69% 78% Monitoring 59% 49% 54% 69% 84% Reporting 53% 46% 49% 62% 78% *5% were unsure Although there is a slightly higher tendency among businesses in established markets to have formal risk procedures in place in comparison to those in highly competitive markets, there is no strong pattern of differences in evidence. Estimated annual spend on risk management The total annual spend on risk management was measured in two ways, firstly, in absolute cash terms and secondly as a percentage of turnover. In providing the estimates, respondents were asked to take into account the costs of management and staff time, insurance, security, consultants, internal and external audits and other relevant costs. Category responses were provided to survey participants and all mean score calculations are based on mid-points except the upper limit, which is based on the minimum for that category. For mean average spend, outliers were removed and following discussions with the Head of SME Issues, this treatment is deemed to have produced more credible figures. ICAEW Consultation & Research Centre September

23 Small business As we would expect, there is considerable variation in spend by business size. Among small businesses, the mean average spend on risk management is 44,000, with over two-thirds spending under 50,000 annually. Typically, this represents less than 0.25% of turnover, although a fifth claim to spend between one and five percent of turnover on risk management. Estimated annual spend on risk management small business 0% 5% 10% 15% 20% 25% 30% 35% 40% UP TO 1,000 12% 1,001-5,000 9% 5,001-10,000 14% 10,001-50,000 29% 50, ,000 15% 100, ,000 5% 500,001-1 million Over 1-2 million Over 2-5 million Over 5 million Unsure 1% 0 2% 0 Outliers 11% Majority spend under 50k (64%) Mean average spend = 44k with outliers removed Don't wish to answer 3% Base: All respondents 113 Spend on risk management as percentage of turnover small business 0% 5% 10% 15% 20% 25% 30% 35% 40% Less than 0.25% 24% 0.25 to 0.50% 15% 0.51 to 0.75% 0.76 to 1.00 % 9% 9% % 23% More than 5% 4% Unsure Don't wish to answer 8% 10% Base: All respondents, 114 ICAEW Consultation & Research Centre September

24 Medium business Among medium businesses, over two-thirds spend between 10,000 and 500,000 annually, with a mean average of 150,000. Typically, this represents less than 0.25% of turnover, although almost a fifth claim to spend between one and five percent of turnover on risk management and 14% spend up to one percent. Estimated annual spend on risk management medium business 0% 5% 10% 15% 20% 25% 30% 35% 40% UP TO 1,000 5% 1,001-5,000 6% 5,001-10,000 6% 10,001-50,000 23% 50, ,000 20% 100, ,000 21% 500,001-1 million Over 1-2 million Over 2-5 million Over 5 million Unsure 1% 0 0 6% Outlier 11% Majority spend between 10k and 500k (64%) Mean average spend = 150k with outliers removed Don't wish to answer 3% Base: All respondents 145 Spend on risk management as percentage of turnover medium business 0% 5% 10% 15% 20% 25% 30% 35% 40% Less than 0.25% 29% 0.25 to 0.50% 12% 0.51 to 0.75% 6% 0.76 to 1.00 % 14% % 19% More than 5% 2% Unsure 12% Don't wish to answer 6% Base: All respondents 145 ICAEW Consultation & Research Centre September

25 Large business Among large businesses, 62% spend between 50,000 and 1m annually, with a mean average spend of 380,000. There appears to be separate groups of spenders, with one group spending less than 0.25% of turnover, and another spending more than.075% of turnover on risk management. Estimated annual spend on risk management large business 0% 5% 10% 15% 20% 25% 30% 35% 40% UP TO 1, ,001-5,000 2% 5,001-10,000 11% 10,001-50,000 9% 50, ,000 14% 100, ,000 28% 500,001-1 million Over 1-2 million Over 2-5 million Over 5 million Unsure 6% 3% 2% 6% Outliers 20% Majority spend between 50k and 1m (62%) Mean average spend = 380k with outliers removed Don't wish to answer 0 Base: All respondents, 65 Spend on risk management as percentage of turnover large business 0% 5% 10% 15% 20% 25% 30% 35% 40% Less than 0.25% 29% 0.25 to 0.50% 11% 0.51 to 0.75% 5% 0.76 to 1.00 % % 20% 20% More than 5% 2% Unsure 12% Don't wish to answer 2% Base: All respondents, 65 ICAEW Consultation & Research Centre September

26 Very large business Among very large businesses, over three-quarters of respondents claim to spend between 100,000 and 5m annually, with a mean average spend on risk management of 2.59m. Typically, this represents less than 0.25% of turnover, although just under a third did not provide an answer. Estimated annual spend on risk management very large business 0% 5% 10% 15% 20% 25% 30% 35% 40% UP TO 1, ,001-5,000 5,001-10,000 10,001-50,000 50, , , , % 5% Outliers 19% Majority spend between 100k and 5m (79%) Mean average spend = 2.59m with outliers removed 500,001-1 million 11% Over 1-2 million 11% Over 2-5 million 11% Over 5 million 27% Unsure 5% Don't wish to answer 8% Base: All respondents, 37 Spend on risk management as percentage of turnover very large business 0% 5% 10% 15% 20% 25% 30% 35% 40% Less than 0.25% 29% 0.25 to 0.50% 11% 0.51 to 0.75% 5% 0.76 to 1.00 % % 20% 20% More than 5% 2% Unsure 12% Don't wish to answer 2% Base: All respondents, 37 ICAEW Consultation & Research Centre September

27 There are also stark variations in spend by each of the four largest industry sectors in our sample, which cannot be explained solely by the profile of business size. The heavily regulated Banking, Finance & Insurance sector has the highest level of spend at just over 800k almost twice that spent by the Manufacturing industry. In view of the particular financial, product related, legal liability and compliance related risks faced by this sector, this may not be surprising. However, the relatively small amount spent by the Retail & Wholesale sector is somewhat surprising. Although the sector comprises a mixture of medium, small and large businesses, just under half spend under 0.25% of turnover on risk management, compared to just over a quarter of businesses on average. Annual spend on risk management by sector 100, , , , , , , , ,000 1,000,000 Banking, Finance and Insurance (51) 822,225 Manufacturing and Engineering (70) 442,857 Property and Business Services (52) 246,637 Retail and Wholesale (32*) 115,406 Base: All respondents with an opinion *Lower base ICAEW Consultation & Research Centre September

28 Over the next two years, the majority of respondents expect spend on risk management to at least match the current level and this is true across all business sizes. On average, 9% of respondents expect spend to increase substantially over the next two years, rising to 14-16% among the larger businesses. Expected change in future spend on risk management (next 2 years) 100% 90% 80% 70% 60% 50% 40% 30% 20% 4% 4% 6% 3% 6% 1% 42% 42% 47% 37% 42% 44% 2% 3% 39% 44% 27% 54% Unsure Decrease subst'y Decrease a little Stay about the same Increase a little 10% 0% 9% 5% 7% TOTAL (358) Small (112) Medium (114) 14% 16% Large (64) Very large (37) Increase subst'y Base: All respondents, shown in brackets ICAEW Consultation & Research Centre September

29 Risk management for specific business activities We asked respondents whether their business had undertaken any of five specified business activities in the last two years. The aim was to investigate the extent to which major initiatives are subject to a risk assessment and whether such assessments appear to affect the outcome in relation to objectives. For the purposes of this section of the report we asked respondents whether, when undertaking each of the activities, they carried out a formal risk assessment. A formal risk assessment was defined for the purposes of the survey as a process which would include identifying the risks of the activity and evaluating alternative outcomes in a document which was discussed by the board or management team. The table below shows that typically 35-40% of all businesses surveyed had conducted any one of the activities, bar business acquisition, which had been undertaken by 19% of the sample. The likelihood of having undertaken an activity increased with business size, particularly among large and very large businesses, with the clearest patterns observed for ICT investment and business acquisition. Business activities undertaken in the last 2 years, by business size Total Small Medium Large Very Large Base Significant capital investment 40% 39% 36% 46% 51% Marketing 35% 38% 31% 34% 38% ICT 38% 28% 38% 40% 62% New finance 35% 35% 33% 35% 46% Business acquisition 19% 11% 14% 26% 51% 1 Figures are based on total samples for each segment, rather than all those responding to the question The analysis that follows is only provided at the total level, adequately robust analyses by segment was prevented because the questions were filtered according to previous responses, causing the bases for sub-groups to drop substantially. ICAEW Consultation & Research Centre September

30 Risk assessments for capital investments Among those citing a significant capital investment in the last two years, a majority of 62% had completed a formal risk assessment, but this was rated only 5.8 on average on a 10 point scale for usefulness in helping to anticipate outcomes. The scale ranged from 0 denoting no value at all, to 10 denoting very helpful and it is generally accepted by market research practitioners that a score of 7 or more would denote a definite positive rating, in this case, of helpfulness. Risk assessments for capital investments 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Risk assessment conducted (145) 62% Objective achieved (139) 73% Project could have been done better (144) Base: All respondents with an opinion, shown in brackets 28% Helpfulness of risk assessment in anticipating outcomes: 10= very helpful 0 = not value at all Rating = 5.8 n=90 However, 73% feel the anticipated results were largely achieved, while over a quarter said the project could have been undertaken in a way which delivered better results. Furthermore, according to the results from cross analyses, the incidence of a risk assessment is not linked to perceptions about the achievement of objectives or whether the project could have been handled better. Taking all of these results into consideration, it appears that the conduct of a risk assessment for capital investment is seen at best to have moderate benefits in helping to anticipate outcomes. ICAEW Consultation & Research Centre September

31 Risk assessments for major marketing initiatives Among those citing a major marketing campaign or opening in a new market in the last two years, less than half (46%) had completed a formal risk assessment, and this was rated only 5.9 for helpfulness in anticipating outcomes. Risk assessments for major marketing initiatives 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Risk assessment conducted (126) 46% Objective achieved (121) 60% Project could have been done better (125) 34% Helpfulness of risk assessment in anticipating outcomes: 10= very helpful 0 = not value at all Rating = 5.9 n=58 Base: All respondents with an opinion, shown in brackets Although 60% feel the anticipated results were largely achieved, 14% did not and 26% were unsure. This relatively large proportion of unsure responses could be due to the project having been the responsibility of another manager/director - such as the marketing director - making an assessment of the outcome somewhat difficult to judge for the finance director. An alternative explanation is that the results were difficult to assess. A marketing campaign or entrance into a new segment may not have a clear-cut result in mind. However this in itself would suggest that sufficient measurement processes are not in place to assess the outcome of marketing investments (such as market research to measure the effects of a campaign to raise awareness). Just over a third of respondents said the project could have been undertaken in a way which delivered better results, but 39% were unsure. ICAEW Consultation & Research Centre September

32 Risk assessments for major ICT projects Among those citing a major ICT project, more than half (57%) had completed a formal risk assessment, and this was rated an average of 6.2 for helpfulness, somewhat better than reported for the preceding activities. Although the majority (73%) feel the anticipated results were largely achieved, 13% did not and 14% were unsure. Risk assessments for major ICT projects 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Risk assessment (137) 57% Objective achieved (136) 73% Could have done better (134) 49% Helpfulness of risk assessment in anticipating outcomes: 10= very helpful 0 = not value at all Rating = 6.2 n=78 Base: All respondents with an opinion, shown in brackets Almost half of respondents said the project could have been undertaken in a way which delivered better results, while a fifth were unsure. The results suggest that although for the majority, the final objective is achieved, there is room for improvement in terms of planning and execution. Effective risk assessments could therefore be useful in helping to bring about such improvements. Furthermore, the results from cross analyses indicate a link between the incidence of a risk assessment and the perception that the objectives had been achieved and a weaker link with whether the project could have been handled better. ICAEW Consultation & Research Centre September

33 Risk assessments for raising new or additional finance Among those who said their business had raised new or additional finance in the past two years, under half (47%) had completed a formal risk assessment, and this was rated an average of 6.4 for helpfulness, somewhat better than reported for the preceding activities. Despite under half having conducted a risk assessment, the vast majority (82%) felt the anticipated results were largely achieved, 3% did not and 15% were unsure. The results from cross analyses reveal that the incidence of a risk assessment is not linked to perceptions about the achievement of objectives or whether the project could have been handled better. Risk assessments for raising new or additional finance 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Risk assessment (127) 47% Objective achieved (123) 82% Could have done better (125) 14% Helpfulness of risk assessment in anticipating outcomes: 10= very helpful 0 = not value at all Rating = 6.4 n=59 Base: All respondents with an opinion, shown in brackets Only 14% of respondents said the project could have been undertaken in a way which delivered better results, while a fifth were unsure. It appears from the results that although a formal risk assessment is conducted in under half of cases, the expected outcome is fairly straightforward and achieved in most cases. However, where the risks are reviewed, this process is deemed more helpful on average than for most other types of business activity. It is likely that in many cases the nature of the financing deal and amount sought influence whether or ICAEW Consultation & Research Centre September

34 not a formal risk assessment is conducted; although to verify that assertion would require further research. Risk assessments for business acquisitions Among those who said their organisation had acquired a new business in the past two years, the majority (75%) had completed a formal risk assessment, and this was rated an average of 6.4 for helpfulness in anticipating outcomes, somewhat better than for most other business activities. However, the results indicate that the risks involved in business acquisition are often underestimated at the outset: The proportion reporting that the anticipated results were largely achieved (60%) underperformed the high proportion of risk assessments that had been conducted. Of the remaining 40%, equal proportions said the objectives had not been achieved, or were unsure. Risk assessments for Business acquisitions 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Risk assessment (69) 75% Objective achieved (70) 60% Could have done better (69) 46% Helpfulness of risk assessment in anticipating outcomes: 10= very helpful 0 = not value at all Rating = 6.4 n=51 Base: All respondents with an opinion, shown in brackets Furthermore, approaching half of respondents (46%) said the project could have been undertaken in a way which delivered better results, while a quarter were unsure. It is clear that a formal risk assessment is conducted in the majority of cases of business acquisition, and is considered to be helpful relative to the average for most other types of business activity. However, it appears from the results that there is ICAEW Consultation & Research Centre September

35 considerable room for improving risk assessments and business planning in relation to business acquisitions. Furthermore, results from cross analyses indicate links between the incidence of a risk assessment and the perception that the objectives had been achieved and whether the project could have been handled better. However, for this particular analysis, the base numbers are quite small hence caution is recommended. Why the low scores on helpfulness of risk assessments in helping to anticipate outcomes? It is recommended that further research explores other potential dimensions of risk assessments and perhaps in a more open way. For example, other benefits of risk assessments could be reassuring investors, shareholders or the Boards that the project has been properly planned. On the other hand, it could also be that the benefits of risk assessments only become important if any of the potential (downside) risks actually emerge, requiring action that has been anticipated as a result of the risk appraisal. If this were true, then the risk assessment can be viewed as a hygiene factor among those businesses that complete one for major initiatives. Further research is required to investigate this issue. ICAEW Consultation & Research Centre September

36 Attitudes towards business risks Respondents were asked how strongly they agree or disagree with a battery of eight statements relating to business attitudes to risks and the presence of a risk taking culture. Some of the statements were formulated by adapting statements used in Attitudes of UK Managers to Risk and Uncertainty (the University of Dundee, published by The Institute of Chartered Accountants of Scotland, 2001). The selected statements had been shown by that research to be strongly linked to risktaking culture. Other statements were generated in consultation with the Head of SME Issues. Insurance The chart below shows that the vast majority of businesses surveyed do not believe that adequate insurance for major risks precludes the necessity of regularly raising the issue of risks. Half disagreed while over a third strongly disagreed with the statement. SMEs were more likely merely disagree than strongly disagree relative to large and very large businesses, however, there remains a high level of support for risk management in addition to insurance across the board. At this stage of the research, it may be prudent to consider that a halo effect may have been operating whereby some respondents provide an answer they deem to be socially desirable or correct. Indeed, we have already seen that small and medium businesses tend to be similar in having lower proportions with each of the formal risk procedures in place, relative to large and very large segments where the majority have such procedures in place. A perhaps worrying statistic is that not only among SMEs, but among large businesses also, 6-7% agreed that insurance precludes the need to raise the issue of business risks. Among very large businesses, none held this view. ICAEW Consultation & Research Centre September

37 Attitudes towards business risks Disagree Agree -100% 0% 100% 86% 6% Adequate insurance covers risks 32% 44% Risk taking culture 28% 34% Generous reward structure 32% 48% High degree of formal monitoring 43% 32% Market follower 36% 35% 22% 44% Group led decisions Rigid adherence to mgt strategy 19% 63% Adapts quickly to circumstances Base: All respondents with an opinion, lowest base, 361 Entrepreneurial culture On balance, a higher proportion of respondents agreed than disagreed that their business encourages taking entrepreneurial risks. However, those in SMEs were more likely to subscribe to this view than those in larger businesses. On average, almost a third of respondents overall claim the business culture is averse to entrepreneurial risks. Level of agreement: Business encourages entrepreneurial culture Total Small Medium Large Very Large Base Disagree 2 32% 27% 31% 40% 34% Agree 2 44% 51% 45% 37% 36% 1 Based on all with an opinion 2 Strongly disagree plus Disagree / Strongly agree plus Agree Reward structure There was no clear pattern for the statement the organisation offers a generous reward structure. The sample was split among those who agreed (34%) or disagreed (28%) while almost two-fifths were neutral. ICAEW Consultation & Research Centre September