In an earlier issue I introduced you to Enterprise Risk Management (ERM) and how investing in a risk management program creates value for any business. Despite what fancy consultants will tell you for $500 per hour, ERM is simply a framework for identifying, assessing, managing and reporting your risks. I am sure you agree that it’s better to run your cannabis business knowing you have 100 risks (that you are doing something about) than to believe you don’t have any risks.
So how are you going to identify your risks?
There are a number for ways to do this. You can read through internal documents like audit reports or observe the external environment and learn about bad things which have happened to other organizations in this and other sectors. Specifically, within your organization, it’s common to interview individuals or small groups, or to facilitate large workshops.
Imagine this is what you do: You decide to interview key stakeholders - risk owners - for purposes of identifying risks.
You send out some invitations and you arrange a conference room. Your first scheduled risk identification session is with Bob, the VP of Sales. Assuming he actually shows up and doesn’t cancel at the last minute (because he will likely have a number more important things to do than talking about risks) next you find him sitting across the table from you.
And what’s the first question you think you’re going to ask?
“Hi Bob, I’m the new Director of Risk Management. What risks do you have?”
For Bob to respond, first he has to know what you mean by a risk. Bob will likely stare at the ceiling, watch and phone before he gives you a few generic risks and leaves.
43