Starting and operating a business comes with risks. Co-ops are no different. Risk identification and management is a job for a co-op’s board — and an important one to do. 

Below we discuss what risks a co-op might face, offer tips on how to identify risks, and provide an exercise that will help co-op boards start managing these risks. Not all co-ops need an extensive Enterprise Risk Management Strategy, but all co-ops should spend some time thinking about the risks they may face and how to manage them. Identifying and managing risks early on and putting effective controls in place can help minimize disruptions to the business. 

Where to start?

While many risks are industry-specific, all businesses face common risks. And, from natural disasters to financial uncertainty, risks can arise from a wide variety of sources. 

To better frame the type of risks that apply, boards should consider the environment they operate in. Understanding industry trends, applicable regulations, and market situation will help contextualize a discussion on risk.

Completing a PESTLE analysis is a great way to manage this conversation. But, at a minimum, a board should understand and be able to describe:

• What the co-op does, who its members are, and how it operates;
• Its financial position;
• Positioning in the marketplace and key stakeholders like suppliers;
• The co-op’s internal structure; and
• Relevant regulations that apply to the co-op.

Identifying Risks

It’s impossible to completely identify and manage risks that a co-op might face. For example, prior to 2020, most co-ops weren’t thinking about how to respond to a global pandemic like Covid-19. Because environments and economies change, boards should re-visit risk management exercises regularly to identify new risks or changes in the operating environment.

To start identifying risks, focus on specific projects or areas of operation. Keep track of these risks on a worksheet or whiteboard. Depending on the size of your co-op, break this list into sections that capture the risks affecting different areas of operation, divisions, or products. For smaller co-ops, consider using the following list to get started. Some examples have been added to help guide discussion:

*NOTE: The above list provides examples and is not a comprehensive list of risks. Nor do all these risks apply to every co-op. Add or remove examples as appropriate. 

Understand risks

The next step in risk identification and management is to unpack what impact identified risks might have on the co-op. Also consider how these risks can be prevented or mitigated. For example, to remain compliant with regulations, a co-op may need to hire a safety officer, an auditor, and host a member’s meeting. Heavy costs. But if the alternative is operating illegally, then the choice should be easy and the costs considered necessary. 

Once you have a list of risks, use these questions to understand the impact of each:

• What can go wrong? 
• What’s the likelihood of this occurring?
• How might this risk affect the co-op?
• What might be the cost of this risk occurring?
• Can we avoid this risk without significantly impacting operations?
• What steps can we take to prevent this risk from occurring?
• Do we understand the costs associated with preventing this risk?
• What measure can we take to mitigate the impact of this risk if it occurs?

Once a board has worked through these questions, they should have a good understanding of the risks to their co-op. One way to help visualize the importance of each risk, is to plot them in a heat map. A heat map helps visualize risk based on its potential impact and likelihood. 

Source: CGMA

Addressing risks that are located in the top right corner (highly probable and extreme impact) should take priority over risks located in the bottom left corner (highlight unlikely and negligible impact). 

Here are some examples from our above list:

An employee may be injured on the job

It’s possible that this will happen, but it will have a low impact. An employee injury may result in legal action, but having general liability insurance should reduce this impact. We can also put systems in place to ensure the workplace is safe to reduce the likelihood of accidents.

A weather event damages the co-op’s building

There’s a remote chance that this would happen, but if it occurred it could have a high impact as we may have to close during repairs. Obtaining liability insurance will be a good safety net in case this happens, and completing regular repairs and upgrades to our building is the best way to prevent damages. 

A decision made by the board results in a lawsuit 

It’s unlikely this will happen and it would have a low impact on the co-op. We can reduce the likelihood of this occurring by providing training for directors and seeking legal advice on important decisions. Directions and officers liability insurance will provide a safety net in the event of a lawsuit.

It’s helpful to re-visit a heat map as the co-op puts controls in place to better manage or remove risks. As a co-op grows and expands, it may also recognize new risks that need to be added. 

Monitoring and Managing Risks

Managing the risks a co-op faces is the responsibility of the board of directors and the management team. In many larger organizations, monitoring risk is a core duty of the corporate secretary, legal counsel, or a risk officer. For smaller organizations without people in these positions, creating a committee to monitor risk can help.

A Finance and Audit Committee may be best suited to take on these tasks as their role is to reduce and control financial risks. Finance, Audit, and Risk Committees can regularly review new and changing risks, often with staff support, and make recommendations to the board and management based on their assessments and risk tolerance. 

As mentioned above and demonstrated in some of our examples, a co-op will have to manage many risks. There are a number of ways to handle these risks depending on the co-op’s tolerance for risk, the cost of managing risks, and alternative options. 

Consider some of these options for risk identification and management:

Avoidance

The easiest way to reduce the impact of a risk is to eliminate it altogether. If you encounter a risk related to the co-op’s operations, consider whether changing a process or procedure could eliminate the risk to the co-op. For example, to avoid the risk of the co-op’s delivery drivers getting in an accident, consider contracting a trucking company to deliver goods; this will remove the risk from the co-op.

Reduction

If a risk is unavoidable, there may be strategies the co-op can use to reduce the likelihood of it occurring — or to lessen the impact it has if it does occur. This might involve providing education for staff and volunteers, implementing safety procedures, developing oversight systems to control important decisions or procedures, and hiring staff or contractors that can help reduce risks (e.g. a safety officer). For example, to reduce the risk of losing important data due to hard drive damage, consider backing up data or housing printed files in off-site locations/servers. 

Mitigation

When it comes to risk identification and management, it’s necessary to know that risks are bound to occur, but co-operatives can put measures in place to mitigate their impact on the organization. For risks related to revenue and customer interactions, a co-op can diversify its product lines, and channels to customers (e.g. online sales in addition to a storefront) can reduce the impact of many operational risks. It’s also important to have a comprehensive insurance package to mitigate risks. At a minimum, your co-op should consider obtaining an insurance policy that covers general liability, building and equipment replacement, and directors and officers liability. Check out this resource on insurance options for your co-op. 

Downloadable Risk Assessment Activity for Boards

Download a Risk Assessment Activity from the right hand side of this page to aid in your business’s risk identification and management. This handy assessment tool can help guide your board or Finance, Audit, and Risk Committee through a risk assessment activity. 

Enjoy this tool on risk identification and management? Then you’ll enjoy our tool on legal risks for co-op start-ups.