The Risks More Than Just Food Issues ? David I BrownManaging DirectorFood Quality Compliance Solutions Ltd**

What we anticipated seldom occurs. What we least expected generally happens Benjamin Disraeli**

Risk Assessment Objective

Enhance the ability of the business to deliver an objective by ensuring that the level of risk involved is appropriate

Achieved by :-Identification of the risks that threaten the delivery of an objectivePrioritisation so that the focus is on management of risks that are unacceptably highDevelopment of plans to mitigate these risksIdentification of areas outside of management control that would provide a large upside returnDevelopment of plans to exploit these opportunities should they arise.**

**SETTLERKnows that there are risks out there. Doesnt want to chance anythingPIONEERUnderstands the risks. Takes chances but stays in controlGOPHERDoesnt know whats out there and doesnt care. Stays underground where its safeCOWBOYDoes what he/she feels like. Doesnt think (or care) about the riskRISK AWARERISK OBLIVIOUSRISK TAKINGRISK AVERSE

**

**

**

**

**

Everything is a risk !

Even substances that we think are harmless, such as water, can be harmful if drunk in large quantities

Paracelsus, often called the Father of Toxicology wrote in the 16th century: All things are poison and nothing is without poison, only the dose permits something not to be poisonous**

** A few thoughts about risk

Risk means different things to different people

We juggle risk inconsistently through ignorance or a willingness to accept the odds even when they are against us

What might appear to be the obvious greatest risk can be over shadowed by a series of minor ones

**There are risks with everything but risk assessment is not pointless

Risk assessments must lead to a conclusion about what matters and would do most damage to your business

**Distillery fire MerseysideBP fire Bay of Mexico

**Carry Out a RISK ASSESSMENTList the top 10 to 15 RisksDetermine Major Ones using this matrix

LIKELIHOOD

1) remote (< 10%)

2) possible (10 - 50%)

3) likely (> 50%)

IMPACT

3) critical

2) major

1) manageable

CRITICAL

(A) low

(B) low

(C) low

(D) medium

(E) medium

(F) medium

(G) high

(I)

(H) high

Business Risk Profile

** F

A C T

SThe way of working using the FACTS processThe TOOLS - Crisis Manuals + crisis teamCRISIS SIMULATIONS AND ISSUE RESOLUTION

LIKELIHOOD

1) remote (< 10%)

2) possible (10 - 50%)

3) likely (> 50%)

IMPACT

3) critical

2) major

1) manageable

CRITICAL

(A) low

(B) low

(C) low

(D) medium

(E) medium

(F) medium

(G) high

(I)

(H) high

Business Risk Profile

**THE FACTS PROCESSF Establish the Facts take the hearsay outA Assess the Risks and Identify Actions ( use risk assessment)C Communicate the Plans and determine the Costs and Insurance. Develop the communications planT Establish the Time PressuresS Prepare Summary for Due Diligence

**Escalation ProcessDetermine whether Class I, Class II or Class III Class I is High Risk , Class III is Low risk, by determining :-The type of hazardThe level of disruptionWhether it can be resolved internally or more global issueIs there media interest, National issue or globalHow much damage to the brand equityWho should be involved and at what level throughout the business

Follow the FACTS process

There is a clear Crisis Team structure which has specific roles and responsibilities, contact methods and crisis room requirementsEach person has a role that needs to be understood in a crisis situationUnderstand the FACTS process and Escalation process and feel capable of using it in a crisis

**The TOOLS and the Crisis Manual

**Risk and Opportunities Categories

Business Environment Risks : Economic or industrial conditions, political environment, social trends, natural catastrophesOperational Risks: Brands, product availability, quality and safety, intellectual property, retention of core equity, legislation / regulation, litigation, procurement, production, logistics management, distribution, product tampering / counterfeit, NPD, environmental, health & safety, sales optimisation, human resources utilisation, management information and decision making, third party and JVs, business interruption.Strategic Risk : Strategic direction, organisational structure, strategic alignment of the operational plans, innovation, strategic executionFinancial Risk : Financial markets, commodity costs, credit, funds management, intellectual property, fraud and illegal acts, tax managementCompliance Risk : Legislation and regulations, supply chain, demand, tax legislation, litigation,

Processes that are effective , implemented and well managedTrained responsible staffclear procedures and instructions that are audited to determine compliance and allow improvement

**

Good morning. To complete this first half of the morning I would just like us to consider risks a little more generally and look at risks in a broader sense and in particular how as individuals we perceive risks and then by understanding and using a few tools, how we may be able to manage risks a little better.

*Benjamin Disraeli is quoted as saying What we anticipated seldom occurs and what we least expected generally happens

One summer holidays, when I was a boy I was helping my dad get the car ready to go on our annual 2 weeks to the coast where I was so looking forward to my daily ice cream cornet and building a bigger sand castle than my brother. In those days our car wasnt a new car and so it needed to be checked out before we went on any long journey this usually meant mechanics were involved The week before, the spark plugs and the oil were changed at the local garage and the mechanics tuned the engine. I remember the evening before we were due to go I was really excited and me and my dad did the final checks to make sure all the lights worked, hand brake, cables, oil up to the mark, tyre pressures and treads checked. We washed and polished the car and put it away in the garage. The car was ready and we were looking forward to a great drive over to the sea side. Hassle free, no car problems, no fear of break down and therefore a calm and happy dad and therefore a calm and happy mum.

That night a thunderstorm struck and a large old sycamore tree on the edge of our garden was split open and half of it fell straight onto our garage.

Mmmh never did get my daily ice creams that year or build a bigger sand castle*My dad hadn't expected that to happen. Of course he hadn't. He had focused, quite sensibly on what he thought was going to be the biggest risk whether our old car was going to get us the few hundred miles to the coast and our holiday.But what he least expected to happen did happen. And that is the essence of understanding and managing risks

In a business context managing risks through risk assessment objectives now perhaps makes more sense.

We need to enhance the ability of the business to deliver an objective by ensuring that the level of risk involved is appropriate

And we can achieve this by identifying the risks that threaten the delivery of the objectivePrioritise so that the focus is on managing the risks that are unacceptably highDevelop plans to mitigate these risksIdentify areas outside of management controlAnd finally develop plans to exploit any opportunities that should arise.*I would just like to see if we can establish the level and type of risk culture in the room today with you all.Are you willing to carry out a little test ?It wont hurt and you dont have to join in but .

There is a little matrix that helps us understand what type of risk takers we are.This matrix has four general groupsI would just like to know what sort of risk aware culture there is hereThere are Settlers. Pioneers, Gophers and Cowboys.As each one comes up just write down which one you think you are

(click slide change)Settlers know that there are risks out there but they dont want to chance anythingPioneers - on the other hand - understand the risks and they take chances BUT they always try to stay in controlGophers Dont know what's out there and don't care either because they stay well underground where its nice and safe.Finally the Cowboys they do what they feel like and to hell with the consequences and so dont think or perhaps care about the risks

So how many Settlers, how many Pioneers Gophers and Cowboys. ( count and feedback)(Click on next ) Here you will see whether you tend to be risk aware, a risk taker, risk oblivious or risk averse*Now lets think about our own industry culture with regard to risks.

In the food and drinks industry, when we think of risks, we usually only consider the risks associated with products that we have had to recall and perhaps the way that we managed the crisis that surrounded the recall*Hopefully, we are also all aware of the risks associated with health and safety, occupational health as well as the risks regarding poorly managed food safety and our HACCP programmes*But I find that having worked in corporate governance and risk management globally for over a decade, I still find food and beverage companies everywhere, both big and small, FMGs and SMEs, who are unaware of all the other risks that could seriously damage either their business, reputations, brands or people.*These risks are not necessarily the same across the food and drinks industry. They vary according to the type of manufacturing processes, for sure. But they also vary according to management awareness and capability, location, regional issues, process controls and so on.*Now most of these images that you have just seen here are health and safety related risks and are quite extreme aren't they aren't they ???????We cant live our lives without taking risks but being risk aware is far more sensible than being risk averse.*What do you think the biggest risk to a human being is ?Who thinks water is a risk ?Who thinks that the lack of water is the biggest risk ?Who thinks that too much water is the biggest risk well it could be if we could drown in it (Hold bottle of water.) This is the one thing that can sustain life . Without it we die and yet it can also kill us.

Paracelsus wrote in the 16th century that All things are poison and nothing is without poison, only the dose permits something not to be poisonous

And so it is with risks. Life is not without risks and all risks are potentially damaging and poisonous. But depending on the size , the impact of the risk and the chance or likelihood of the risk happening, determines how critical or how poisonous it could be.*Risk means different things to different people. Hence many of us are happy to drive above the speed limit from time to time, ignoring the reasoned, calculated risk assessment that has been made by transport engineers. Similarly, plenty of people are happy to smoke but wont eat the cancer causing foods that have been exposed by the latest sensational headlines.So in our daily lives we juggle risk inconsistently, either through ignorance or a willingness to accept the odds even if they are not in our favour.

A business cannot be quite so cavalier. It needs to first understand and then as far as possible, control the factors that might damage its business, giving priority to the areas of greatest risk. So whilst it might appear that an explosion and fire might be the biggest risk to a distillerys business continuity, that may not be true. The poorly trained operator, the incompetent engineers or the disastrous supplier might actually be a far greater risk - in practice.*It is hard to assess and quantify a risk. That does not make risk assessment a pointless exercise. There are a variety of ways in which a risk assessment might be made and recorded, but the aim should be to reach a conclusion about which matters, if left uncontrolled, would be most likely to prove most damaging to the business.*Managing risks and having good processes in place doesnt mean that things cant go wrong. Even some of the best companies in the world who pride themselves on having first class risk management and business continuity programmes in place can and have had disasters. Remember BP oil rigs in the Bay of Mexico, Distillery fires in Liverpool.Not forgetting the natural disasters from hurricanes to tsunamis

But by assessing the these risks and determining the criticality, developing and implementing mitigation plans, the risks can at least be reduced and made manageable but ignore risks or fail to recognise how critical they are or put in poor mitigation and you may well end up with huge problems*So lets look briefly at a simple understanding about managing our risks.

Here is a basic risk assessment matrix, which can easily be used to determine any and all the potential risks across your business or site. Its easy because its based on subjective assessments of the risks but using your own internal skilled people who do really understand what the potential problems are if only you ask them. Using this tool you can then determine the impact of those risks and the likelihood of them occurring and work out which ones are the most critical. Initially only look at the top 10 to 15 risks and go and put in mitigation plans, reduce those risks to a manageable level then you can work on the next 15 that will immerge.*Because most of the food and drinks industry do associate risks with recalls and crisis management I will just show you this the link between how risk management sits with these processes. These are the sorts of links between your risk assessment matrix and the mitigation plans that are developed from them and by using tools such as the FACTS process and your own crisis manuals and crisis management teams you can more easily manage the crisis to a sensible and acceptable conclusion. Dont forget the more simulations you do the better you will manage your real crisis.*With your risk assessment completed you can use this facts process that will help you.Establish the facts, assess the risks and identify the actions required. Communicate the plans that are developed and determine costsUnderstand and establish the time frames and pressuresAfterwards ensure you develop a clear summary for DD*As the crisis develops you will need a clear escalation process.What is the level of risk, the type of hazard, the level of disruption expected.Can you resolve the crisis internally or not. How and who will work with the media on PR. How much damage to the brand is likely follow the FACST process *Using your crisis team who must have clear roles and responsibilities in a dedicated crisis room, use your pre written and tested crisis manual, understand and use the FACTS and escalation processes*So we have discussed risks in a more general way and I hope that in this very short time I have been able to expand the risk horizons. Before I finish perhaps we can just consider some of the other risk areas. Here is a chart showing some of the risk and opportunity categories. Like the risks associated with business environment, operations, strategy, compliance and of course financial.Quality, food safety and therefore recall and crisis management all sit within the operational category, but there are so many other areas to consider and all of them capable of doing immense damage to your brands, assets, people and company.*A final thoughtwith all processes. To ensure that they are effective. Implemented and well managed they need one or two final requirements.They all need to have trained responsible people and clear procedures and instructions that can be audited to ensure compliance and make improvements.And that is where the rest of the day comes in

Thank you*