Risk: What It Really Means and Why It's Costing You Work

Jon Wragg

Hello everybody and welcome to this month's webinar and for those that don't know me, I am Jon and I am co-founder of Ltt Group and every month we're trying to host a webinar with a particular topic and getting two specialists around that topic and go from there really.

These sessions are recorded so if you have to drop off because we know everybody's busy for the full hour, you will receive the link via our YouTube channel on where to receive this and then going forward, please if you see us on LinkedIn or you see anything around these and you want to join any more or there's follow-up discussions, please feel free to follow up with us and get in touch. So this month's webinar is entitled something very simple as far as I'm concerned, it's around one word and that word is risk but it's what it really means and why it's costing you work.

So whether that is through commercial work or other avenues, it is ultimately about what it's costing you and what we can do about that and going forward. The good thing about the word risk is actually there are three people who are talking on this call and I will try and do as little talking as possible apart from this intro, is we all see risk through a slightly different lens due to our work and also everything that we've done in our background. So myself, my background is corporate sustainability mainly in the supply chain and tender world so when I talk about risk and I'll come on to this a little bit more in detail, I talk about risk from a commercial angle.

By not doing something, whether that is carbon calculation, a certain accreditation or actually displaying and talking about it correctly, you could be actually risking commercial work down that line because you are not winning tenders, you're not scoring highly in tenders in that particular section. So when I talk about risk, it's that side of it. There's also the other slight side of it, like if you're purchasing risk and looking down your supply chain but obviously there's people that are far more specialist in that area than me and we'll talk a little bit about that as well.

So today is made up of three of us and there'll be three of us talking, so there's myself, there's Robert Clark who I'll let introduce himself in a minute and Mitzi Danielson-Kaslick who I will let as well introduce herself. So first of all I will pass over to Mitzi to give herself a brief intro and go from there.

Mitzi Danielson-Kaslick

So thank you so much for having me. So I'm Mitzi Danielson-Kaslick and I run VERITAS which is a consultancy specialising in risk governance and compliance. Alongside that I'm also a volunteer for the Home Office and I'm the correspondent for human trafficking on the Isle of Man.

Jon Wragg

Thank you Mitzi and welcome, it's a pleasure to have you. Robert, so introduce yourself.

Robert Clark

Afternoon everybody, my name is Robert Clark. Thanks again for having me on this forum, looking forward to it very much. My background is in banking so I'm going to be talking about risk from a financial perspective.

I have just newly retired within the last year but I had a 37-year career in various banks, finishing up in a Chinese bank which was the most interesting of all. So I look forward to discussing the topics today.

Jon Wragg

Thank you very much and for those of you that this is the first webinar that you've joined at an Ltt webinar, I'll just give you a little brief idea of how we run them.

It is not a panel, we have a guide of questions, it is a fireside chat and my whole point of these and whether it's this topic or other topics that we've talked about it is really, actually there tends to be many different opinions of how this works for businesses and being part of that and whether you are a large corporate, whether you are an institution, whether you're a large organisation, NHS local government or whether you are a small business on the supply chain, the things that we're going to talk about today and risk in particular could be of interest to you and it could actually show you why you're being asked certain questions, whether it's about sustainability, financial audits in supply chain.

So like I said we will have a few topics.

So first of all, look, the title of this webinar is risk and what it really means and why it's costing you work. So what I'd like to do is ask us quite a simple question, but I think it's quite a complicated answer for each of us, is, and we'll come to you first Mitzi, is when you talk about risk and you mention that word and how you talk about it, what do you specifically mean by risk? And first of all we'll come to you and then Robert, I'll ask you the same question.

So Mitzi, please go ahead.

Mitzi Danielson-Kaslick

So I think whenever we're talking about risk in my line of work, we're talking about a huge range of things. For the most, some of the most important things, you know, you're looking at the commercial risks, so things like how high risk is a certain decision for a business, and also things a little bit more specialist like money laundering risks, so what are the chances that this client or these funds originate from money laundering.

In my kind of voluntary work, we talk about the human trafficking risk quite a lot more, so I'm quite often invited in when there's been a human trafficking potential identified to then interview and talk through what might have happened. And that situation, we're talking about the risk that somebody has been trafficked or even will, will be re-trafficked, which is an issue too.

Jon Wragg

Yeah, okay. I mean, that's really interesting. I think the more transparent supply chains need to be, whether that, and from a sustainability angle, people often overlooked the, the people element of supply chains. People tend to focus on the product or the business, but actually people are a huge element of supply chains, and people are a huge element of a pretty small business supply chains.

And just on that, way you touched on it, a, I was made aware of quite recently, in the realms of modern slavery. I have always been part of a business that has had a modern slavery policy. However, I have also until very recently been very guilty of having one and not really understanding everything that needs to be involved in it, that's either been a compliance or whatever. And I was, um, shocked to hear that, um, the city that I live in, Sheffield, is, Sheffield is one of the worst places in Europe for modern slavery. And the reason for that is, is quite simply, we have a lot of small businesses and we have a high majority of areas where slavery and modern slavery is, is quite prominent.

What's your take on that with regards to how small businesses and large businesses as well, how they can really, apart from just asking for a modern slavery policy, which we all know sometimes is a little bit weaker than it is or copied from a website, how can we maybe delve a bit deeper? Are there accreditations? Is it something that we should really be asking for? What makes a good business, let's say, before I come to Robert?

Mitzi Danielson-Kaslick

So I think, um, firstly, yeah, I totally agree with you with the modern slavery policies. Um, I, it's lovely that people have them. It's not something I particularly advocate for. Um, I don't, I don't particularly see what something on your website is going to do if I'm not doing the work behind that.

And so what I would say is it's really about a logical understanding of how is this product or service this price? Who is actually performing it? You know, who is making the product, who is providing service, um, and are they being paid a fair, reasonable and legal wage with legal and reasonable conditions attached?

So for example, if you are, um, a medium-sized office, um, and you're looking to contract a cleaning company to clean your office, which pretty much every office does, um, then I would be saying understand how much the actual cleaners are being paid per hour and whether they're here legally and whether they are being held in reasonable conditions.

Jon Wragg

I mean, that's a, thank you very much, that's a very valid example. I think there's lots of people in the sustainability, sustainability industry that are actually targeting facilities management companies to help them with their carbon, but I'm not 100% sure that all of the sustainability people out there are looking specifically at their employability for their secondary services, especially the cleaning companies and things like that. Um, and that's a good thing.

I've always grown up in a world where the saying, um, buy cheap, buy twice has always been relevant. Um, but I also think that as small businesses are under increasing pressure to hold on to their margins and try and keep what they're buying down to a minimum, I do also think it's very prevalent and accurate to say that if something is cheap, that sometimes it's too good to be true. Um, and, and cheapest isn't necessarily best. There are good examples where prices are low and, and everything's correct, but sometimes if it screams that it sounds too good to be true, especially on pricing, there's something behind that, there's something that's not right, let's say.

Um, Robert, if it's all right, I'll come to you with the question. Obviously you've had a long standing career of looking at risk through a financial lens. Um, but also, um, you've seen a lot of changes, and not because of your longstandings career, but over the recent terms. What do you mean when you talk about risk, and when you look at, especially when you look at businesses, what, what are you looking at for risk?

Robert Clark

Well, as chief risk officer, which is what I was for the last 10 years, I worked for a large Chinese bank, ICBC, um, largest bank in the world that nobody's heard of. Um, a, by the time I left, I think there were 22 different risk types, um, right across the board. And I would say, um, they've sort of evolved over the years, um, from the traditional types. Where I came in, it's like credit risk, so obviously working in a bank, you know, you want to work out whether you're going to get your money back and where you're taking your risks there, market risk, operational risk.

But, um, latterly it evolved and, um, into the areas like, like we're interested in, particularly ESG. So, um, and sometimes they categorise them in financial risk and non-financial risk, but in my mind I think about them all as financial risk ultimately, because even something like a, um, a reputational risk can crystallise into financial losses. Um, so, um, but generally speaking, we ask the question, what is risk? It's the uncertainty, um, arising from, um, a exposure to danger or harm or, or uncertainty, and how we manage the risk is. But for practical purposes, for SMEs, we're talking about how you manage financial risks, the risks that, um, affect objectives.

So, um, I could talk about this ad infinitum, but I'll just pause there, except to say maybe the big themes that I found when I was answering all these questions, Jon, is, um, there's more focus today on economic sustainability for businesses, coupled to operational resilience and business continuity. Um, but we can, we can try and then work, work that in later, or like maybe explain a bit more what I mean, but I'm conscious we're on a time deadline.

Jon Wragg

Yeah, no, no, I mean we are on time, and I think the three things that you've just touched on there could be an hour's talk on their own. And I think when we're talking about the economic advantages and the link to environmental, whether that's climate change risk and everything else as well, I am very aware personally that, um, high street banks, and obviously you work for the, and just said itself, the biggest bank in the world that nobody's ever heard of, um, because people tend not to have a debit card with those guys, um, but the high street banks are now looking at risk in a different guise when it comes to business risk. May not, maybe not consumer and personal banking, but especially when it comes to, um, business banking as well.

Obviously HSBC has been very vocal in this area and talked about certain accreditations and certain realms of sustainability will give you preferential treatment. It will give you better, um, it will give you better lending criteria, it will give you, make sure you pay less interest in certain areas, because they can actually give you preferential rates very simply because there's a risk indicator. Because you have something like EcoVadis in HSBC's case that shows them, it very simple, why you're not a risk, and therefore they don't have to give you a, as a greater, um, interest rate and therefore risk. And these are the things to do with that, and green lending and things like that.

But that's also good when you're talking about operational risk. I mean, I've got a bit of time on this question alone. Talk to me about what you mean by operational risk really, and what a finance institution, when looking at a small business particularly, what do you mean by operational risks?

Robert Clark

Well, the simplest form means a risk arising from people, processes and systems, and, and how that, that can bleed into other kinds of risks. So it's like somebody can make a mistake in a lending assessment, for example, and that turns into a long-term loss, you know, so the lines are blurred. But people, processes and systems. So operational, another form, operational risk might be a power outage or an internet failure, or, you know, it takes, it takes a while to get your systems up and running, so it's a cost for your business and it's an embarrassment and that kind of thing.

But operational risk is developing and is widening now. All the operational risk people now are finding they have to be more expert in operational resilience and business continuity, which are slightly different concepts. Operational resilience is, but what a business continuity, I would say, is more internally focused. It's about how, how would we keep the processes or shop door open when, when something goes wrong, where we're fixing the problems. There's, operational resilience is a bit wider. It's like, assumes that something will go wrong, work backwards from there and put in place all the systems to try and make the business resilient. And it's more overarching, and operational resilience would include like your third parties, your vendors or whatever, you know. And so the operational risk in the traditional sense is transitioning into something a bit broader, and yeah, that actually...

Jon Wragg

I'm sorry to cut you off there. It's, no, and like I said, I think Mitzi as well, I think, but, and we're only on the first question here, risk is complicated, okay? And what's meant by risk is complicated with all three of us. When we mentioned risk, whether that's on social media and blogs or interviews or whatever we're talking about here right now, and we are all coming in from a slightly different lens.

But, and I will always, because a, beyond passion, obviously it's the career and everything else I've chosen, but there's few risks right now, and especially operational efficiency with regards to climate change, and where that is, obviously the, the heat wave. But whether you want to blame El Nino or whatever, they're becoming more frequent. There were businesses closed from that. We're about to go through another one, as far as I'm concerned, so there could be the best part of five to six days shut down for some businesses in the UK in one month, or at least over a 60 day period, and those months cross over.

If that's going to happen more often, I know that insurance companies, I know that lenders, I know that things like that, I've got to take that into account with risk as well, because there are lots of businesses out there that just aren't considering it. They're not there. And the issue with small businesses is, because the climate they're in, they are not doing three to five to ten year forecasts and doing risk from that side of it, because they're looking more short-term. They're often looking right now three to six months because of the, the financial risk and the economic climate as we are right now. They can't look too much at the climate change resilience, and then they're not doing that work because they don't come under legislation. So there's lots of risk there from my point of view.

And, and really that, I guess that comes into my next question, which actually means, if it's all right, I'll come to Robert first, because I think it leans into his answer on the last one, is risk has changed. Risk has changed and it is ever-changing. Obviously you just said there, Robert, that there's over 20 things right now with regards to the Chinese world. Yes, yeah, and that's just in the Chinese world of what's deemed as risk. And I, for not wanting to put words in your mouth, I assume that there are increased numbers, whether that is UK or European or American lending and things like that, those numbers slightly change in what they deem as risk.

But how have you seen this change, I'd say, over recent years? I'd say the past 10, maybe even five years, where are you seeing the focus? Bearing in mind, credit is credit. We understand credit. I think a lot of us have a credit score, and businesses work very similar, whether it's good or bad or whatever. I think a lot of us sort of understand that. I think how would you say that risk has changed in recent years, and what is, especially financial institutions, and looking at...

Robert Clark

Yeah, and I can keep it quite, quite high level. And I think biggest changes are, risk management has changed from being sort of backward looking, a box ticking compliance function, to being a more proactive and strategic discipline. They talk, they use expressions like being a risk partner or risk navigator, basically the idea being that the real role of the risk function is to support safe and sustainable business, however you define stability.

And the concept, secondly, and the concept of enterprise risk management is all encompassing, and so they're trying to look at all the kinds of risks, and that means that the risk universe, what we consider to be risk categories, has expanded and greatly in scope. Sometimes that's because of the, the world has changed, and sometimes because there's a regulatory push. And for example, and credit risk is the traditional risk category, but now we're also looking at through the, the perspective climate risk. We look at climate risk, how it translates in the financial risk, and they talk about transmission mechanisms.

So the push was from the regulators to, to look at climate risk, and the UK were sort of forward and ahead of the pack, you know, quite leaders globally. So from about 2019, the Prudential Regulation Authority, which is one of the two big regulators in the UK, was pressurising banks and insurers to raise their game on climate risk, but it was always entitled the financial related climate risk.

And so it's proactive, it's ERMs all encompassing, the scope has increased. We're encouraged more to look at correlations between risk categories, which historically have not been brilliant at doing, like, so as I mentioned, like how does climate risk translate into credit risk, could translate into other kinds of risk, with reputational risk. But the one I probably want to emphasise a bit is the big changes on scenario analysis, stress test and contingency plan. And I think this is relevant to all kinds of businesses, SMEs or whatever. It's about asking the what if questions, and the key phrase I often used was challenging but plausible scenarios. Challenging but plausible.

You know, there are a lot of risks out there, but they're not all, I think you've mentioned the other day, Jon, not all risks are relevant to every business, so it's zeroing in on the risks that are relevant to you. Because for businesses that want to be bankable, there's a misconception that banks want to only lend to a risk-free businesses, but no, what they want is evidence that the businesses are aware of the risks they're facing and that they're managing them. Bankers are quite simple creatures at heart. We want to have proof and evidence if we, if something goes wrong in the future, you know, that we've ticked all the boxes.

Mitzi mentioned due diligence on her side. If you were asking questions about modern slavery, the same idea with something like ESG, you want to be able to demonstrate that the business is doing what it's saying it's doing, you know. So I'll pause at that point.

Jon Wragg

Yeah, yeah, no, I mean, thank you once again. Once again, thank you for, you've just leaned into asking the same question to Mitzi there. I was doing your work with the Foreign Office. I mean, Robert just said then that bankers are quite simple creatures at heart. The Foreign Office is not, right?

So, and also, if anything, it's quite bureaucratic, which is not as simple at heart. And, and especially your work with slavery, and especially cross borders and things like that, how and why have you seen that change over recent times? Is it legislation led or is it something else? And if so, have you got any examples of where that's really changed and where it's now far stronger and far better than it was before?

Mitzi Danielson-Kaslick

So I think I definitely have seen a shift. So one of the biggest shifts, for example, is that my role with the Home Office didn't exist three years ago, so it simply wasn't something they had. It came about because when they were originally having more and more small boats arriving across the Channel, a lot of people started to say they had been trafficked or at risk of trafficking, and that was one of the reasons there was quite a big backlog of people staying in hotels, because there were enough people competent to assess that, because it takes quite a long time, and as you can imagine.

I would say one of the biggest pushes I've seen, and in all of my work, is that we're starting to understand that nothing is ever no risk, and, and that's, and that's really critical. So I always say to my, to my clients, and don't use the term no risk, because it's not true. Everything is on the risk spectrum, and it's where it falls and whether you're okay with that. Yeah.

So, um, just to talk from what Robert was saying about banking, and so a lot of my clients are come to me because they've hit a brick wall with getting a bank account, and for whatever reason. And it's, it is very interesting to communicate with, with banks and kind of other financial institutions around risk tolerance, so where we're talking about, um, what is their risk appetite, what things do they consider to be too high risk to deal with. And a big shift I've seen, sorry, sorry.

Jon Wragg

No, I was saying that's interesting.

Mitzi Danielson-Kaslick

Sorry. Yeah, a big, a big shift I've seen there is that a lot of places are moving away from the, what you call black and white risk spectrum, so saying this is a yes, this is a no, moving into, for example, with things like crypto, which are very linked in cases to human trafficking, and where banks have moved from saying categorically no, not ever, to tell me more. And it's that tell me more, thinking about the due diligence, and we're thinking about providing enough information that things can be fully assessed. And that's the big shift I've seen, moving from a yes no approach to we're going to gather information to view the holistic risk and then holistically see whether it's within the risk appetite.

Robert Clark

Yes. Well, in credit committees, we would, we wouldn't just talk about like credit risk, for example, because it's obvious if you're talking about a business that they're facing more than just the, the, the credit risk is not the only consideration, you know. There are many reasons why they might not be able to pay the money back.

Jon Wragg

And I think when you're talking about risk, and I think when, when all three of us, and, and obviously lots and lots of experts out there who sit in risk categories and risk assessment, and there's also health and safety, which is absolutely massive on risk spectrum as well. There's also operational risk and Six Sigma specialists and lean optimisation specialist as well, and that's risk. There's now more than ever cyber security and AI and risks at that, and obviously business risks associated to that. There are actually, there are forms of risk in almost every form of consultancy as such, and we're all talking about it.

And I could have had maybe 10 other specialists from different areas that would have created a very Question Time style messy conversation with a lot of cross-talking, so maybe that's one for the future. And I think that one of the things of this is, um, and I've had a lot of emails about this leading up to this, is, is actually risk crosses over so many boundaries, and the questions are, why haven't you got this person on? Well, quite frankly, I, I either don't know them or I didn't know of their work, so it may be another topic to talk more about risk and how that crosses over.

I think with that, um, you, uh, just talked, Robert, you just talked about that, and obviously, um, it's, you talked about as well, I think risk is moving from quite a very siloed thing in siloed different departments to now, especially if you're looking at large businesses and institutions looking down either their supply chain, or in banking institutes looking at their banking clients. When they're looking at a risk as such, it now is no longer siloed. It tends to be this kind of messy middle of a Venn diagram or whatever, and you've kind of got policy, commerciality, assessment, compliance, all these kind of things within a company or an organisation all looking at risk and, and seeing a risk assessment.

How can small businesses, obviously we're a startup, we, we are a risk at the beginning because we have nothing to, to back it up, but how can small business, especially established small businesses, really make sure that they are being highlighted to all of those areas and kind of moving with the times really? Uh, Mitzi, obviously you talk about yourself first, but how can they make sure that they are covering the right basis on these things and making sure that they're, they're not just going missing in that messy middle area, and of that, those cross bodies?

Mitzi Danielson-Kaslick

So I think the first point there is that increasingly, horizon scanning is becoming really important. And what that means is that increasingly it's a priority for businesses, or at least it should be, um, to be looking for what those emerging risks are. So the risks that are, I have a friend in the military and he describes those risks as unknown risk, the risks that we sort of know about, the, we don't know enough about yet. They're not here yet.

And that's the thing, it's not, to me, that's kind of a lot of what I say to my clients. You never have a full picture at any given time of exactly what your risks are, and that's, I know, quite an unpopular statement. It's quite an uncomfortable statement. Everybody would like to think that we complete picture of our risk and we've mitigated it really, really well. And you can mitigate really, really well with what you know about, and it's then putting, put play in place mitigations for the things that you don't know about quite so well.

So, um, quite an example I had of this recently was that, so I've got the contract for doing the training for digital asset foundations, um, on the Isle of Man, and a year ago nobody heard of them. That was, that was not a thing. And what they're all about is about helping companies protect their data so that it can be put separate from the company. So if something happens, like the company goes bust, that data is then retained, so it's in a separate structure, almost like IP, but a little bit more simple.

Um, and that's not a risk people had really considered. And often when I talk to people about, oh well, what will you do if all your data goes because you lose your company or whatever, what will you do if your systems are attacked and you lose all of your data, even while keeping the company, where else is it, you know? And people are like, that's not something we've ever really thought of. But it's definitely a risk, particularly as data becomes more and more valuable. You know, we're thinking about how much business is done online, and sort of leading back to our point about operational resilience, you know, that's, that's a key point that nobody, nobody thought of.

So when we're thinking of horizon scanning, I'd say that's the best way to keep up to date with what your risks are most likely to be, and then contextualising it within what you know about your own business. So it's all well and good to find a statement about money laundering risk. Okay, so, um, it's considered that one out of every hundred thousand accounts in the UK have been taken over by a criminal and is used for laundering. Okay, um, but how does that matter to your business?

Jon Wragg

Okay, that's, that's really interesting. Uh, and especially the, the example that you just gave. Um, I, I assume a lot of that came to the forefront really with what happened with Jaguar Land Rover and M&S, for example. All of a sudden you find out that it's not the big businesses that were at risk, because they had their procedures in place. It was a supplier, and in one of the cases a supplier of a supplier of a, um, and things can come to a standstill quite simply in a very large and well-organised and well-structured enterprise, in, in some of those cases.

Um, Robert, when, when you're talking about that, and, and as I just asked Mitzi, how do you see the banks now actually not being a silo? Yes, you've got legislation, and we'll talk about that in a second, but not being a siloed in themselves. And, and how do you think also that could be probably better improved slightly with regards to that? It's that messy middle, and making sure small businesses don't go missing in that messy middle really.

Robert Clark

Um, yeah. Well, when I think about the messy middle, I read it as the space where policy meets commercial reality meets risk management. And that, that bit in the middle, to me, it was just another way of saying the risk reward balance, which is something the bank has always sort of grappled with since, since the dawn of time.

Um, so, um, Mitzi mentioned horizon scanning, looking for new risk. Basically the process is, is identify the risks. I mean, I love that, that known, known knowns, known unknowns. That's Donald Rumsfeld, always makes me smile, because such a slagging for a time, but it's actually kind of profound, you know. And that's kind of at the heart of risk management, you know. It's quite good to, you've got to identify the risks, then assess them or analyse them, and then a, monitor and manage them, and rinse and repeat.

Um, but to try and answer your question more, more directly, um, a, the messy middle, you can, you can be dealt with by, um, trying to translate the, the high level policies into business as usual. That's when it brings out the, the sort of issues, um, like is it aligned with commercial reality, um, um, as it, um, actually focussing on the material issues. Like, um, I think Mitzi alluded to, there's a lot of risks out there, but there might be one in one thousand chances, sort of, um, a, being a, being an issue for your business.

So, um, you assess, you identify the risks, assess their materiality, um, and then roll out proportionate risk controls. And that's a, proportion as a word that a lot of risk managers use. It means that, you know, you don't want to kill the business essentially by having too many controls, you know. It's like, um, that would, that would be self-defeating. Um, so I don't know if I've answered your question as directly.

Jon Wragg

It's complicated, so you, so you have. But I think, and there are, I think, just slightly translate it. I think the world has very quickly moved from policies, but just having policies sake in many cases, into policies, actions and then rewards as well, and being evidenced that. And I think there is a small part to play for, for something that obviously I'm very passionate about, which is EcoVadis, and that's ultimately what they score on.

And the more that they get entrenched into the banking sector, the more that they get entrenched into large business and supply chains, that whole policy, action and reward way of looking at things is actually, it's no longer great, because you can see it quite clearly scored. You can see it scored against your peers, you can see it's industry scored. And actually now that most of the major high street banks have now rolled out EcoVadis into their supply chain, and some are now giving EcoVadis into and saying that you get preferential banking treatment, many of the large businesses out there have rolled out EcoVadis over the past 12 months, um, not just for small businesses but across everything.

And that's how purchasing, sustainability, risk identification, um, also compliance teams are now identifying risk for those, whether that is brand risk, whether that is marketing risk, whether that is purchasing risk or sustainability risk as well, because of legislation. And EcoVadis is just one example. It's just one that obviously I'm very close to right now, so I understand it more, far more than I do of your world, um, because I'm not really part of those.

So I, I think risk is huge, but I also think that risk aversion is becoming a little bit more, um, not transparent, but it's becoming a more transactional. People are starting to understand that to show that you are not a risk, you can't just say we've got this policy in place. It's kind of, we've got this in policy in place, um, and there's a great friend of mine, Alan Brown, who always says, if you're going to say something, always follow it, whether it's a tender writing or an award or whatever, always follow it with the three words, which means what.

So if you're going to attach a policy to something, or if somebody asks you a question, you go, we've got this policy. What you now mean to do is go, which means what to you, and why that means that we're no longer a risk. Yes, we have a policy, but look at the actions that we do from this policy, environmental, cyber risk, whatever, whatever is modern slavery. Look what we do, and then look how we manage that and who's in charge of it. That, those are the kind of the way that business is going, and it seemed to have moved incredibly quickly on that. It seems to have forever and a day things have been done, past two years it's now gone into this, and it's only getting stronger, and hence why it's now going down the supply chain of small businesses.

And that leads on to really, really my final point before we start to run out of time, is, is, look, in my, and this is my opinion, and look, my opinion to some people means something, some people it means nothing, and my opinion is my opinion, but I see small businesses at the ones, and what I mean by small business, and I think that's also a term that I am also guilty of overusing, especially the three layers of SME, and what I mean by that, sometimes I don't really put a definition to that because it's a really broad spectrum. But when I say small businesses, I'm going to say the ones that are founder operated or family run, or have started something and it's grown, and they're looking for either an exit now or a merger or an acquisition, or what that is for their next growth policy. I see that they are the ones who are most at risk from ever-changing legislation that they don't come under, but they're now being forced to sort of understand because of questionnaires that have been sent their way.

And climate, and, and like I said, we touched on that earlier, there are many businesses in South Yorkshire that closed and have been closed for up to four days in June and will close for a three to four to five days in July based on the heat wave, because we're just not equipped for it in this country. If that's only going to get worse, and we're in the centre of the country, we're not, we're landlocked basically, we're not affected by tides, we're not affected by the water so much, and where they sit on the supply chain is a risk. If they become too much of risk, at what point do your industries look at those and tell your bigger clients, don't buy from those?

Because I'm saying it from a sustainable point of view, but what influence does, Rob, I'll come to you first, what influence does the banking industry have on its large commercial clients to say, look, if you continue to look at this supply chain the way that you do now, that's a real risk for you, we can't work with you anymore? Because I know HSBC do that, but are you aware of things like that?

Robert Clark

Absolutely. And, and this, this, what you're describing is looking at below the surface, at end to end, it's a supply chains, and who their key dependencies are. The overall, the overarching theme is looking at your third party dependencies, and banks have to do it, and they've got, they've got third party dependencies. So yeah, that's, again, it's this holistic thing.

So our banks look at looking at customers in this way? Yes. So they want evidence that they, they are managing their ESG risks, and even if they've not completed all the actions, a few actions, as they say, is worth a whole load of policies and fine words, you know. They want to see evidence that it's happening. So if we're looking at something in a credit committee, and typically it would be a large, a large company, but the principle applies, you want to see what they're doing, and if their transition plan, carbon footprints, as plausible and affordable, as time specific, that kind of thing. And the failure to do these sort of things makes some, makes the business less bankable, frankly. They find it harder or more expensive to raise money.

So, and the reason banks are doing that is because they're coming under pressure, same as every other financial institution, from investors and shareholders and the public and the regulators and God knows who else, you know. And so, and definitely as a case that banks are sort of bearing down on their customers, who in turn must bear down on their suppliers, their customers, etc, so it percolates down. So, you know, even if you're an SME, a lot of the regulation on climate is, might be above you in theory, but in practice it sort of filters down to your level, and you've got to do something about it.

But the good news is for SMEs that there are some good external sources of support, and not all the risks are applicable to them, and they can generally be operationally agile and change quickly. They don't have legacy systems. So there's, there's reasons to be cheerful on that point as well.

Jon Wragg

So, um, I think you, I think we have to be, I think, look, I think this part of this, we're actually, might come across as like maybe doom mongering or negative, and it's actually opposite for me. It's the case of, the more you know, the better you can prepare, and therefore you can look positively about this. Means they just, I'll slightly change the question that I asked Robert there, because it was about finance, with regards to the Foreign Office.

And say you were to find a, um, there was a case of modern slavery there. There will be many small business, yes, there are those that are directly involved in it, and therefore they should be shut down and they should be stopped, obviously, it's organised crime, whatever it is. But at what point does the safeguarding of those people become the problem of the, the business who is buying from them? In the case of a small business, does the Foreign Office have powers to really put pressure on them, or say stop buying or doing this, or in worst case close them down?

Mitzi Danielson-Kaslick

What, what, what I see a lot of is where, um, so a lot of my clients are sort of financial services or adjacent services, things like law firms, um, and there was quite a big, a couple of years ago, with King Gaming, which was an i-gaming provider, um, and it basically turned out that they were deeply involved in human trafficking, some of it known, some of it unknown, um, and that was...

Jon Wragg

Before, before we go on with that, are they being closed down, because you've just named and shamed them on...

Mitzi Danielson-Kaslick

No, no. Yes, by a company, yes.

Jon Wragg

Okay, I'm not about to be sued.

Mitzi Danielson-Kaslick

If you Google. Yeah, it was done in Bloomberg as well.

Jon Wragg

Yeah, okay.

Mitzi Danielson-Kaslick

Um, thank you. So that was kind of when, um, when people really started looking at it and really saying, kind of, at what point is it that the regulated business will be on the hook? Um, so I would say pretty much every business is regulated in some way, you know. Even, for example, a nail salon, um, will be under health and safety rules around doing nails.

And so I would say that one, though, the Home Office, they don't have the power to go and, go and sort of knock you on the head, and, and that comes down to the police. Where, where the Home Office comes in is that they are providing support to police and other services to investigate things that are maybe a little bit outside of scope. So for example, where, where somebody's coming to report crime, and, and the police are interviewing them about that, and it turns out also they seem to be here illegally, during that process, um, but there's some suggestion they may have been trafficked, and then that's where we come in. And so, yeah, it's more kind of that, the broader, the broader thing.

But one of the biggest examples, like lightweight, King Gaming was, so I've actually worked opposite them for quite a long time, and they were heralded as the single biggest private investment on the Isle of Man ever. And they, they bought a piece of land, they were going to invest 70 million and having an office there, and the company that was building that office has now gone bust because they couldn't be paid.

Jon Wragg

Right, okay, okay, okay. So there's literally an inherent risk in that as well, and obviously because, yeah, okay, okay. Um, funny enough, I was at a networking event, uh, yesterday, and, uh, there was a wonderful guest speaker talking about safeguarding. Um, and, uh, she's head of safeguarding for Merlin group, who obviously have a lot of names. She was very positive about their work. However, because of their, uh, constantly surrounded by the public, and unfortunately they have a duty of care, and you'd never think that actually a theme park directly has a duty of care. If a member of staff sees something that they think shouldn't be right, and if they don't raise that, there's real risk to that group, and brand risk as well, coming out in papers, and there's lots of things like that.

What I will, um, okay, look, we can, we can talk about this for a long time. I said that we would set some time for questions.

So, so one of the questions that I have had, um, but they also, um, come in before this, was, um, what is the one thing most businesses could do right now to improve how they are perceived through a risk lens? I, I, and I think risk lens is huger, as we've said. Um, they haven't put context around that. Um, I will sing the praises of EcoVadis, obviously, uh, and I sell those services, so I'm just going to sing it. So EcoVadis, you don't have it, EcoVadis is great. Um, but, um, let's, let's come to you on this one first.

Mitzi Danielson-Kaslick

So I would say the single best thing you can do is be actually open and transparent about what the risks you found are and what you're doing about them.

Jon Wragg

Okay, that, well, okay, yeah, that's, that's really good. Thank you for keeping it concise. Uh, Robert, anything from you?

Robert Clark

Yeah, you just, uh, what I was going to say is, technically you call it a risk register. It's a bit about identifying what risk you have, your top five risks. For SMEs, that you could probably narrow it down to about, about five. Then having a plan in place, um, to mitigate the risk, and owners, who's in charge, who's in charge of the risk, and the evidence. Again, back to the evidence, you've been able to prove it, whether it's ESG, what have you done, you know. Words and, no, it's not as valuable as actual actions, even if they are, they're just small actions.

I remember, and it's what Spike Milligan said about a, a,

Jon Wragg

You're showing your age now, Robert.

Robert Clark

No, I know.

Jon Wragg

Mitzi has no idea who Spike Milligan is.

Robert Clark

No, he was an Irish English comedian, and he, he, he once said that one of his, one of his quotations was a, we haven't, we haven't planned anything, so nothing can go wrong. Yeah, you can see that, the logical fallacy. And, but that's not an option for it, for SMEs. That you can, you have, you can start by making a risk register and have a plan off the back of that, even if it's imperfect, and then you've got something to show to the bank, make your business bankable.

Jon Wragg

I, I, that's a nice little segue, because I've got one, I've got one more question. Um, and very simply, um, just make sure I'm reading this correctly, just one, sorry, one sec. Um, yeah, okay. So where does risk sit with regards to an owner? Who should be in charge of risk in a small business?

Now, from a corporate background, I know that there is compliance managers, I know that there are all sorts of things with regards to that. In a small business, it's really hard on where this kind of thing sits. Um, I genuinely believe in, in a top-down approach in these things. Um, I, I don't think it should be somebody's full-time job in a small business, because it is, there's, there's other things that can drive the business. But I do think right at the top they should have a view on this and have an understanding of it. Now, whether they delegate operational work on this, it should be part of a strategy on a small business, and that's, but that's my view. Do either of you have a, an opinion on that, or where it really should sit?

Mitzi Danielson-Kaslick

As, I was going to say something relatively similar. So I'm actually a big advocate for a top-down approach, and I know that in financial services you do have to have a compliance team. And one of the reasons I do what I do professionally as a risk consultant is, I think there is something very valuable about having that external lens. I always say when I meet clients, I don't, whatever it is you've got going on your business, if it's not normal, um, I'm gonna think it's not normal, because I've seen several businesses this week, right?

I think that it's really easy in a top-down approach to become snow blind. So I would say, well, that risk, actually the risk accountability and responsibility sits at the top, and the knowledge and the practicality of that, by all means bringing somebody external to help you as needed.

Jon Wragg

Definitely. Yeah, I, I think there are real, um, specialists in these areas. There's definitely one person on this call who's a guest on this call who I would definitely say is a specialist in risk, and I'll happily call Karen out. So, Karen. Um, and I think with regards to that, I think, um, there's now more help than ever for, uh, small businesses. It's not just an enterprise level. Yes, the Big Four have a place, and, and whatever, but there, there are, there are proper expertise at enterprise level in certain areas, and there to really help businesses go forward, and especially leadership teams in businesses as well, no matter how small. Robert, um, do you agree or do you disagree?

Robert Clark

Broadly agree. I think in small businesses, most of them, I mean, I had to look at some of the statistics, and most of them are very small, you know, so they don't have the luxury to have big risk teams, so it would naturally sit at the top, um, anyway, you know. And if it's financial risk, it's probably going to be, um, in a business like that, it's going to be your treasurer or whatever, that's, they say, well, you're in charge of risk as well, you know.

But, uh, um, when small businesses develop, like any business develop, you might realise that you don't have the in-house skill set, so then you might need, need to go external. The, the key point again is to, to know what your risks are, and to, to know who's responsible for them, and to have it documented. And so, um, yeah, I think it would, it naturally start top down, um, just because of the sheer pressure on, on resources that most SMEs are facing.

Jon Wragg

Yeah, and, and what, one thing, just, just for me, I'm fine on that. The top down approach is all well and good. There is always the case, um, I've seen, um, that sometimes the person at top does tend to bury the head in the sand with certain things like this, is risk compliance, because they're not a specialist, especially if they are a, um, owner, a founder operator, and they've grown their business, uh, naturally. I mean, one, I wouldn't like somebody right now telling me that I was at massive risk, um, as a co-founder, as a startup, but there has to be that conversation.

And I do think that in every area, whether it is risk, whether it is financial, whether it is, uh, modern slavery, whether it is supply chain risk, whether it's accreditations, whatever, my big thing is, there is a real help out there, and asking for help, there, it is stronger to ask for help than just sit there and hope that everything's going to be okay and get better. Because actually things like this tend to be a snowball effect. Things get worse and things get worse and things get worse, and then that's no good for anybody. Uh, and there's real negative impacts on mental health, and real negative impacts on staff, real negative impacts on local economies and economies at scale.

So actually, I, I think the biggest advice I can give anybody is ask for help. Don't assume you know it. I'm quite, we're quite niche in what we offer at Ltt, but, uh, we rely on partners to deliver everything that we deliver, um, quite simply because we cannot deliver it all. We don't claim to know it all, even though obviously, uh, my children may argue that I do claim to know lots of everything, uh, but that's different. Um, but apart from that, we're, none of us know everything. We're all specialists in certain things, um, and apart from that, but, um, there are, there are others.

What I will say is, unfortunately, we're now up to a time. I, I said an hour for this call, we cannot go beyond that. I understand everybody's busy, my guests are busy. I'd really like to thank, uh, Robert and Mitzi for their time today. Um, and like I said, you can watch this back. We will be sending a recording out to everybody via a link. You can watch it back at your time, you can, you can message us all, you can email, um, and with follow-ups or anything.

You, I would like to thank everybody for attending. Those that couldn't attend, I understand everybody's busy, and thank you for watching. Uh, but most of all, I would like to thank my two guests, Robert and Mitzi, and say thank you very much for your time today. Everybody, thank you.

Robert Clark

No problem. I'm happy to meet everybody. No worries, take care. Thank you, bye-bye.