Episode 127: Unpacking Risk Management: Strategies, Mitigation, and Supply Chain Insights

Mike O'Neill: Welcome back to the Get Unstuck and On-Target podcast. I'm Mike O'Neill with Bench Builders and with executive coaching and People skills training, we help companies solve the people problems that are slowing their growth. Joining me today is Steven Lustig. Steven's Career Path has taken him from a startup to a Fortune 100 company.

Prior to forming Lusik Global Consulting, his previous role was at EastWest Manufacturing where he had responsibility for a hundred million dollar P&L. Steven recently left that role to pursue his long-term passion of helping companies achieve success and growth through effective governance. Operational excellence, strategic guidance, and risk mitigation.

It's that risk mitigation that we're gonna spend some time on today. Welcome, Steven.

Steven Lustig: Thank you, Mike. Welcome. Very pleased to be here. Happy to be on the podcast and to be chatting with you again.

Mike O'Neill: Steven. When we first met I found that what I knew about risk management, And particularly risk mitigation was very, very limited.

And I'm gonna operate on the assumption that those who are listening now probably have heard of it. Maybe they work in organizations, whereas that's kind of given a high priority. But for the those who don't know what we're referring to, how do you explain to others what is risk and risk medication?

Steven Lustig: Yeah, that's a wonderful place to start. So risk is all around us. If we look at the world right now, we have risk, many different areas that are affecting our business. It could be competition, it could be customer concentration, it could be technology. There's geopolitical risk, supply chain risk, cyber security.

And now we're also seeing more and more risk related to sustainability. Not only environmental aspects, but also employees, investors, customers and regulators expecting sustainability from companies. So risk can be defined in many different ways and affects a lot of companies, and it will vary depending on the size of the company.

The location of the company and the industry the company is in Risk is anything that could have a unexpected effect. On the company's future growth and success, and we generally view and think of risk as a negative, but it also could be a positive if addressed properly. And so risk mitigation is the process of identifying those risks, looking at the risks that are most likely to have a significant impact on the company, and then determining ways to address those risks in a systematic function.

Mike O'Neill: Steven, you have an impressive academic background with engineering degrees, if I remember right from MIT, from Georgia Tech. I think you also have an MBA from Georgia Tech. And this topic could be the kind of topic that people listen in. They kind of go, well, you know what? I'm a small business owner.

This doesn't apply to me. How would you rebuff that thought?

Steven Lustig: Sure. Well, certainly the efforts you would take at risk mitigation in a multi-billion dollar company and the efforts you would take in a small million dollar firm are going to be very different because the magnitude of the risk is different.

The number of employees are available, the funds available are different. And so it's, it's not a one size all, it's a one size all fits everything. The advice I would give you is I sit on the board of directors for a firm which is on the smaller side, and at my suggestion, the board has initiated a risk committee and are engaged with executives on that, and the executives are leading efforts internally to go through this risk mitigation process.

This doesn't mean creation of a whole new department. This doesn't mean hiring new people. This doesn't mean buying fancy software or spending huge amounts of money. It, it means taking a look at risk, using the resources that are available setting some resources aside of resource time to, to take a important Search through what your risk might be and identify those.

But it doesn't mean creating huge investments for the company. And that's what's going to vary. It really will scale up depending on the industry. A regulated industry, think of banking or financials, you could think of automotive or airlines. They're gonna have more risk and more risk mitigation efforts to let me to look at than.

A smaller company that's in another industry. So the amount of effort, the magnitude of that effort varies, but the need to do that is still important because small company or a large company, you still want to be successful and you still want to be in business next year.

Mike O'Neill: Steven, this is gonna be an over generalization, but let me say it nonetheless.

As you know, I came out of a corporate HR background and as our company got bigger, I found that the tendency was to be a little less risky, almost ev averting risk. For the last 15 years or so, I've been working with business owners and key leaders of companies that they own, and they're growing, and the tolerance for risk seems to be much higher, if that makes sense.

That the nature of starting a business, it's hard. It's risky, literally. And what has to happen almost every day is you have to kind of on the fly, make a decision. Is this worth the risk or not? But I would think that those decisions are more gut decisions. You're describing something very different, and that is a very purposeful look at the business and look at what could derail.

What they're trying to accomplish. Am I characterizing that okay?

Steven Lustig: Yes. No, that's a, a great one. A great explanation of I would say almost the phases a company goes through, and also what we're talking about, startups by definition, ask for forgiveness instead of asking for permission. And along with that, the whole process of starting up a company is involved.

It's a risk. Is there a market? Will we get a product out? Will we have the right funding and the right employees? So, there's a huge amount of risks for that company at the startup stage, and they're generally more willing to take those risks because to be honest, they don't have a lot of choice. More established companies and more established markets can afford to be more risk averse if they choose to.

But in the either situation, it's a question of understanding those risks and intelligently deciding how to address those. And in some cases there may be nothing that can be done. And the answer is, we know this risk exists and we are going to go and, you know, we're going to conduct business that way anyway.

And other cases, there are actions that can be taken to mitigate that risk. Eliminate that risk if you're lucky or exploit that risk to an advantage. And so there are systematic ways to go about addressing that without going crazy and looking at everything around a corner as a risk. Right. Well, there were thunderstorms last night without a risk in a consulting business.

Not really an extreme example, but you need to be able to prioritize the risks you're going to spend time analyzing and mitigating what are the risks that are the most likely to occur? What and what are the risks that are going to, if they occur cause the most impact, negative or positive to your business.

For example, if you've got a company in California, you have a factory in California. Earthquake risk is probably something you want to think about. Here in Atlanta, I would not prioritize spending effort thinking about earthquake risk, but there's other aspects and that that varies by location, by industry.

That's just one example where it's a geographical based risk if you are. Again, it's similarly, if you are on the Gulf Coast, you probably want to think about a hurricane. If you're in the south, you Midwest, you probably want to think about a tornado. I have been at a company where tornadoes are not so common in the Atlanta metro area, but probably good 20 years ago for natal tour through Dunwoody and Norcross areas and others, and actually to corner off the roof of the building.

And you know, so what? What is the risk mitigation plan and how do you react in those type of situations? And that's the sort of thing that you need to think about when you're prioritizing.

Mike O'Neill: You said something a moment ago that kind of caught my attention. I wanna paraphrase. Risks cannot be avoided, but it can be evaluated, mitigated, and in some cases turned into opportunities.

What do you mean by turn into opportunities?

Steven Lustig: Yeah, so there's cases where if you see risks, those are, might be chances where you can almost double down on the actions you're going to take and you can exploit those risks. So if there's a, if there's a risk of a market shift to. I mean, we'll use a very, his old historic common example, right?

If you're a, if you're a buggy company and you're making the buggy whips back in the early 1900's and now you see cars coming, well that's a risk. And you can either, you can address that as a risk of how do I mitigate that risk? How do I keep my customers? Or you could exploit that risk by saying, well, I've got experience in something related to this, what this new car is going to need.

I don't know what that would be, but I've got some my company's got experience in that. Let's use that experience to exploit this risk that's going to be coming to our market. And how do we then become a preferred supplier to this new market of people who, of companies that are manufacturing cars and needing parts, or of people who are buying cars and need something that we can provide.

And so that's one way that you could exploit the risk rather than just mitigate that. And I think we know there was really no good risk mitigation strategy for the people who were doing that. How many of those companies could actually shift to something that they could exploit? Is, is, you know, I don't know, but that would be an ex let me say it, a hypothetical example where you may be able to exploit risk.

Industries are shifting all the time. Geopolitical examples. What if you are a manufacturing company and you have. Factories in China and you have factories in Mexico. And you see right now again, I have a lot of supply chain experience. If you see, as you see right now, there's a lot of questions about where do people manufacture for the US market.

Do you do it onshore in the US? Can you do that affordably and do you have the talents available? Do you do it nearshore in Mexico or do you do it offshore in China or elsewhere in Asia? So if you look at some of the risk. Some of the tariff, some of the geopolitical discussions, trade restrictions content restrictions.

If you look at the costs of shipping things across. The ocean last year, they surged the cost containers for containers surged 6, 7, 8 times their normal cost, maybe more. And you may remember a lot of port delays on the West coast. The products you were expecting to get off the ship took a month maybe or more.

So if you've got a factory in Mexico and China, maybe you exploit that risk by saying, I'm going to build a higher percentage of my product in Mexico than China right now. And I'm going to show my customers that I'm doing this as a way to help them. So that's one way you could exploit some of the geopolitical risk that's occurring right now.

Mike O'Neill: That's a good, Illustration. You know, as I'm listening to you describe this, it feels that, goodness gracious, this could get complicated fast. You have advanced degrees for a, for a business owner listening to to this, what do you find is practical? Are there algorithms? Are there models? Are there things that kind of go into looking at risk, assessing it so that mitigation can take place?

Or is it more, more a manual process?

Steven Lustig: So there's, if you are, you know, some of those banks, those financial companies, some of those other larger companies with significant risks, both as a, as a percentage of your business and as a overall dollar amount, given your size, your revenue, there are a lot of very complicated and sophisticated ways you can go about risk mitigation and software you can use.

That's not the area I focus on. It's not what I consult about. What I try to do is help companies that are not at, at a bigger level. They're, you know, not these multi-billion dollar companies in regulated industries where this needs to be a major expenditure. The important thing is to, one, recognize that you have risks and be willing to spend the, the time to look at them.

And it doesn't need to be, again, a huge amount of time. It really can be as simple as people brainstorming, getting the right people together to come up with the risks, and you can assess these risks using a simple Excel chart. You know, in, in engineering we use RPN charts a lot, which identifies your take your risk, what's the likelihood of something occurring, the severity of something occurring.

You can multiply that and get a simple quantitative answer and then evaluate what are my top numbers, right? My earthquake. Well, if I have an earthquake in my factory here in Atlanta, we're not earthquake proof. That's the. Impact's probably gonna be severe, but we know the risk is very low. So probably the total risk number's going to be low.

You know, if I have

I'll say, I'm trying to think of another good example along those lines. A fire. A fire in a factory in Atlanta is going to be more common than a earthquake and can cause significant damage. And so that may not get as high of a impact, but it's going to get a higher, you know, likelihood of occurrence.

And so you can then, you know, multiply those out, you get a higher score. And then you'll look and say, which are the ones that I want to look at? How many do I look at to start with? Do I look at my top five, my top 10? I do five. Top five now. Then I do the next five. And you don't need to go down to really low levels.

You need to assess what really makes sense. The key thing is you need to be objective in as best you can. In defining what's the likelihood of a risk and what's the impact of a risk. And that's why it's really beneficial. One, get some outside help involved, and two, to get a cross-functional team involved.

Your facility managers, your sale manager, your IT manager may have very different feelings about the impact of a particular occurrence. And by getting all of those opinions together and those people to talk about that and. Agree, if not unanimously, on an approximate number for the impact, then you're in better shape to really be able to focus on the things that are truly more of a threat to your company.

Mike O'Neill: What do you find would likely get your phone ringing? Is there an event that occurs with the company that they, that was unexpected and they realized they were ill prepared for that event? Is that what most often? Results in them reaching out to you, Steven?

Steven Lustig: Yeah, so people are, you know, it's, it's kind of like a lot of things.

People are either not aware or don't have the time to spend on it until they see the impact in person. So people are most likely to be looking for these risk mitigation services after they've been through an event, or they know somebody who's been through an event, a customer, a supplier. Even just a friend or a neighbor who works somewhere, and that's when people start saying, well, we really could have handled this better.

If we had prepared, we could have mitigated the risk. One in terms of the impact. And then two, we could have improved our response. We could have been better prepared to respond faster in ways that minimize the impact to our business. And now how do we do that? How do we learn? I mean, everything shouldn't be continuous learning process and it would be a shame to, you know, Be a little complacent about the risks.

Go through an event that kind of gives you a heads up and a you know, a aha moment and not take advantage of that. Right? The kind of the silver lining in the cloud. We've now gone ahead and learned from this, so the next time something's out there, you can do better. I was at a company where a supplier had a cybersecurity event.

We know those are very common. We read about them in the news and we many, many more we don't read about. And the supplier, because of that, it's a manufacturing company they were not able to produce. So their manufacturing instructions, their manufacturing plans, their instructions to tell people what parts to kit and what parts to make and how to make them and where to ship them.

That was compromised. And so they were not able to support the company that I work for, which meant the company I work for was not able to complete the assembly of the product and ship it to our customer. And that's another way kind of to give people a heads up, well, this happens to someone else. It could happen to us.

It's, it's. It may be comfortable to assume, oh, our risk mitigation or our cybersecurity protocols and preventions are better than that company. But that may or may not be a valid assumption. I mean, one, you don't know all the things they were doing or not doing. And two, even with more robust thing mitigation efforts in place, it's still not impossible for a cybersecurity event to happen.

Mike O'Neill: We are hearing all too often about the cyber security and how sophisticated these hackers have actually gotten. Steven, I wanna go back to kind of what is a recurring theme in this podcast, whereas I asked our guests to share an example where perhaps they or a client of theirs got stuck and what did it take?

To get unstuck. How would you answer that question?

Steven Lustig: So that's a good question. And I think one of the most useful aspects of the, of the podcast because it helps people point people in an direction of not just what are the challenges, but what do we do about them. So I'm gonna go back to a supply chain example.

I think everybody on the podcast knows that during Covid and after Covid, it became very difficult to get a wide variety of things. And you might think about toilet paper, you might think about. Lumber for, you know, home projects at your house and all sorts of other things maybe that you did not see on the grocery shelves.

But the industries also face challenges. You know, people, if you were trying to order a game station, some sort of playing station like that, you were facing long delays. If you were trying to get exercise equipment that had electronics in it, you were often facing long delays. The automakers, big automakers could not get electronic components despite their size, their importance to those suppliers and their contracts.

So as those examples illustrate, the electronics market was very challenging and so, lead times for components that go into electronics and in our computers, our phones in cars and everywhere shot up when things were maybe were 12 week lead times, suddenly you're gonna have to wait a year for it or more.

And this may have this occurred as well with products that were on order already. And it wasn't just a question of new orders, it was where are. You know you have orders with us. Yeah. We all thought it was going to be 12 weeks. Well, sorry, it's not we because of covid shutdowns, worker shortages, supplier issues, logistics, delays.

It's not going to be that timeframe. It's going to be much more, obviously, that impacts your custom, your company's revenues and your customers as well. And so the risk mitigation efforts we took about, related to that had to do with reviewing the supply chain and looking at ways to diversify that supply chain to reduce the risk then and in the future.

Who are different companies that you can be partnering with? What are different methods, different channels that you can be finding these parts with? What are different ways to. Increase inventory that you have or that suppliers have for you without being something that causes too much negative impact to your financials.

Really diversifying the programs you have place for inventory as well as the supply base by company, by supplier, by country and geography, and so that's something that will help going into the future as well. If you started with one or two sources and you were successfully able to work and partner with others so that you now have additional sources, the next time that there's a constraint.

You are vet is situated to address it, you are no longer searching for those suppliers. You're now working with those existing suppliers that you know, and that's an improved way of reacting to or maybe preparing for those type of occurrences.

Mike O'Neill: You know, at the very beginning of this episode, I shared my understanding of risk, risk management.

Risk mitigation was pretty small. And so one reason I wanted to spend some time with you is kind of help round out that understanding. There have been a number of things that I've heard that I did not know. Something that you shared this a little while ago is it doesn't take sophisticated modeling and software, but there are tools that could literally be spreadsheet driven.

That you can bring in and help clients and put the right people in the room, you can help them do that assessment. And it sounded much more reachable to me when I heard you described it that way. So thank you for that description. You know, Steven, the whole notion of. Risk management, risk mitigation.

I mean, it's a lot we can actually cover. We're recording this in early June, and the world has gone through an upheaval in the last three years that very few people saw coming and I don't know, but do you think that that has created a little more awareness of how vulnerable. We are from a business standpoint, particularly from a supply chain, do you think that that has served as a wake up call?

Steven Lustig: Yes, definitely. From the company that I've spoken with over the past years recently there's a lot more interest in supply chain than there was be, it was before, and a lot higher level interest at those companies. And that's not a coincidence. They're interested in supply chain because the supply chain was holding up their revenue and their customer satisfaction, not necessarily because of any poor execution by their supply chain teams, but because of a lack of corporate risk mitigation processes in place and identifying the supply chain.

Not necessarily only as a, how can we absolutely minimize our costs, but also balancing that with the risk mitigation aspects. That's why companies are looking at where they're building things from a cost perspective that hasn't changed too much. Companies are now starting to say. How do I balance this?

How do I minimize some of my supply chain risks and build in some different geographies or maybe with some different companies? And how do I fine tune that risk? How do I understand what that risk is and how do I then come up with the right strategy and how do I manage according to that strategy?

Because certainly if you're managing one supplier in one country, that's a lot easier than multiple companies in different time zones in different cultures. And so it's not as, you know, a zero additional work that's involved there, but is the extra work worth the risk mitigation that will help you with the next supply chain crisis?

Is the extra expenses that maybe a higher product cost, is that something you're willing to do? Because you want to assure your leadership, your board of directors, your customers, that you've got a plan. Because more and more customers are asking for your plan. Where are your, where's your supply chain coming from?

Part of that's for sustainability, but a lot of that's also for risk mitigation, and so, I would agree with you. You're, you're seeing a lot more companies and executives and boards think about this because, you know, if we had done a risk analysis before covid, I doubt many companies would've put a pandemic on there.

I'm pretty sure any risk analysis that you would do now, a pandemic is on there somewhere. It may not be your number one risk, but it's going to be a lot higher and it's going to be on there. In fact, when and before it probably would not have. And so there is that idea. We didn't foresee this. What does that mean?

We didn't foresee the supply chain disruptions that occurred afterwards. We didn't foresee the Russian invasion of Ukraine and some of the concerns it raised about grain supplies in the world, and some minerals that are used for spec specified equipment in some industries. How do you now say, I've seen that we're living in a risky world.

What's the right thing to do? What's the right level of effort to put into addressing that in a, in a way that doesn't cost too much, but protects us?

Mike O'Neill: Thus far, we've limited our conversation to risk and risk mitigation, and I know you have expertise in other areas as well. Be it governance, be it operational excellence, be it strategic guidance. If folks have been listening to this episode and they say, I wanna learn more, what's the best way for them to connect with you, Steven?

Steven Lustig: Thank you for asking. Yes, you'd love to engage with your listeners further on any of these or related topics. The best way is to contact me at one. You're welcome to find me on LinkedIn and please send me a message and mention that you heard us talking and you are interested in wanting to know more.

I can be found at my website, www.lustigglobalconsulting.com. It's L U S T I G. Or by email, steven@lustigglobalconsulting.com. Be happy to get your messages and, and chat with you about some of your concerns and ways we can help each other.

Mike O'Neill: Excellent. We will include that contact information in the show notes. Steven, I've learned a lot. I trust that our listeners have have two. Thank you for sharing your expertise.

Steven Lustig: Thank you very much. I enjoyed the chat as always, and look forward to hearing more of your podcast in the future.

Mike O'Neill: Thank you Steven. And I also wanna thank our listeners for joining us today. If you'd like to subscribe to this podcast, you can do it several ways.

The easiest is just go to your browser, type in unstuck.show. And while you're there, you can also subscribe to our weekly management blog called The Bottom Line. So my question for you as a listener, if you're trying to grow your business, but it's those people problems that have slowed you down, let's talk head over to bench-builders.com and schedule a call.

So I wanna thank you for joining us, and I hope you have picked up on some tips from Steven that'll help you get unstuck and on target. Until next time.