Helping businesses understand and manage risk
In this blog, Ignition Law’s Co-Head of Commercial, Tim Barnett-Richards, looks at how businesses need to understand the potential legal and compliance risks they face and be pragmatic in mitigating against them (with a little help from our team).
Are you the proud founder of a start-up or scale-up? Or the business leader of an SME that has scaled up at pace? Whilst spinning the many plates needed to make your business a success, have you had time to fully scope out and appropriately mitigate against the legal and compliance risks faced by your growing business?
How to identify your business risks: the importance of taking a step back
Founders and business leaders under time and cost constraints can easily fall into the trap of taking a scattergun approach to tackling perceived risks, without a coherent strategy. They are forced to jump straight in at the deep end, rushing to plug gaps using generic commercial contracts or policies sourced online.
But often, this is a case of putting the cart before the horse: it’s difficult, if not impossible, to effectively mitigate risk without first taking a step back to gain perspective and see the bigger picture.
Workshop your business risks to truly understand them
Whether you’re at the outset of any new business venture, scaling up or simply taking stock of where you’re at, a proper scoping of your business’ risk profile is always time (and money) well spent. Akin to an occupational safety assessment of a physical workspace, you need to workshop your business risks to identify the key potential threats your business faces.
We understand that taking certain risks is part and parcel of running a successful business. So an important aspect of this exercise is also to define your appetite for risk, which will determine how thorough your risk-mitigation strategy needs to be.
So how should you go about this crucial but often-neglected task? You need to ask yourself the following questions (this list is non-exhaustive, and will vary depending on the nature of your business, but it provides a good starting point):
- Are you operating in a regulated sector?
- Are you selling to consumers?
- Are you operating online?
- Are you confident that you handle personal data in a compliant manner? Do you know if, and how, you are processing personal data?
- Does your business involve cross-border transactions, or dependencies in terms of goods or services coming from, or being located, abroad?
- Do you use third parties to carry out activities on your behalf?
- Do you have supplier dependencies, e.g. are you sole-sourced? Or do you rely on others to get your goods/services to market?
- Is your business vulnerable to pricing volatility, e.g. fluctuating energy costs? Is cashflow a concern?
Planning for the worst is an essential component to any effective risk-mitigation strategy. So you also need to ask what a Doomsday scenario might look like for you – what is the worst that could happen if things go wrong? For example, if you are late in supplying or fail entirely to deliver? Or if you supply defective goods or services? Or lose or inappropriately use customers’ personal data?
We’ve all observed the difficulties businesses have faced over the last few years, for example, with Brexit, Covid-19, the cost of living and fuel crises, and logistics disruptions in the Suez Canal and Russian transit channels. So playing out these sorts of scenarios in answering the questions listed above and thinking about how they might impact your business is an important part of your risk mitigation strategy.
By workshopping your business risks in this way, you can separate the signal from the noise, understand your blind spots and allocate your limited resources appropriately.
Managing your business risks: taking a proportionate and practical approach
Once you’ve identified your key business risks and understand your risk appetite, you can start to come up with a plan.
Rome wasn’t built in a day, and neither was any commercial risk-mitigation strategy worth the paper it’s printed on. You’ll want to ensure that you invest your limited time and resource in next steps that are proportionate, well-considered, practical and aligned to your risk appetite.
These risk-busting tools are just some that are likely to be invaluable to you:
- Terms of Business/Customer and Supplier Contracts: Intelligent use of commercial contracts can:
- provide clarity on what you are selling/buying, and thereby help you avoid disputes;
- limit your exposure to customers and ensure your suppliers take responsibility for the part they play in supplying goods/services to you (you don’t want to be the piggy-in-the-middle where any losses land);
- protect the intellectual property rights in your goods and services and ensure they aren’t lost through your business activities with third parties;
- ensure compliance with applicable regulatory frameworks, for example, UK consumer law;
- offer certainty in terms of pricing, payment and supply; and
- uphold ethical and compliance standards in your supply chain and protect you if third parties are acting on your behalf.
Being intelligent with how you use commercial contracts doesn’t always mean preparing your own suite of legal agreements upfront. Sometimes, commercial realities mean that you don’t have the bargaining power to work off your own legal agreements (yet!). In these cases, a better approach is often to have a clear contracting guide, setting out the dos and don’ts when working off the other side’s legal agreements.
- Website Terms of Use, Privacy Policy and Cookie Policy: These policies provide key information to website users, including summarising any data you’re collecting from/about them, and explaining how they can (and cannot) access and use your business’ website. These policies are key to ensuring your online shop is compliant with applicable legal and regulatory regimes.
- GDPR/Data Privacy: If your business collects and handles personal data (including for marketing and customer analysis), it is critical that you conduct a personal data assessment. Failing to do so can lead to significant fines and irreparable reputational damage. A data-mapping workshop is the best place to start to understand what personal data you collect, how it’s collected and stored, who it’s shared with and what it’s used for. After that, you can build a data privacy compliance programme that protects personal data and individuals’ rights in relation to that data, but which also reflects your way of doing business.
- Insurance: Do you have the right professional indemnity/product liability/cyber insurance in place? Do the policy terms also provide cover in the event of your Doomsday scenario playing out in real life?
- Business Practices: There are many practical ways to manage your business risks that work in tandem with your commercial contracts and policies. For example, incoming and outgoing quality checks to catch any issues before they turn into bigger problems; conducting due diligence on the third parties you want to do business with; structuring your payments to third parties efficiently to incentivise good performance (‘cash is King’, after all); and generally building good, trusted, working relationships with your business partners.
How the Ignition Law team can help you to manage your business risk
One of the things that sets Ignition Law’s Commercial team apart is that our lawyers have many years of experience working in large, reputable City law firms, but have also spent time working in-house with businesses – many holding General Counsel or similar senior positions or sitting on Boards. Of course, Ignition Law is also a scale-up itself – we opened our doors in 2014 and continue to grow exponentially.
We really do ‘get’ the pressure you’re under, and use our combined legal and business expertise to tackle problems in a way that reflects commercial and operational realities.
In other words, we’re perfectly placed to help you to understand and mitigate your legal and compliance risks.
Our services include:
- Risk and personal data-mapping workshops, in which we work collaboratively with you to help you to identify, risk-assess and prioritise your legal and compliance risks.
- Data privacy guidance notes and policies to help you understand your obligations in handling personal data, and to ensure transparency in terms of telling individuals whose personal data you handle, what you do with their data and what their rights are.
- Website health checks to ensure your online shop is legally compliant – especially if you’re selling to consumers and/or processing personal data.
- User-friendly contract toolbox that works for your business:
- Playbooks to guide negotiations, especially where it’s difficult to insist on your own standard terms – know what is acceptable and when to say “no”
- User-friendly templates that your business can populate quickly and which facilitate positive interactions with your customers, suppliers and other business partners
- Playbooks and templates to promote consistency across your business, help to ensure compliance and certainty and mitigate the risk of disputes
- Brand protection to ensure your hard work doesn’t go to waste!
- Calls to understand and scope out your legal needs so that you’re getting the right legal support
We also offer a Virtual General Counsel service. In return for you committing to a certain number of hours per month at a heavily discounted rate, we partner you with a senior and experienced Ignition Law lawyer who will get to know you and your business and facilitate the provision of legal support to your business across all our practice areas.
We are here to help you with any aspect of legal and compliance risk management for your business. Please get in touch at info@ignition.law or contact Tim directly at tim.richards@ignition.law.
