One and a half years after the German StaRUG (the Geman implementation of the EU-Regulation on the “preventive restructuring framework, for more information, cf. here) came into force, the German Federal Ministry of Justice (BMJ) has fulfilled its obligation under § 101 StaRUG and has actually made “tools provided by public authorities for the early identification of crises” available on its website (see link below). However, the tools listed on the site are unlikely to be of any real use for the daily practice in an SME due to their general nature. Following on from previous considerations (cf. again here), some aspects of the actual design of a risk early warning system in medium-sized companies are therefore presented below.
Since 2021, the provisions of § 1 StaRUG stipulates that managers must “continuously monitor developments that may jeopardize the continued existence of the legal entity“. In contrast to § 91 (2) of the German Stock Corporation Act (AktG), for example, this obligation does not depend on the legal form or size of the company and therefore applies to all companies operating in Germany. Numerous recent cases – especially in the banking sector (see here for general information and here for information on the failed risk management at Credit Suisse, both in German) – illustrate the need to identify risks as early as possible.
But how should the respective SME’s management proceed in concrete terms? The “IDW PS 340” (here, in German) is a concrete standard for auditing an existing risk management system in a stock corporation in accordance with § 317 (4) of the German Commercial Code (HGB). However, this standard, as well as other standards, are far too extensive for most medium-sized companies and are therefore only applicable at all in the basic assumptions. In practice, the first and most important step for SMEs is probably to identify specific risks to their own business success, distinguishing between internal risks (which are not discussed in detail here) and external risks, which are given priority. To this end, the company’s own business planning (or at least the SWOT analysis) should be compared with the (risk) forecasts of independently operating institutions in order to be able to identify “weak” (external) crisis signals as early as possible. The “doctrine” of such “weak signals” was founded by Harry Igor Ansoff after the experience of the oil crisis in the 1970s (see on this and on other futurologists here, in German). In today’s “VUCA” world with its sometimes drastic reversals, the anticipation of risks (and opportunities) is essential for companies to survive. For years, the number of corresponding institutionalized risk forecasts has been on the rise (see here for Control Risks’ “Risk Map” or Eurasia Group’s “Top Risks 2023”, to name just two). These and other forecasts can be used to draw up a preliminary list of risks that could pose a concrete threat to a company’s success. Important keywords for this are currently of course (as before) supply chains, currency, interest rate and inflation risks or the development of energy prices. The “Futures Wheel”, for example, can subsequently help in identifying and assessing the fundamentally identified risks (see the reference below from the German Federal Academy for Security Policy (BAKS)).
Once the top risks have been identified and “ranked” in terms of the company’s success, these risks must be “operationalized”, i.e. assigned a concrete value (or better a range) related to the company. With regard to energy prices, for example, the question is how an increase (or decrease) in the price by a specific – to be justified – percentage would affect the company’s success. Or, how e.g. the (partial) failure of the company’s own IT could affect the company’s success – and resulting downtimes in production or delivery of one, ten or 100 days. The correspondingly calculated values must flow back into the corporate planning – will therefore, in case of doubt, concretize the SWOT analysis. “In principle, an Excel list is sufficient for this,” as Creditreform magazine 4/2021, p. 27, soberly states. In addition, there are also free online tools to support SME risk management, such as the “Risk Simulator” (here, in German).
If risks have been integrated into corporate planning, the monitoring of plan fulfillment should also include monitoring of identified risks, as well as risks that have only been identified in the course of the financial year. If necessary, the risk assessment – and corporate planning based on it – must be adjusted. Irrespective of this, this process of risk assessment and aggregation must be repeated at the latest for the new fiscal year. Then, lessons can and should also be learned from the respective previous planning cycle. Over time, the first steps thus develop into an early risk detection system, which must then be followed by risk management. But that is another article.
Conclusion: Not only against the background of the currently still abstract liability risks in the case of a missing early risk detection system, the SME manager should now, at the latest against the background of the experiences with Corona or the war in Ukraine, concretely deal with the risks possibly affecting his company. Compliance with the checklists published by the GErman Federal Ministry of Justice for the early identification of risks is likely to be the minimum standard to be observed in accordance with § 1 StaRUG, although compliance will also have the effect of avoiding liability. As shown, the published checklists are too generic, so that management should give further thought of its own to the processes required for actual detection of “weak crisis signals”.
However, the general rule in this area is also to “just get started”, i.e. to pragmatically track down risks as systematically as possible using relevant forums and to successively develop a “risk map” from this. As a “bonus”, at the end of the process there could even be the realization of new business opportunities. It is not for nothing that the Chinese characters for “crisis” and “opportunity” correspond to each other.
BMJ: „Frühwarnsysteme (§ 101 StaRUG)“ (in German)
BAKS: „Methoden zur Strategischen Vorausschau: Futures Wheel“ (in German)