Risk assessment report

Risk Assessment at the Wal-Mart Stores Inc.

Industry and company information

Risk assessment

System characterization

Threat identification

Vulnerability identification

Control analysis

Likelihood determination

Impact analysis

Risk determination

Control recommendations

Concluding remarks

Bibliography (Annotated)

The current economic climate is more challenging than ever and economic agents face incremental difficulties in registering profits through the serving of a population with a decreasing purchasing power. Nevertheless, in a context in which most economic agents register decreasing revenues, America's number one retailer -- Wal-Mart -- registers growing profits.

The company does nevertheless encounter numerous challenges as a result of internal vulnerabilities and external threats. In addressing the risks which face Wal-Mart, the current report has used the Risk Management Guide for Information Technology Systems, from the Special Publication 800-30 of the National Institute of Standards and Technology. The choice for this methodology was made as it is easily accessible and applicable, regardless of the field in which the entity operates.

The analysis of the risk has revealed two primarily important risks -- the threat of the economic instability in the current climate and the vulnerability of the past failures with international expansion. The negative reputation of the company represents a medium level risk and the competition in the industry represents a low level risk. Recommendations were forwarded to addressing all of these risks.

1. Introduction

The corporations in the United States are no longer only important from an economic perspective, but they have grown to be part of the American culture. Figures of corporate founders, such as the Sam Walton, Henry Ford or the McDonald brothers are part of American history and their heritage foundations are not just employment places, they are in fact integrant parties of the American society.

But in recent years, these corporations have been presented with the pressures of the internationalized economic crisis and many of them were forced to downsize or even declared bankruptcy. The main problems were pegged to the decreasing incomes and purchasing powers of the consumer, materialized in a low demand for products and services. But in this day and age, despite the limitations encountered, some corporations continue to thrive. Such is the case of America's number one retailer -- Wal-Mart.

Numerous accusations have been forwarded against Wal-Mart through its existence, but it is nevertheless true that the company is a symbol of corporate success. A question is however being posed relative to the future stability of the firm in the current circumstances, given the risks it faces. To better understand these risks however, it is first necessary to understand the features of the firm and the industry in which it operates.

2. Industry and company information

Wal-Mart was founded in 1962 in Arkansas by former soldier Sam Walton. Having returned from the front, Walton envisioned a community in which the people would have quick and easy access to the necessary commodities. And not just to any commodity, but to a wide selection of products, from which they would choose the ones that best served their needs. Walton as such opened the first Wal-Mart store on the 2nd of July 1962 and operated it as a discount store. Gradually, he came to open more and more stores. Today, the hypermarket chain is formed from no less than 8,500 stores and these still strive to preserve the identity of the founder. Sam Walton also focused on the well-being of the people and focused on training and internal promotions to managerial functions. Optimism is still present at the modern day Wal-Mart stores, where the employees gather up every morning to give the morning cheer.

From a financial standpoint, Wal-Mart is a highly successful business, with continually increasing revenues and profits. In 2007 for instance, the revenues of the stores totaled up to $345 billions, to have followed a sustained growth trend and reached a total of $419 in 2011. The main generator of these revenues is represented by Wal-Mart United States, followed by Wal-Mart International, and Sam's Clubs. The charts below reveal this:

Source: Wal-Mart 2011 Annual Report

Source: Wal-Mart 2011 Annual Report

In terms of the revenues expectations for 2012, the belief is that they would increase by an estimated 4 to 6 per cent. This increase would be due to the addition of new spaces in the already existent Wal-Mart stores. In terms of other important financial outcomes, most of them have also followed an ascendant trend. The table below presents some of the more relevant figures pointing out to the results registered by Wal-Mart in 2011, and their evolution comparative to previous years.

2011

2010

2009

2008

2007

Net sales

$418,952

$405,132

$401,087

$373,821

$344,759

Net sales increase

11.6%

Gross profit margin

24.7%

24.9%

24.2%

24.0%

23.4%

Income

$15,355

$14,449

$13,235

$12,841

$12,224

Total assets

$180,663

$170,407

$163,096

$163,200

$151,274

Long-term debt

$43,842

$36,401

$34,549

$33,402

$30,735

Shareholders' equity

$68,542

$70,468

$64,969

$64,311

$61,298

Unit counts

Wal-Mart U.S.

Wal-Mart International

Sam's Club

Total

3,804

4,557

8,970

3,755

4,099

8,459

3,703

3,595

7,909

3,595

3,093

7,288

3,488

2,733

6,809

Note: With the exception of the Gross profit margin and the unit counts, the figures are in millions of dollars

Source: Wal-Mart Annual Report

Wal-Mart operates within the retail industry, which is a highly competitive industry. The demand of consumers is pegged to the level of economic development and business activity. Specifically, in times of economic prosperity, demand and consumption increase, whereas in times of economic stagnation or recession, these variables decrease. Wal-Mart does nevertheless reveal an unexpected outcome of an increased demand for its products, which could be explained by the fact that the crisis has pushed consumers to seek discount purchases, constantly offered by the company. Also, the stores sell commodities necessary for human life, regardless of economic state.

Wal-Mart, similar to the rest of the corporations in the retail industry, has created economies of scale. These allow the company access to impressive resources and help it create efficiencies. Strong managerial models, well implemented logistics and marketing efficiencies are key competitive points for large size players in the retail industry. Smaller size companies compete by offering customized products to niche markets. Today, Wal-Mart's top competitors are Carrefour S.A., the Costco Wholesale Corporation and the Target Corporation. Despite the intense competition it faces at an international level, "Wal-Mart Stores is an irresistible (or at least unavoidable) retail force that has yet to meet any immovable objects. Bigger than Europe's Carrefour, Metro AG, and Tesco combined, it's the world's #1 retailer" (Hoovers, 2011).

3. Risk assessment

The assessment of the risks facing the Wal-Mart Stores is important to understanding the jeopardy which threatens it, but also to revealing solutions to reducing the chances of the risks materializing. There are several means of assessing the risk, each relevant and applicable in specific contexts. For the current risk assessment process, the methodology was selected as it reveals clarity and easy applicability. Specifically, however it is created in the context of the IT industry, the methodology hereby used is applicable in virtually all business fields.

The risks facing the Wal-Mart Stores would be assessed with the aid of the Risk Management Guide for Information Technology Systems, featured in the Special Publication 800-30 of the National Institute of Standards and Technology, Technology Administration at the United States Department of Congress. This specific methodology is composed from nine gradual stages, as follows:

Step 1: System characterization, in which emphasis is placed on the information related to the system and the method used in the collection of the information

Step 2: Threat identification, at the level of which focus is placed on the identification of the sources of threats and the threat motivation and actions

Step 3: Vulnerability identification, where emphasis falls on the identification of the sources of vulnerability and the assessment of the security of the system

Step 4: Control analysis, where emphasis is placed on the control methods, the control categories and the technique of control analysis

Step 5: Likelihood determination, where assumptions are made over the likelihood of the threats and vulnerabilities materializing

Step 6: Impact analysis, during which phase emphasis is placed on the estimation of the impacts which would be felt in case the threats and the vulnerabilities materialize

Step 7: Risk determination, during which stage emphasis is placed on the identification of the risks, based on the chances of materialization of the threats and vulnerabilities, as well as based on the impacts which would be felt. At this stage, the identified risks are ranked in order of severity and importance.

Step 8: Control recommendations, at the level of which recommendations are formulated in the mitigation of the identified risks

Step 9: Results documentation (Stoneburner, Goguen, Feringa, 2002). At the level of the ninth step, it has to be noted that this specific stage of the risk assessment process refers to the actual completion of the report on the information collected throughout the research process. The ninth step is in essence represented by the entire project, which centralizes the findings of the research conducted. A separate section for this step would not as such be integrated.

The chart below indicates the structure and components of the risk assessment methodology.

Source: Stoneburner, Goguen, Feringa, 2002

Since the method is in fact developed for the IT systems, it would be applied to the case of Wal-Mart through adaptation of the specifics. In other words, while the nine steps are preserved, their particular applications and contents would differ based on the differences between IT and retail systems.

3.1. System characterization

Wal-Mart is the largest retailing company within both the United States as well as within the entire world, revealing a size larger than that of its primary competitors combined. The company employs more than 2 million staff members across the world and argues that it strives to create favorable and stimulating workplaces, to support the development of the communities in which it operates, and most importantly to help its customers lead a better life by delivering more value at lower costs.

"We save people money so they can live better. Saving people money to help them live better was the goal that Sam Walton envisioned when he opened the doors to the first Walmart. This focus drives everything we do at Walmart. And, for the millions of customers who shop in our stores around the world each week, it means they can trust that our brand means we have every day low prices" (Wal-Mart 2011 Annual Report).

3.2. Threat identification

The identification of the threats in the assessment of risks can be correlated with the marketing stage of threat identification in the construction of the SWOT analysis. As in the marketing effort, the threats at the level of risk assessment are pegged to external features which jeopardize the stability and general well-being of the Wal-Mart Stores. The threats which impact Wal-Mart's stability refer to the following:

The general state of the economy. This threat is problematic since consumer spending is pegged to consumer income, which is being jeopardized by the internationalized economic crisis. The globalization of the economic shortages translates into the threatening of Wal-Mart's revenues within the United States as well as outside it.

The incremental competition which threatens to move into Wal-Mart's consumer market. The retail industry is a highly competitive industry in which revenues are high and as such alluring to numerous players.

3.3. Vulnerability identification

Similar to the identification of the threats, the detection of the vulnerabilities also has a correspondent in marketing, namely the identification of the weaknesses in the construction of the SWOT analysis. In both cases, the vulnerabilities and the weaknesses refer to internal issues which create strains on the overall stability of the firm. In the IT application of the risk assessment method, the risks would be pegged to the combination of the threats and the vulnerabilities, but in the scenario of Wal-Mart, the threats and the vulnerabilities are different, linked to diverse variables and of significant importance. They would as such be treated as independent generators of risks.

In the case of Wal-Mart then, the main vulnerabilities would refer to the following:

Its past failures with efforts of international expansion

The negative image perceived by the public regarding Wal-Mart

a) Past efforts of international expansion

Wal-Mart currently generates an estimated 26 per cent of its revenues from international operations and this figure has been following an ascendant trend, and is also expected to maintain its trend as international operations would continue to grow in size and importance (Wal-Mart 2011 Annual Report). Still, it has to be noted that most of Wal-Mart's operations remain concentrated in the United States. And out of the operations which do generate profits outside the country, most of these originate from Canada and Mexico. Wal-Mart has also opened some stores on the Asian continent which succeed, but its experiences in Europe have been negative ones.

Wal-Mart had long been awaiting an opportunity to penetrate the European market, and when it did so, it was determined to bring Sam Walton's vision into the Old Continent. Yet, the Old Continent seemed incompatible and this is mostly relevant by the failure in Germany. Here, the employees and the population, who are more reticent and more private individuals, did not welcome the morning cheer and the enthusiasm and optimism of the Wal-Mart culture. Then, German employees were strongly embedded in the culture of labor unions to protect their rights. Wal-Mart U.S. discourages unions and uses the technique to reduce costs with the personnel. As this approach was unsuitable in Germany, it came to register more costs. Then, there was also the strong competition, as Europe is filled with hypermarket chains, such as Cora, Carrefour, Metro, Lidl and several others more, competition which was ignored by the American retailer. After nearly a decade of struggle and millions of dollars lost, Wal-Mart decided to retreat from Germany. Overall, its failure in Europe would be explained by its failure to understand and adapt to the local cultures.

"The circumstances of the company's failure to establish itself in Germany give reason to believe that it pursued a fundamentally flawed internationalization strategy due to an incredible degree of ignorance of the specific features of the extremely competitive German retail market. Moreover, instead of attracting consumers with an innovative approach to retailing, as it has done in the U.S.A., in Germany the company does not seem to be able to offer customers any compelling value proposition in comparison with its local competitors" (Knorr and Arndt, 2003).

b) Wal-Mart's reputation

Another internal vulnerability of Wal-Mart's is linked to the fact that it has a negative reputation within the communities in which it operates. Some of the more important accusations which have been forwarded against the retailer throughout the years include the following:

Wal-Mart's treatment of the employees, including the low wages it offers, the limited medical coverage, the fact that it asks the employees to work long hours and does not pay the extra hours or even the accusations that it discriminated African-Americans and women in favor of Caucasian males, for promotions into managerial positions.

Wal-Mart's penetration of the small communities, leading to the bankruptcy of the mom & pop stores.

Wal-Mart's lack of emphasis on product quality. The company has for instance been accused of importing products from cost efficient regions, in unsafe and unsanitary conditions.

Wal-Mart's lack of emphasis on consumer safety. The retailer was accused of ensuring full surveillance and safety within the store to ensure that products are not being stolen, but does not ensure any surveillance and safety in the parking lots, where people are being robbed or even killed (Greenwald, 2005).

3.4. Control analysis

At this level of the risk assessment, it is necessary to review the means in which the company has so far responded to the threats in the external environment in order to reduce the chance of these threats materializing. In this order of ideas, the measure taken by the firm in addressing the competition and the economically weakening customer base refers to the sustained emphasis on the price -- Wal-Mart's already existent focal point. In other words, the company has focused on consolidating its position as a price leader within the industry.

3.5. Likelihood determination

At this level of the risk assessment analysis it is important to look at both internal vulnerabilities as well as the external threats and see what is the likelihood of them materializing. In this order of ideas, the following specifications are noteworthy:

Threat no. 1: Economic instability -- the chances for this threat to materialize are difficult to estimate because the general state of the economic crisis is uncertain. One source comes to indicate that the critical point of the crisis has been passed, whereas a different source will indicate that the worst of the crisis is yet to come. In this context then, it is difficult to state whether the purchasing powers of consumers would increase or decrease. Nevertheless, the safer assumption at this stage is that of the crisis still unfolding, and the possibility of negative turnouts still being present.

Threat no. 2: Competitive threats -- At this stage it is noted that Wal-Mart is already the leader of the retail industry and that it would be difficult for any retailer to overthrow it.

Vulnerability no. 1: Failure in international expansion -- Wal-Mart's international revenues represent an estimated one quarter or all revenues and the company intends to increase this figure in the future. In a context in which it aims to increase its global presence, its inadequacies in its global strategies are highly likely to materialize.

Vulnerability no. 2: Negative reputation -- Finally, the negative reputation which has been attached to the American retailer is highly likely to materialize in problems and negative reactions from the public, especially when it opens a new store and by this jeopardizes the economic stability of an already weak community.

3.6. Impact analysis

As the vulnerabilities and the threats combine and result into impacts, it is necessary to assess these impacts in terms of their natures as well as in terms of their strength. The table below reveals the impacts which could be pegged to the materialization of the threats and the vulnerabilities.

Threat / vulnerability

Impacts

Magnitude of impact

Economic instability

- Decrease in sales

High

Competition

- Decrease in sales

High

Failure of international expansion

- Loss of investments

High

Negative reputation

- Failure of national expansion

High

3.7. Risk determination

In a traditional context of applying the Risk Management Guide for Information Technology Systems, the stage of risk determination would be highly complex and determined by quantitative tools of assessing the importance of each risk. Specifically, the risk would be identified as function of the following:

"The likelihood of a given threat-source's attempting to exercise a given vulnerability

The magnitude of the impact should a threat-source successfully exercise the vulnerability

The adequacy of planned or existing security controls for reducing or eliminating risk" (Stoneburner, Goguen, and Feringa, 2002).

In the current scenario however, of analyzing the risk pertaining to the activities of Wal-Mart, the previous stages have revealed notable levels of likelihood and impacts. The impacts of all threats and vulnerabilities are high, indicating high levels of risk, but the threats and vulnerabilities are marked by different levels of likelihood, which as such reveal differences in the degrees of risk they pose. The matrix below assesses the degrees of risk associated with each threat and vulnerability.

Likelihood of materialization

Level

Likelihood of materialization

Value

Impact of materialization

Level

Impact of materialization

Value

Risk

(Likelihood x impact)

Value

Risk

Level

Threat 1: Economic instability

High

1.0

High

1.0 x 100 = 100

High

Threat 2: Competition

Low

0.1

High

Low

Vulnerability 1: International expansion failure

High

1.0

High

1.0 x 100= 100

High

Vulnerability 2: Negative reputation

Medium

0.5

High

Medium

3.8. Control recommendations

Based on the previous step, the ranking of the risks is uncovered as follows:

1 -- The highest levels of importance are revealed by the economic instability and the company's previous failures with international expansion

2 -- The negative reputation of the company is a medium level risk

3 -- The threat of the competitive players in the industry is a low level risk.

With this ranking in mind, it is now essential to propose several recommendations as to how the risks could be better controlled by the American retailer.

a) Recommendations for dealing with the threat of economic instability

Focusing on price leadership to ensure that Wal-Mart remains the preferred destination of shoppers even if they come to be on a tighter budget

Withholding from making major investments in order to preserve the company's financial stability. The executive team should in essence focus on savings in order to be able to cover any future losses.

b) Recommendations for dealing with the vulnerability of global expansion

Conducing thorough analyses of the markets in which the company intends to launch its operations

Understanding and eliminating -- as well as possible -- the barriers which prevent the company from successfully penetrating the region. These could include fiscal barriers, legal barriers and so on Studying, understanding and adapting to the features of the local culture

Selecting regions for expansion where the retail sector is underserved, in detriment of regions where the concentration of retailers is increased (as was the case of Germany).

c) Recommendations for dealing with the vulnerability of negative reputation

Investing in improving the reputation

Becoming involved in, and supporting, community efforts for development, such as charity events, educational events, sports events and so on Investing more in the better treatment of the employees through the offering of incentives such as medical coverage, premiums and bonuses, team building sessions, promotional opportunities, flexible working schedules and so on.

d) Recommendations for dealing with the threat of the competitive powers

Consolidating the leading position and even improving it

Continually assessing the market to reveal and serve new consumer demands

Continually assessing the industry to reveal new trends and strategic directions implemented by the competition.

4. Concluding remarks

The modern day economic climate is extremely challenging and economic agents are faced with the need to overcome challenges, but also the possibility to seize opportunities. Wal-Mart for instance, America's greatest retailer has managed to seize the opportunities and has grown into the largest retailer at a global level. Even in these times, when economic instability is a constant around the world and when economic agents suffer bankruptcies, downsizes and losses, Wal-Mart operates on increasing revenues.

Still, despite being the embodiment of corporate success, Wal-Mart continues to face challenges. The primary sources of risks are represented by the internal weaknesses and by the external threats. The assessment of the risks has been completed with the aid of the Risk Management Guide for Information Technology Systems in the Special Publication 800-30 of NIST. This methodology was selected due to its versatility and applicability in numerous instances and due to the structure and clarity offered by its nine steps.