Risk assessment of Walmart Stores Inc. using NIST methodology

Risk Assessment at the Wal-Mart Stores Inc.

Industry and company information

Risk assessment

System characterization

Threat identification

Vulnerability identification

Control analysis

Likelihood determination

Impact analysis

Risk determination

Control recommendations

Concluding remarks

Bibliography (Annotated)

The current economic climate is more challenging than ever and economic agents face incremental difficulties in registering profits through the serving of a population with a decreasing purchasing power. Nevertheless, in a context in which most economic agents register decreasing revenues, America's number one retailer -- Wal-Mart -- registers growing profits.

The company does nevertheless encounter numerous challenges as a result of internal vulnerabilities and external threats. In addressing the risks which face Wal-Mart, the current report has used the Risk Management Guide for Information Technology Systems, from the Special Publication 800-30 of the National Institute of Standards and Technology. The choice for this methodology was made as it is easily accessible and applicable, regardless of the field in which the entity operates.

The analysis of the risk has revealed two primarily important risks -- the threat of the economic instability in the current climate and the vulnerability of the past failures with international expansion. The negative reputation of the company represents a medium level risk and the competition in the industry represents a low level risk. Recommendations were forwarded to addressing all of these risks.

1. Introduction

The corporations in the United States are no longer only important from an economic perspective, but they have grown to be part of the American culture. Figures of corporate founders, such as the Sam Walton, Henry Ford or the McDonald brothers are part of American history and their heritage foundations are not just employment places, they are in fact integrant parties of the American society.

But in recent years, these corporations have been presented with the pressures of the internationalized economic crisis and many of them were forced to downsize or even declared bankruptcy. The main problems were pegged to the decreasing incomes and purchasing powers of the consumer, materialized in a low demand for products and services. But in this day and age, despite the limitations encountered, some corporations continue to thrive. Such is the case of America's number one retailer -- Wal-Mart.

Numerous accusations have been forwarded against Wal-Mart through its existence, but it is nevertheless true that the company is a symbol of corporate success. A question is however being posed relative to the future stability of the firm in the current circumstances, given the risks it faces. To better understand these risks however, it is first necessary to understand the features of the firm and the industry in which it operates.

3. Risk assessment

The assessment of the risks facing the Wal-Mart Stores is important to understanding the jeopardy which threatens it, but also to revealing solutions to reducing the chances of the risks materializing. There are several means of assessing the risk, each relevant and applicable in specific contexts. For the current risk assessment process, the methodology was selected as it reveals clarity and easy applicability. Specifically, however it is created in the context of the IT industry, the methodology hereby used is applicable in virtually all business fields.

The risks facing the Wal-Mart Stores would be assessed with the aid of the Risk Management Guide for Information Technology Systems, featured in the Special Publication 800-30 of the National Institute of Standards and Technology, Technology Administration at the United States Department of Congress. This specific methodology is composed from nine gradual stages, as follows:

Step 1: System characterization, in which emphasis is placed on the information related to the system and the method used in the collection of the information

Step 2: Threat identification, at the level of which focus is placed on the identification of the sources of threats and the threat motivation and actions

Step 3: Vulnerability identification, where emphasis falls on the identification of the sources of vulnerability and the assessment of the security of the system

Step 4: Control analysis, where emphasis is placed on the control methods, the control categories and the technique of control analysis

Step 5: Likelihood determination, where assumptions are made over the likelihood of the threats and vulnerabilities materializing

Step 6: Impact analysis, during which phase emphasis is placed on the estimation of the impacts which would be felt in case the threats and the vulnerabilities materialize

Step 7: Risk determination, during which stage emphasis is placed on the identification of the risks, based on the chances of materialization of the threats and vulnerabilities, as well as based on the impacts which would be felt. At this stage, the identified risks are ranked in order of severity and importance.

Step 8: Control recommendations, at the level of which recommendations are formulated in the mitigation of the identified risks

Step 9: Results documentation (Stoneburner, Goguen, Feringa, 2002). At the level of the ninth step, it has to be noted that this specific stage of the risk assessment process refers to the actual completion of the report on the information collected throughout the research process. The ninth step is in essence represented by the entire project, which centralizes the findings of the research conducted. A separate section for this step would not as such be integrated.

The chart below indicates the structure and components of the risk assessment methodology.

Source: Stoneburner, Goguen, Feringa, 2002

Since the method is in fact developed for the IT systems, it would be applied to the case of Wal-Mart through adaptation of the specifics. In other words, while the nine steps are preserved, their particular applications and contents would differ based on the differences between IT and retail systems.

3.1. System characterization

Wal-Mart is the largest retailing company within both the United States as well as within the entire world, revealing a size larger than that of its primary competitors combined. The company employs more than 2 million staff members across the world and argues that it strives to create favorable and stimulating workplaces, to support the development of the communities in which it operates, and most importantly to help its customers lead a better life by delivering more value at lower costs.

"We save people money so they can live better. Saving people money to help them live better was the goal that Sam Walton envisioned when he opened the doors to the first Walmart. This focus drives everything we do at Walmart. And, for the millions of customers who shop in our stores around the world each week, it means they can trust that our brand means we have every day low prices" (Wal-Mart 2011 Annual Report).

3.2. Threat identification

The identification of the threats in the assessment of risks can be correlated with the marketing stage of threat identification in the construction of the SWOT analysis. As in the marketing effort, the threats at the level of risk assessment are pegged to external features which jeopardize the stability and general well-being of the Wal-Mart Stores. The threats which impact Wal-Mart's stability refer to the following:

The general state of the economy. This threat is problematic since consumer spending is pegged to consumer income, which is being jeopardized by the internationalized economic crisis. The globalization of the economic shortages translates into the threatening of Wal-Mart's revenues within the United States as well as outside it.

The incremental competition which threatens to move into Wal-Mart's consumer market. The retail industry is a highly competitive industry in which revenues are high and as such alluring to numerous players.

3.3. Vulnerability identification

Similar to the identification of the threats, the detection of the vulnerabilities also has a correspondent in marketing, namely the identification of the weaknesses in the construction of the SWOT analysis. In both cases, the vulnerabilities and the weaknesses refer to internal issues which create strains on the overall stability of the firm. In the IT application of the risk assessment method, the risks would be pegged to the combination of the threats and the vulnerabilities, but in the scenario of Wal-Mart, the threats and the vulnerabilities are different, linked to diverse variables and of significant importance. They would as such be treated as independent generators of risks.

In the case of Wal-Mart then, the main vulnerabilities would refer to the following:

Its past failures with efforts of international expansion

The negative image perceived by the public regarding Wal-Mart

a) Past efforts of international expansion

Wal-Mart currently generates an estimated 26 per cent of its revenues from international operations and this figure has been following an ascendant trend, and is also expected to maintain its trend as international operations would continue to grow in size and importance (Wal-Mart 2011 Annual Report). Still, it has to be noted that most of Wal-Mart's operations remain concentrated in the United States. And out of the operations which do generate profits outside the country, most of these originate from Canada and Mexico. Wal-Mart has also opened some stores on the Asian continent which succeed, but its experiences in Europe have been negative ones.

Wal-Mart had long been awaiting an opportunity to penetrate the European market, and when it did so, it was determined to bring Sam Walton's vision into the Old Continent. Yet, the Old Continent seemed incompatible and this is mostly relevant by the failure in Germany. Here, the employees and the population, who are more reticent and more private individuals, did not welcome the morning cheer and the enthusiasm and optimism of the Wal-Mart culture. Then, German employees were strongly embedded in the culture of labor unions to protect their rights. Wal-Mart U.S. discourages unions and uses the technique to reduce costs with the personnel. As this approach was unsuitable in Germany, it came to register more costs. Then, there was also the strong competition, as Europe is filled with hypermarket chains, such as Cora, Carrefour, Metro, Lidl and several others more, competition which was ignored by the American retailer. After nearly a decade of struggle and millions of dollars lost, Wal-Mart decided to retreat from Germany. Overall, its failure in Europe would be explained by its failure to understand and adapt to the local cultures.

"The circumstances of the company's failure to establish itself in Germany give reason to believe that it pursued a fundamentally flawed internationalization strategy due to an incredible degree of ignorance of the specific features of the extremely competitive German retail market. Moreover, instead of attracting consumers with an innovative approach to retailing, as it has done in the U.S.A., in Germany the company does not seem to be able to offer customers any compelling value proposition in comparison with its local competitors" (Knorr and Arndt, 2003).

b) Wal-Mart's reputation

Another internal vulnerability of Wal-Mart's is linked to the fact that it has a negative reputation within the communities in which it operates. Some of the more important accusations which have been forwarded against the retailer throughout the years include the following:

Wal-Mart's treatment of the employees, including the low wages it offers, the limited medical coverage, the fact that it asks the employees to work long hours and does not pay the extra hours or even the accusations that it discriminated African-Americans and women in favor of Caucasian males, for promotions into managerial positions.

Wal-Mart's penetration of the small communities, leading to the bankruptcy of the mom & pop stores.

Wal-Mart's lack of emphasis on product quality. The company has for instance been accused of importing products from cost efficient regions, in unsafe and unsanitary conditions.

Wal-Mart's lack of emphasis on consumer safety. The retailer was accused of ensuring full surveillance and safety within the store to ensure that products are not being stolen, but does not ensure any surveillance and safety in the parking lots, where people are being robbed or even killed (Greenwald, 2005).

3.4. Control analysis

At this level of the risk assessment, it is necessary to review the means in which the company has so far responded to the threats in the external environment in order to reduce the chance of these threats materializing. In this order of ideas, the measure taken by the firm in addressing the competition and the economically weakening customer base refers to the sustained emphasis on the price -- Wal-Mart's already existent focal point. In other words, the company has focused on consolidating its position as a price leader within the industry.

3.5. Likelihood determination

At this level of the risk assessment analysis it is important to look at both internal vulnerabilities as well as the external threats and see what is the likelihood of them materializing. In this order of ideas, the following specifications are noteworthy:

Threat no. 1: Economic instability -- the chances for this threat to materialize are difficult to estimate because the general state of the economic crisis is uncertain. One source comes to indicate that the critical point of the crisis has been passed, whereas a different source will indicate that the worst of the crisis is yet to come. In this context then, it is difficult to state whether the purchasing powers of consumers would increase or decrease. Nevertheless, the safer assumption at this stage is that of the crisis still unfolding, and the possibility of negative turnouts still being present.

Threat no. 2: Competitive threats -- At this stage it is noted that Wal-Mart is already the leader of the retail industry and that it would be difficult for any retailer to overthrow it.

Vulnerability no. 1: Failure in international expansion -- Wal-Mart's international revenues represent an estimated one quarter or all revenues and the company intends to increase this figure in the future. In a context in which it aims to increase its global presence, its inadequacies in its global strategies are highly likely to materialize.

Vulnerability no. 2: Negative reputation -- Finally, the negative reputation which has been attached to the American retailer is highly likely to materialize in problems and negative reactions from the public, especially when it opens a new store and by this jeopardizes the economic stability of an already weak community.

3.6. Impact analysis

As the vulnerabilities and the threats combine and result into impacts, it is necessary to assess these impacts in terms of their natures as well as in terms of their strength. The table below reveals the impacts which could be pegged to the materialization of the threats and the vulnerabilities.

Threat / vulnerability

Impacts

Magnitude of impact

Economic instability

- Decrease in sales

High

Competition

- Decrease in sales

High

Failure of international expansion

- Loss of investments

High

Negative reputation

- Failure of national expansion

High

3.7. Risk determination

In a traditional context of applying the Risk Management Guide for Information Technology Systems, the stage of risk determination would be highly complex and determined by quantitative tools of assessing the importance of each risk. Specifically, the risk would be identified as function of the following:

"The likelihood of a given threat-source's attempting to exercise a given vulnerability

The magnitude of the impact should a threat-source successfully exercise the vulnerability

The adequacy of planned or existing security controls for reducing or eliminating risk" (Stoneburner, Goguen, and Feringa, 2002).

In the current scenario however, of analyzing the risk pertaining to the activities of Wal-Mart, the previous stages have revealed notable levels of likelihood and impacts. The impacts of all threats and vulnerabilities are high, indicating high levels of risk, but the threats and vulnerabilities are marked by different levels of likelihood, which as such reveal differences in the degrees of risk they pose. The matrix below assesses the degrees of risk associated with each threat and vulnerability.

Likelihood of materialization

Level

Likelihood of materialization

Value

Impact of materialization

Level

Impact of materialization

Value

Risk

(Likelihood x impact)

Value

Risk

Level

Threat 1: Economic instability

High

1.0

High

1.0 x 100 = 100

High

Threat 2: Competition

Low

0.1

High

Low

Vulnerability 1: International expansion failure

High

1.0

High

1.0 x 100= 100

High

Vulnerability 2: Negative reputation

Medium

0.5

High

Medium

3.8. Control recommendations

Based on the previous step, the ranking of the risks is uncovered as follows:

1 -- The highest levels of importance are revealed by the economic instability and the company's previous failures with international expansion

2 -- The negative reputation of the company is a medium level risk

3 -- The threat of the competitive players in the industry is a low level risk.

With this ranking in mind, it is now essential to propose several recommendations as to how the risks could be better controlled by the American retailer.

a) Recommendations for dealing with the threat of economic instability

Focusing on price leadership to ensure that Wal-Mart remains the preferred destination of shoppers even if they come to be on a tighter budget

Withholding from making major investments in order to preserve the company's financial stability. The executive team should in essence focus on savings in order to be able to cover any future losses.

b) Recommendations for dealing with the vulnerability of global expansion

Conducing thorough analyses of the markets in which the company intends to launch its operations

Understanding and eliminating -- as well as possible -- the barriers which prevent the company from successfully penetrating the region. These could include fiscal barriers, legal barriers and so on Studying, understanding and adapting to the features of the local culture

Selecting regions for expansion where the retail sector is underserved, in detriment of regions where the concentration of retailers is increased (as was the case of Germany).

c) Recommendations for dealing with the vulnerability of negative reputation

Investing in improving the reputation

Becoming involved in, and supporting, community efforts for development, such as charity events, educational events, sports events and so on Investing more in the better treatment of the employees through the offering of incentives such as medical coverage, premiums and bonuses, team building sessions, promotional opportunities, flexible working schedules and so on.

d) Recommendations for dealing with the threat of the competitive powers

Consolidating the leading position and even improving it

Continually assessing the market to reveal and serve new consumer demands

Continually assessing the industry to reveal new trends and strategic directions implemented by the competition.

4. Concluding remarks

The modern day economic climate is extremely challenging and economic agents are faced with the need to overcome challenges, but also the possibility to seize opportunities. Wal-Mart for instance, America's greatest retailer has managed to seize the opportunities and has grown into the largest retailer at a global level. Even in these times, when economic instability is a constant around the world and when economic agents suffer bankruptcies, downsizes and losses, Wal-Mart operates on increasing revenues.

Still, despite being the embodiment of corporate success, Wal-Mart continues to face challenges. The primary sources of risks are represented by the internal weaknesses and by the external threats. The assessment of the risks has been completed with the aid of the Risk Management Guide for Information Technology Systems in the Special Publication 800-30 of NIST. This methodology was selected due to its versatility and applicability in numerous instances and due to the structure and clarity offered by its nine steps.

In a nutshell, it was identified that Wal-Mart faces four important risks -- the economic climate, the competition, the past failures with global expansion and the negative reputation, each with varying degrees of importance. In order to overcome these challenges, the company should implement a complex strategic program, through which it would address all these risks and reduce the chances of their materialization. In terms of the economic climate for instance, it was recommended for the firm to consolidate its price leadership position. In regard to the competition, it was proposed for the company to assess their strategic evolutions and decisions. In respect to international expansion, the key recommendation is that of adaptation to the local ways. And finally, in terms of their reputation, it was suggested that the company invested more in positioning itself as a valuable member of the community.

All in all however, the risks to which Wal-Mart and other economic and technologic agents are exposed continually change, develop and reemerge. This virtually means that the ultimate recommendation is for the professional groups to constantly review the markets and the industries in which they operate in order to quickly identify and respond to emergent risks.

Bibliography:

Greenwald, R., 2005, Wal-Mart: The High Cost of Low Price, Documentary -- The documentary is generically a less traditional sources of information in the construction of research reports. Nevertheless, this particular report was chosen as it presented numerous issues relevant in the context of the analysis conducted, and it presented them through the lenses of the affected people, rather than through the lenses of the organization. The documentary cites employees and other parties which have interacted with the retailer and presents their sides of the story, which become combined and centralized to create a negative reputation of Wal-Mart.

Knorr, A., Arndt, A., 2003, Why did Wal-Mart fail in Germany? Institute for World Economics and International Management, http://www.iwim.uni-bremen.de/publikationen/pdf/w024.pdf last accessed on July 12, 2011 -- Knorr and Arndt's article details the reasons as to why Wal-Mart's entry into the European continent -- with specific emphasis on Germany -- has been unsuccessful. The article has been selected due to its sources -- The Institute for World Economics and International Management -- which testifies to the accuracy of the information, its reliability and its objectivity. At a general level, the article is create using more qualitative approaches rather than quantitative ones, and its findings indicate that Wal-Mart's breakdown in Germany is due to the company's inability to comprehend and adapt to the specifics of the European market place.

Stoneburner, G., Goguen, A., Feringa, A., 2002, Risk Management Guide for Information Technology Systems, NIST Special Publication 800-30, http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf last accessed on July 12, 2011 -- This specific source is useful as it presents the nine steps of the methodology used in the assessment of the risks pertaining to the operations of the Wal-Mart Stores. The limitation is however pegged to the fact that the model is created for systems within the Information Technology field. Still, the nine steps of the process can be customized and applied to any company, regardless of the industry in which it operates.

Wal-Mart 2011 Annual Report, Wal-Mart Website, http://walmartstores.com/sites/annualreport/2011/financials/Walmart_2011_Annual_Report.pdf last accessed on July 12, 2011 -- The Wal-Mart Annual Report is a highly relevant and reliable source of information as it reveals figures directly computed by the organization. It as such integrates information which is relevant and clear, without any shadow of doubt regarding its sources. Nevertheless, while the accuracy of the facts and the figures is not disputable, it has to be recognized that the annual report is part of the organizational documents and represents a means of the company's interaction with its stakeholders. In this order of ideas, the company would use the Annual report to place itself in a favorable light. This specifically means that the company would emphasize on its strengths and achievements, but it would leave out its problems. This shortage generates the need to search for answers to the risks faced by Wal-Mart in other sources.

2011, Wal-Mart Stores Inc., Hoovers, http://www.hoovers.com/company/Wal-Mart_Stores_Inc/rrjiff-1.html last accessed on July 12, 2011 -- Hoovers is a specialized database which offers valuable information on companies across the globe, of various sizes and in numerous industries. The website is especially user-friendly, revealing a textbox in which the user types the name of the company of interest and Hoovers retrieves the report it has on the company. At the level of the overview, the report contains information on the contact details of the firm of interest, a brief description of the store and of the competitive landscape. The shortage is however revealed by the fact that the detailed report is not immediately accessible, but a fee has to be paid for it. Nevertheless, the Hoovers website does represent a solid starting point in the analysis of companies and industries.