RISK AND RISK MANAGEMENT
Risk
threats, dangers, possibility of financial loss
anything that could negatively impact the entity’s ability to meet its business objectives
possibility that events will or will not occur and affect the achievement of strategies and business
objectives (could affect positively or negatively)
exists whenever a future outcome or future event cannot be predicted with certainty and a range
of different possible outcomes or events might occur (for risk to exist there are two requirements.
Degree of uncertainty and the outcome must matter)
Note: your objective should define your risk
Organization Definition
International Risk is the effect of uncertainty on objective and the effect is a
Organization for positive or negative deviation from what is expected
Standardization (ISO)
Traditional risk definitions combine a potential event with
probability and severity
ISO points out that risk is goal-specific
Institute of Internal Risk is the possibility of an event occurring that will have an
Auditors impact on the achievement of objectives. Risk is measured in
terms of impact and likelihood. (event-specific)
Institute of Risk Risk is a combination of the probability of an event and its
Management consequences. Consequences could either be positive or
negative (event-specific).
CATEGORIES OF RISK
Pure Risk Speculative Risk
A downside risk A two-way risk
Is a risk where there is a possibility that an Is a risk where the actual future event or
adverse event will occur. Events might turn outcome might be either better or worse
out to be worse than expected but they than expected
cannot be better than expected Cannot be avoided because risk must
Is a risk that can often be controlled either be taken in order to make profits. As a
by means of internal control or by general rule, higher risks should be
insurance. justified by the expectation of higher
Also called as internal control risks or profits (although events might turn out
operational risks worse than expected) and a company
needs to decide what level of
speculative risks are acceptable.
Speculative risks are usually called
business risk and might also be called
strategic risk or enterprise risk.
Market Risk
is the risk from changes in the market price of key items such as the price of key commodities
market prices can go up or down and a company can benefit from a fall in raw material prices or
incur a loss from a rise in prices
Credit Risk
is the risk of losses from bad debts or delays by customers in the settlement of their debts
All companies that give credit to customers are exposed to credit risk.
The size of credit risk depends on the amount of receivables owed to company and the credit
quality of the customers
Liquidity Risk
Is the risk that the company will be unable to settle its liabilities when payment is due.
It can occur when a company has no money in bank, is unable to borrow more money quickly,
and has no assets that it can sell quickly in the market to obtain cash.
Companies can be profitable but still at risk from liquidity shortage
Technological Risk
Is the risk that could arise from changes in technology or inadequacy of technological systems in
use.
When a major technological change occurs, companies might have to make a decision about
whether or not to adopt new technology
Legal Risk
which includes regulatory risk, is the risk of losses arising from failure to comply with laws and
regulations and also the risk of losses from legal actions and lawsuits
Health, Safety and Environmental Risk.
Are risks to health and safety of employees, customers and the general public.
Environment risks are risks of losses arising in the short term or long term from damage to the
environment – such as pollution or destruction of non-renewable raw materials
Reputation Risk
Is the risk that a company’s reputation with the general public and customers or the reputation of
its product brand will suffer damage.
Damage to reputation can arise in many different ways; incidents that damage reputation are
often reported by the media
Business Probity Risk
Probity means honesty and integrity.
Is the risk of losses from failure to act in an honest way
Risk Management (COSO Definition)
Is a process applied in strategy setting across the enterprise designed to identify potential events
that may affect the entity and manage risks within the risk appetite to provide reasonable
assurance regarding the achievement of the entity’s objectives
Is a corporate governance issue
Manage risk in creating, preserving and realizing value
Risk management process:
1. Identify
Risk identification means company needs to understand what risks it face, both in
environment and markets (strategic risks) and internally (operational risks).
This may be aided by creation of risk committee. These are committees of managers
from several departments or functions and helps in identification of risk
2. Assess
Assess the importance of the risks in order to:
o Rank the risks in order of significance
o Identify the risks that are most significant
o Identify the risks where control measures are urgently needed
This is the stage of actually assessing the risk and is also called the risk profiling or risk
mapping
To assess each risk, it is necessary to consider the likelihood that losses will occur as a
consequence of the risk and the size or amount of loss (impact) when this happens
Assessment may be done qualitatively or quantitatively
Sample Risk Map
5
4
3
Probability 2
1
1 2 3 4 5
Impact
High Impact High Impact
Low Probability High Probability
High Impact Consider the need for Take immediate action
control measures such as to control the risk
IMPACT OF insurance
POTENTIAL
LOSS
Low Impact Low Impact Low Impact
Low Probability High Probability
Review Periodically Consider the need for
control action
Low Probability Frequency High Probability Frequency
PROBABILITY OF FREQUENCY OF THE RISK MATERIALIZING
3. Respond
Action plan
4. Monitor
Risk Appetite (how much you are willing to accept)
The amount of risk on a broad level, an organization is willing to accept in pursuit of value
Affected by your risk capacity (how much you can accept)
Acceptable variation in performance
The boundaries of acceptable outcomes related to achieving business objectives
Tolerance
Tolerance
Target
Risk
Performance
RISK PROFILE RISK APPETITE RISK CAPACITY
Objectives
Efficiency and effectiveness of operations
Compliance with laws and regulations
Reliability in financial reporting
Essentials of Risk Management
Language – understand the same language
Process – identify, assess, respond, and monitor
Ratings – scaling method/qualitative/quantitative
Response
o Risk diversification
Do not put all your eggs in one basket
To invest in a range of different business activities and build up a portfolio of
different business activities
A diversification strategy by a company might be appropriate provided that its
management have the skills and experience to manage the portfolio of different
business activities
A diversification strategy by a company is much riskier and less appropriate
when it takes the company into unrelated business activities
Risk are not reduced significantly by diversifying into different activities where the
risks are similar so that if there is an adverse change in one business activity,
there is a strong probability that adverse changes will also occur in the other
activities
o Risk Transfer/risk sharing
Involves collaborating with another person and sharing the risks jointly
Common methods of risk sharing in business are partnerships and joint ventures
o Hedging
Means creating a position (making a transaction) that offsets an exposure to
another risk
o TARA Framework
Transfer/Share
Avoid
Reduce
Accept
High
Transfer Avoid
Risk of lawsuit Transmission
Probability from students due to face to
face classes
Accept Reduce
Risk of damage Risk of damage
to classrooms to reputation
Low Impact High
High
System-based System-based
detective preventive
Probability
People-based People-based
detective preventive
Low Impact High
Enterprise Risk Management Framework
portfolio view
Note: In COSO, risk management is under performance
