Risk and Uncertainty

Introduction to Risk & Uncertainty

• Risk and uncertainty are often used interchangeably, but risk is the probability of harm from a hazard, potentially involving loss.
• Uncertainty is divided into calculable probabilities based on past events and immeasurable probabilities with no discernible pattern or unique events.
• Frank Night differentiates the calculable group as risks and the latter as uncertainties in his book "Risk, Uncertainty and Profit".
• John Maynard Keynes believed surprise is an important element of uncertainty and affects decision-making across individuals, businesses, and society.
• Risk is a state of nature, while uncertainty is a state of mind.
• A situation is risky when there are multiple possible outcomes, but the actual result is unknown in advance.
• Risk is the relative variation of the actual outcome from the anticipated or expected outcome.
• The development of a new product for a manufacturing firm is risky due to profits being uncertain before actual sales.
• Similarly, developing a new drug has risk because of the range of market reception outcomes.

Classification & Types of Risks

• Risks are classified in four ways
• based on source, nature, status, and consequences.
• Risk based on Source can be internal or external in origination.
• Risk based on Nature can be controllable or uncontrollable.
• Risk based on Status can be inherent or residual depending on mitigatory actions.
• Risk based on Consequences can be strategic, operational, or financial based on business functions.

Risk Based on Source – Internal and External Risks

• Internal risks originate within the enterprise during normal business, making them easier to anticipate and manage.
• Production, people, technical, physical, and process factors can result in internal issues.
• External risks come from outside the organization and are harder to predict and manage.
• Economic, political, nature, environment, market or industry factors.
• Management can quantify the possibility of internal risks with greater precision and influence their outcome.
• External risks are studied more to improve organizational ability to deal with them, as enterprises employ economists to monitor businesses.

Risk Based on Nature – Controllable and Uncontrollable Risks

• Controllable risks can be influenced to a great extent by management with there being various ways to exert influence over outcomes.
• Uncontrollable Risks cannot be influenced to a reasonable extent.
• Controllable risks: Safety precautions, technology deployment, and employee awareness.
• Uncontrollable Risks: Sabotage, flooding, and terrorist attacks.
• Controllable risks are easier to predict, allowing preventable measures, whereas uncontrollable risks require reactive measures to minimize impact.

Relationship between Source and Nature of Risk

• A relationship exists between the source of risks (internal/external) and the nature of the risk (controllable/uncontrollable)
• The possibility exists of any combination or situation somewhere in between.
• Internal risks are usually more controllable, while external risks are more uncontrollable.
• Risk is highest for external uncontrollable factors and lowest for internal controllable factors.
• To manage risks, move them from the higher to the lower region.
• Example: Lobbying for favorable legislation is a way of controlling external Risk.

Risk Based on Status – Inherent and Residual Risk

• Risks are all pervasive and inherent in all business activity due to their inherent uncertainty.
• An "Inherent Risk" acknowledges the presence of risk in 'raw form' before any risk treatment.
• Residual Risk remains untreated after mitigation, either accepted reluctantly or consciously as the treatment can cost too much.

Risk Based on Consequences – Outcome of Event

• Risks are classified based on how they unfold and impact various business aspects/functions.
• Strategic, operations, brand/reputation, customer, finance, law and regulations, knowledge, technology, management and employees, and location/geography are typical areas of consequence.
• This is not a complete list with one risk capable of being assigned in more than one category.
• Strategic Risks, are very significant and affect the company's fundamental business or long-term objectives, concerning changes to the business environment, industry, or political and economic conditions.
• Operational Risks impact how the organization prepares and delivers its product/service to customers and are more internal in nature
• Brand/Reputation Risks can tarnish the company's image due to poor perceptions from customers or stakeholders, stemming from events that shake the company's core values.
• Customer Satisfaction Risks affect the quality of product or service, but not severely enough to impact the brand, slower in nature, and stem from experiences.
• Financial Risks deal with the company's financial matters, including financial viability and how information is shared by the company with capital availability and investments.
• Laws and Regulations Risks result from legal non-compliance resulting in penalties or lawsuits as well as compliance to internal policies including Risks to intellectual property.
• Knowledge Risks involve information of a confidential nature with a bearing on the achievement of objectives, where corruption to or loss/theft of information could result in damage to business viability.
• Technology Risks rise because of dependence on the use, ownership and operation of technology or from not keeping pace with changes, including a poor understanding of nuances.
• Management and Employees (HR/People) Risks affect the employees and management due to dependence on individuals as well as optimum utilization of people to achieve objectives.
• Location/Geography Risks include dependence on a particular geography or location to achieve company-wide objectives.
• Fraud Risk includes misstatement of information or misappropriation of assets
• Audit Risk: Audit risk is related mainly to the external and internal audit efforts designed to provide audit assurance to the area subject to audit as well as the risk of incorrect audit conclusions by flawed evidence.

Risk Classification Linkages

• Risk classification seeks a type of benefit linking all the classification effort together to achieve clarity, appreciation of risk dynamics, and a better road map.
• Internal and external environments are a source for all inherent risks to develop a risk response and classify them to either transfer or terminate them.
• Controllable risks are subject to internal mitigations to reduce their impact, resulting in residual risks.

Importance of Risk Management

• Governance functions include planning, budgeting, performance measurement, assurance and auditing, procurement, hiring, assessing staff, and control over day-to-day operations.
• Coordination is involved to both direct and control an organization and to direct and control an organization with regard to risk.
• Risk Management is the key pillar of Governance and only tool to deal with business uncertainty.
• Fortune 500 and other large companies use Risk Management to sustain & grow businesses.
• Risk management is an integral component including as an iterative process undertaken in sequence.

Objectives of Risk Management

• Risk management protects property, earnings, and personnel (prevents losses and legal liabilities).
• It minimizes costs and maximizes profitability by taking measures to reduce the possibility of a ‘risk event’.
• Corporate sector recognizes the importance of independent risk managers whose purpose is to control pure risks, analysis and control of all risks arising out of business.

Overview of Mitigation & Controls

• Identifying potential risks involved is the first step in managing Risk.
• Risks are assessed for potential loss severity, occurrence probability, and are a measure of inability to achieve objectives within cost and time constraints possessing two components: probability of failing to achieve outcome and overall consequences.
• There may be ready-made solutions to manage risk involving a risk decision not to perform an activity which is called Avoidance.
• There may be a need to accept the loss by taking a risky proposal where there are no alternatives to reduce Risk.
• Transferring risk causes another party to accept it, typically by contract.
• Risk hedging is a systematic process of reducing risk associated with an investment proposal where some risk is inevitable.

Risk Control

• Risk Control is selected to reduce loss frequency and severity requiring a cost-benefit exercise to evaluate benefits and costs.
• No cost benefit exercise is required when there is no option or it is imposed by law.
• Risk Control covers measures to avoid/eliminate/reduce loss chances to minimize cost, while ensuring long-term survival.

Opportunities in RM for CAs

• A Chartered Accountant can play a role in RM as a Manager, Auditor or Consultant.
• A chief executive officer is responsible for implementing RM and can be a member of the board of directors or CEO
• Companies form committees regarding RM where a CA can play a role.
• As a Chief Risk Officer (CRO), CAs set policy and strategy for risk management, are primary champions, build culture, implement internal policy, development risk response processes, and prepare reports.

CA as an auditor and consultant

• Auditors aware of RM can understand and use features
• As internal auditors, CAs assist management and risk management committees
• As internal or external auditors, CAs examine, evaluate report and provide recommendations from risk assessments.
• CAs are a huge number of consultants and can provide detailed advice on the business.