Risk Management Fundamentals

Risk Management Reviewer

Orientation

• Risk management involves coordinated activities to direct and control an organization with regard to risk.
• It includes identification, evaluation, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability or impact of unfortunate events.

Key Concepts in Risk Management

• Risk: probability of an outcome having a negative effect on people, systems, or assets.
• Stakeholder: a party that has an interest in a company and can either affect or be affected by the business.
• Risk sources: usual potential reasons and causes risks in the organization.
• Event: occurrence or change of a particular set of circumstances.
• Consequences: outcomes or effects of one action.
• Likelihood: probability of an event occurring.
• Control: measure that maintains or modifies risk.

Principles of Risk Management

• Integrated: risk management should be a part of, and not separate from, the organizational purpose, governance, leadership, and objectives.
• Structured and Comprehensive: risk management involves a systematic process that is tailored to the organization's context.
• Customized: risk management should be customized and proportionate to the organization's external and internal context.
• Inclusive: risk management involves the appropriate and timely involvement of stakeholders.
• Dynamic: risk management anticipates, detects, acknowledges, and responds to changes and events in an appropriate and timely manner.
• Best Available Information: risk management is based on the best available information, including historical and current data, as well as on future expectations.
• Human and Cultural Factors: human behavior and culture significantly influence all aspects of risk management.
• Continual Improvement: risk management is continually improved through learning and experience.

Framework of Risk Management

• Provides guidance to the company on integrating risk management into its activities and functions.
• Sets the scene for the ongoing successful application of risk management.

Risk Management Process

• Leadership and Commitment: ensuring risk management is integrated into all organizational activities and demonstrating leadership and commitment.
• Communication and Consultation: facilitating factual, timely, relevant, accurate, and understandable exchange of information among stakeholders.
• Scope, Context, and Criteria: customizing the risk management process, understanding the external and internal context, and defining risk criteria.
• Risk Assessment: identifying, analyzing, and evaluating risks to determine their significance and prioritize risk treatment.
• Risk Treatment: selecting and implementing options for addressing risk.
• Monitoring and Review: continually monitoring and reviewing the risk management process to ensure its effectiveness.

Risk Assessment

• Risk Identification: documenting potential risks that could impact the organization's objectives.
• Risk Analysis: detailed consideration of uncertainties, risk sources, consequences, likelihood, events, scenarios, controls, and their effectiveness.
• Risk Evaluation: comparing the results of the risk analysis with established risk criteria to determine where additional action is required.
• Risk Treatment: selecting and implementing options for addressing risk.

Risk Management Principles and Process

• Integrated, structured, and comprehensive

• Customized, inclusive, and dynamic

• Based on best available information

• Continually improved through learning and experience### Risk Management Process

• Risk treatment involves an iterative process of formulating and selecting risk treatment options, planning and implementing risk treatment, assessing the effectiveness of that treatment, and deciding whether the remaining risk is acceptable.

• Risk analysis should consider factors such as the likelihood of events, the nature and magnitude of consequences, time-related factors, volatility, complexity, and connectivity.

• Risk analysis may be influenced by divergence of opinions, biases, perceptions of risk, and judgments, as well as the quality of information used, assumptions, and limitations of techniques.

Risk Treatment Options

• Options for treating risk may involve avoiding the risk, taking or increasing the risk, removing the risk source, changing the likelihood or consequences, sharing the risk, or retaining the risk.
• The selection of risk treatment options should be made in accordance with the organization's objectives, risk criteria, and available resources.

Monitoring and Review

• Monitoring and review are critical aspects of the risk management process, ensuring that risks are effectively managed and new risks are identified and addressed in a timely manner.
• Monitoring and review involve planning, gathering, and analyzing information, recording results, and providing feedback.

Recording and Reporting

• Recording and reporting aim to communicate risk management activities and outcomes across the organization, provide information for decision-making, improve risk management activities, and assist interaction with stakeholders.
• Factors to consider for reporting include differing stakeholders and their specific information needs, cost, frequency, and timeliness of reporting, method of reporting, and relevance of information to organizational objectives.

Enterprise Risk Management (ERM)

• ERM is a holistic approach employed across the entire organization to identify, assess, and manage various risks that an organization may encounter in pursuit of its objectives.
• ERM objectives include promoting a strong risk culture, aligning with organizational strategy, establishing risk governance, safeguarding reputation, and ensuring legal compliance.

Strategic Planning for Enterprise Risk Management

• Strategic planning helps ensure that all stakeholders are equipped to contribute to ERM efforts and make informed decisions that mitigate risks and capitalize on opportunities.
• By systematically assessing risks and their potential impact on strategic objectives, organizations can make more informed choices that balance risk and reward.

Strategic Enterprise Risk Management (SERM)

• SERM is an integrated approach that enables organizations to align their risk management processes with strategic decision-making, thereby improving overall performance and resiliency.
• Important aspects of SERM include alignment with objectives, proactivity, and continuous improvement.

Types of Business Risks

• Operational risks pertain to day-to-day challenges encountered during business operations, including internal process inefficiencies, human errors, technological breakdowns, and supply chain disruptions.
• Financial risks arise from factors that jeopardize a company's financial stability, such as market volatility, credit defaults, liquidity constraints, and currency fluctuations.
• Strategic risks arise from uncertainties surrounding long-term objectives and plans, stemming from changes in the market landscape, competitive pressures, regulatory dynamics, and shifting consumer preferences.

Roles of Strategic Planning in ERM

• Strategic planning involves setting objectives that support the mission and goals of a company, identifying potential events that might impact an organization, assessing risks, and developing risk response strategies.
• It helps organizations prioritize risks, allocate resources effectively, and enhance their ability to seize opportunities and respond to threats.### Enterprise Risk Management (ERM)
• ERM considers the organization's overall risk appetite and tolerance levels, enabling a balanced approach to risk management that facilitates strategic growth while mitigating potential threats.
• ERM takes a comprehensive view of organizational risks, identifying and addressing interconnected risks proactively to prevent escalation into significant threats.

Risk Management Process

• Objective Setting: set objectives that support the mission and goals of a company, aligned with the company's risk appetite.
• Event Identification: identify important areas of the business and associated events that may have dire outcomes.
• Risk Assessment: determine the likelihood, severity, and ability to respond to identified risks.
• Risk Response: develop and implement actions to mitigate or respond to identified risks.
• Control Activities: create policies and procedures to ensure management carries out operations while mitigating risk.
• Information and Communication: capture data useful to management to better understand a company's risk profile and management of risk.
• Monitoring: review what is actually performed compared to what policy documents suggest.

Integrating ERM into Strategic Planning

• Benefits of integrating ERM into strategic planning:
  • Enhance performance, reduce costs, and increase profits.
  • Identify potential risks and devise strategies to mitigate them to maximize success.
  • Align risk management processes with strategic performance and resiliency.

Components Involved in Strategic Planning for ERM

• Internal Environment: sets the tone for how risk is viewed and addressed within the organization.
• Key Risk Indicators (KRIs): measurable data used to provide an immediate indication of potential risks to accomplishing objectives.
• Types of KRIs:
  • Lagging indicators: measure the real performance or record the actual risks of the organization.
  • Leading indicators: anticipate future outcomes, used to forecast risks associated with the company reaching its goal.

Tools and Techniques for Strategic ERM

• Key Risk Indicators (KRIs):
  • Measurable: expressed as percentages, figures, etc.
  • Relevant: significant to the company and its objectives.
  • Comparable: comparable to trends over time and can be compared both internally and to the existing industry standards.
• Risk Register: a document or file used to track and manage risks related to initiatives, operations, and projects.
• Risk Matrix: a visual tool used to map out risks, measuring the likelihood of the risk occurring and its severity.
• Scenario Analysis: an assessment technique used to identify and measure the potential occurrence of operational risk events.

Risk Management Software

• Companies can use risk management software to make their risk management easier and standardized.
• Examples of risk management software: Resolver, Oracle, SAS.

Risk Culture

• The purpose of establishing the scope, context, and criteria is to customize the risk management process, enabling effective risk assessment and appropriate risk treatment.
• Components of risk culture:
  • Scope: defines the boundaries of the risk management process.
  • Context: understands the external and internal context.
  • Criteria: sets the conditions for risk assessment and treatment.

Setting Risk Criteria

• Qualitative Risk Criteria: shows the conditions in an accepted risk of an organization.
• Cost Benefit Criteria: determines the cost benefit in terms of risk reduction.
• Setting risk criteria: objectively decided by the organization, setting the risk on a numerical basis whether it needs immediate action or not.