ACCA P1 Governance, Risk and Ethics - 2011 - Study text

Подождите немного. Документ загружается.

Paper P1: Governance, risk and ethics

224 © Emile Woolf Publishing Limited

The manager of a well known group of hotels summarised the importance of

reputation risk in general terms. He said that managing this type of risk is of top

importance for any company that has a well known brand as the brand is one of the

most important assets and reputation is a key issue.

Business probity risk

Probity means honesty and integrity. Business probity risk is the risk of losses from

a failure to act in an honest way. Companies in some industries might be exposed to

this type of risk.

 For some products, there might be a large trade in smuggled goods, such as

cigarettes and alcohol products. Companies might be tempted to deal with

smugglers in order to increase sales of their products. The consequences if any

dishonesty or crime is discovered could be criminal prosecution, fines by

government or loss of reputation with the public.

 In some countries and some industries, bribery is a problem. Companies might

find that in order to win sales in some countries, they have to pay bribes

(‘commissions’) to individuals. By failing to pay bribes, companies would not

win sales contracts. By paying bribes, companies act dishonestly, and could be

exposed to regulatory action or criminal action by the authorities of evidence of

bribery is uncovered. This problem has been reported, for example, in the

markets for the sale of military equipment.

 In the UK, various banks and insurance companies have been fined heavily by

the authorities for mis-selling products to customers that were not appropriate.

Many banks and insurance companies in the UK mis-sold endowment policies

(life assurance policies) to many customers during the 1980s and were required

to pay large amounts of compensation for the losses that those customers

suffered.

Derivatives risk

Derivatives risk is another type of risk included in the syllabus for the examination.

They include commodity derivatives and financial derivatives.

 Commodity derivatives are contracts on the price of certain commodities, such

as oil, wheat, metals (gold, tin, copper etc) and coffee. Derivatives contracts are

contracts to buy and sell a quantity of commodities at a future date at a fixed

price agreed in the contract. In most cases, the buyer and seller of the derivative

instrument do not intend to buy and sell the physical commodities. The contract

is a contract for the price, and it is settled by the payment of the difference

between the fixed price in the contract and the market price at settlement date

for the contract.

 Financial derivatives are contracts on the price of certain financial instruments or

market rates, such as foreign exchange rates, interest rates, bond prices and

share prices. Like commodity derivatives, the buyer and seller of financial

derivatives do not usually exchange items they have bought or sold. The

contract is simply a contract on the price or market rate. It is settled by a

payment for the difference between the fixed price in the contract and the

market rate at the settlement date.

Chapter 10: Identifying and assessing risk

Derivative instruments include options, futures and swaps. They can be used to

control risks by ‘hedging’ exposures to price risks (market risks). On the other hand,

they can be used to speculate on changes in market prices.

There have been incidents where the treasury department of a company or

government organisation has used derivatives to speculate on changes in market

prices, and suffered heavy losses because market prices moved against its position

in the derivative instruments. All companies with a treasury department could be

exposed to derivatives risk from trading by its treasury staff in the commodities or

financial markets. Risk management and control systems (internal controls) need to

be implemented and enforced to control the risk.

Example

One type of derivative instrument is a credit default swap (CDS). A CDS can be

described as a form of credit ‘insurance’ or credit protection. It relates to a specific

amount of a debt of a ‘credit subject’ (a bank loan owed by a specific borrower or

bonds issued by a specific company). One person can use a CDS to buy credit

protection from another person. The seller of the credit protection will be required to

make a payment to the buyer if the credit subject defaults on payment of the debt.

For example, Bank XYZ can sell credit protection to Company ABC in the form of a

credit default swap. The swap might be for $10 million of government bonds issued

by the government of Brazil. Company ABC is not required to hold any Brazilian

government bonds in order to buy the CDS. It can speculate on the possibility that

the Brazilian government will default, and hope to make a profit.

It seems probable that many organisations have traded credit default swaps, and

have speculated on the credit risk of other entities. There are no reliable statistics

about the volume and value of CDSs, and no information about who holds them. If

there is a major credit crisis in the world – for example if the Brazilian government

were to default on the payment of its bonds – the financial consequences for sellers

of CDSs could possibly be very damaging.

For any company that trades in CDSs, there is an urgent need for risk management

and suitable internal controls.

Paper P1: Governance, risk and ethics

226 © Emile Woolf Publishing Limited

2.3 Nature and importance of business and financial risks

The board of directors should consider business risk when it makes strategic

decisions. It should choose strategies that are expected to be profitable, but that the

business risks to a level that it considers acceptable. Consequently, both risk and

return should be assessed in strategic decision-making.

Business risks are strategic risks that threaten the health and survival of a business.

They vary between companies and over time.

 The failure rate is greater for those businesses in cyclical industries like tourism.

 The failure rate among new start up businesses is greater than that amongst

more mature businesses.

Note that the banking crisis in 2008 and 2009 showed that business risk can also

apply to older and more established companies in more stable industries.

Financial risk is a major cause of business risk. Cash flow and liquidity problems

can be very damaging to the financial health of a business. Such problems can be

caused by trading fluctuations but working capital management and financial

structure also play a significant role.

Whilst debt finance might be preferable when interest rates are low or necessary

when equity capital is unavailable it increases financial risk.

Example – Marconi

In the 1990s, GEC was a major UK company, specialising mainly as a defence

contractor. It had a reputation as a risk-averse company with a large cash pile. In

1996 a new chief executive led the board into a major change in the company’s

strategy. GEC sold off its defence interests and switched its business into

telecommunications, mainly in the USA, buying large quantities of

telecommunications assets. The company also changed its name to Marconi.

A number of factors, including a huge over-capacity in network supply, led to a

collapse in the market for telecommunications equipment in 2001. Many of

Marconi’s competitors saw the downturn coming, but Marconi did not. It assumed,

incorrectly, the market downturn would be brief and there would soon be recovery

and growth.

Within a year loss of shareholder confidence resulted in a collapse in the Marconi

share price, reducing the value of its equity from about £35 billion to just £800

million. In July 2001, the company asked for trading in its shares to be suspended in

anticipation of a profits warning. Not long afterwards, Lord Simpson was forced to

resign. In retrospect, investors realised that the Marconi board had not understood

the business risks to which their strategy decisions had exposed the business.

Some years later in 2006 the Marconi name and most of the assets were bought by

the Swedish firm Ericsson.

A lesson from the Marconi experience is that the board of the company took a

strategic risk without being fully aware of the scale of the risk. The risk management

systems within the company were also unable to alert management and the board of

the increasing risks to the telecommunications industry in 2001. This was poor

governance, and as a result the company lost both value for shareholders and its

independence.

Chapter 10: Identifying and assessing risk

2.4 Business risks in different business sectors

The major risks facing companies vary over time, and manager might have different

opinions about which risks are more significant than others. Risks differ between

companies in different industries or markets.

 Companies in different industries might face the same risks, but in some

industries the risk might be much greater than in other industries. For example,

credit risk is a very significant risk in the banking industry, but less significant in

the oil industry. In contrast, the risks of environmental regulation are much

higher for oil companies than for banks.

 Risks vary in significance over time, as the business environment changes.

Companies need to be alert not only for new risks, but for changes in the

significance of existing risks. Are they giving too much attention to risks that are

no longer significant? Or have they ignored the growth in significance of any

risk that has existed for a long time, but is now much more significant than it

used to be.

Example

The table below compares the significant risks facing a commercial bank, an

international oil company and a large retailing organisation. These are the significant

risks identified by three major listed companies (in the UK) in their annual report

and accounts. All three companies have extensive business interests both outside

and inside the UK.

Commercial bank Retailing organisation Oil company

Strategy risk. The risk of

choosing strategies that do not

maximise shareholder value.

Business strategy risk. Risk

that the business strategy

might take the company in the

wrong direction, or is not

efficiently communicated.

Market risk, especially risk of

changes in the price of oil and

natural gas.

Product-service risk. The risk of

developing products and

services for customers that do

not meet customer

requirements and are worse

than the products or services

offered by competitors.

Financial strategy and group

treasury risk. This covers the

risk of not having available

funds, credit risk, interest rate

risk and currency risk.

Exploration risk. The risk of

being unable to find sufficient

new reserves of oil and natural

gas.

Credit risk.

Risk of under-performance in

the UK business. This is

dependent largely on economic

conditions in the UK.

Reputation risk

Market risk. This includes the

risk from variations in interest

rates (interest rate risk) and

currency exchange rates

(currency risk) as well as the

risk of changes in market

prices of financial products

such as shares.

Competition risk. This is the

risk of losses due to the

activities and successes of

competitors.

Security risk (risk from crime,

civil wars and terrorism).

Environmental risk. The risk

from climate change.

Economic risk. Risk from

changes in the state of national

economies and the world

economy.

Paper P1: Governance, risk and ethics

228 © Emile Woolf Publishing Limited

Commercial bank Retailing organisation Oil company

Operational risks. Risks of

losses due to human error or

fraud, failures in systems (such

as IT systems) and unforeseen

external events (terrorism

attacks, natural disasters).

People capabilities risk. This is

the risk of failing to attract ‘the

best people’ to work for the

company.

Competition risk

Political risk. This is the risk of

doing business in politically

unstable countries or politically

sensitive countries.

People capabilities risk. This is

the risk of failing to attract ‘the

best people’ to work for the

company.

Reputation risk. Failure to

protect reputation could lead to

a loss of trust and confidence

by customers.

Natural disaster risk

Risk of inadequate liquidity and

inadequate capital.

Environmental risk. Risks arise

from issues such as energy

savings, transport efficiency,

waste management and the

recycling of waste.

Currency risk

IT failures risk

Regulatory risk. Product safety risk Regulatory risk

Ethical risks in the supply

chain. This is the risk to

reputation of dealing with

suppliers who do not use

ethical business practices.

Shortage of skilled labour risk,

especially a shortage of

science graduates.

Fraud and compliance risk

IT systems risk. This is the risk

of a failure in the company’s

major IT systems.

Political risk and terrorism risk

Pensions risk. The risk to the

company from the costs of

meeting its liabilities to the

company’s pension scheme for

its employees.

Chapter 10: Identifying and assessing risk

Concepts in risk management

 Exposure to risk

 The dynamic nature of risk assessment

 Risk appetite

 A risk-based approach

3 Concepts in risk management

To understand risk management, it is necessary to understand a few key concepts.

3.1 Exposure to risk

When a company is exposed to risk, this means that it will suffer a loss if there are

unfavourable changes in conditions in the future or unfavourable events occur. For

example, if a UK company holds US$2 million it is exposed to a risk of a fall in the

value of the dollar against sterling, because the sterling value of the dollars will fall.

Companies need to assess the significance of their exposures to risk. If possible,

exposures should be measured and quantified.

 If a UK company holds US$2 million, its exposure to a fall in the value of the

dollar against sterling is $2 million.

 If an investor holds £100 million in shares of UK listed companies, it has a £100

million exposure to a fall in the UK stock market.

 If a company is owed £500,000 by its customers, its exposure to credit risk is

£500,000.

An exposure is not necessarily the amount that the company will expect to lose if

events or conditions turn out unfavourable. For example, an investor holding £100

million in shares of UK listed companies is exposed to a fall in the market price of

the shares, but he would not expect to lose the entire £100 million. Similarly a

company with receivables of £500,000 should not expect all its receivables to become

bad debts (unless the money is owed by just one or two customers).

Having measured an exposure to risk, a company can estimate what the possible

losses might be, realistically. This estimate of the possible losses should help

management to assess the significance of the risk.

Some risk exposures cannot be measured, because they are ‘qualitative risks’. It is

very difficult, for example, to estimate the possible losses that could arise from

damage to a company’s reputation. Qualitative risks must also be assessed, but

since the amount of the exposure and the possible losses that might occur cannot be

quantified, an assessment of these risks depends on management judgement and

opinion.

Paper P1: Governance, risk and ethics

230 © Emile Woolf Publishing Limited

Residual risk

Companies control the risks that they face. Controls cannot eliminate risks

completely, and even after taking suitable control measures to control a risk, there is

some remaining risk exposure.

The remaining exposure to a risk after control measures have been taken is called

residual risk. If a residual risk is too high for a company to accept, it should

implement additional control measures to reduce the residual risk to an acceptable

level.

3.2 The dynamic nature of risk assessment

Organisations differ in how exposed they are to changes in internal and external

risks. The internal and external factors that affect an organisation might be very

changeable. This means that the risks faced by a company do not remain static but

change over time and in different situations.

In some situations, environmental factors change relatively little, but in other

environments, risk factors can change a great deal. These are sometimes called

‘turbulent’ environments.

The extent of possible exposure to risk due to environmental change can be

represented as a scale or continuum between two theoretical extremes that would

not be found in practice.

 At one end of the scale there is never any change in the external or internal

environment of an organisation. This does not mean that there are no risks but,

rather that the risks faced do not change. Clearly this cannot exist in practice. All

organisations will face a changing risk profile.

 At the other extreme the external or internal environment of an organisation

changes constantly with the results that all risks are changing all the time. Such a

situation does not exist in reality but situations close to it do exist.

Static Dynamic

Increasing environmental change and

turbulence

Real life situations

Organisations occupy different positions along the static/dynamic scale

(continuum). In other words some organisations face very changeable risks whilst

those faced by other companies are relatively stable. It is important to note that even

static environments might change unexpectedly. For example, many financial

services organisations rescued by governments in the credit crunch would have

been considered low risk only a few years ago (Examples include mortgage

providers Freddie Mack and Fannie May in the US and Northern Rock and RBS in

the UK).

An organisation’s risk management approach must meet the demands posed by the

complexity of the risks that it faces. Failure to respond appropriately to risk could

Chapter 10: Identifying and assessing risk

lead to failure of the organisation’s strategy or even of the organisation itself. It

follows from this that organisations in more dynamic environments need a greater

investment in risk management strategies.

3.3 Risk appetite

A company must accept some risk in order to make profits. This means that a risk of

making a loss must be accepted in order to create a chance to make profit. A

company will take the risk if its management decides that the risk of loss is justified

by the expectation of a gain.

Risk appetite is concerned with how much risk management are willing to take.

Management might be willing to accept the risk of loss up to a certain maximum

limit if the chance of making profits is sufficiently attractive to them. For a market

trader in the financial markets, risk appetite has been defined as ‘the amount of

capital that a trader is willing to lose in order to generate a potential profit.’

Risk appetite is used to describe how willing a board is to take on risk – on a scale

from willing to take on risk through willing to take some risks down to aversion to

taking a risk.

A Board of directors might also have an appetite for one type of risk but an aversion

to a different type of risk. The risk appetite of a Board or management in any

particular situation will depend on:

 the importance of the decision and the nature of the decision

 the amount and nature of the potential gains or losses, and

 the reliability of the information available to help the Board or management to

make their decision.

Board policy on risk

The risk appetite of a company should be decided by the board of directors, and a

policy on risk should be decided and communicated by the board to its

management. Managers need guidance on the levels of risk that it would be

‘legitimate’ for them to take on with any decision that they make.

 Managers should not be allowed to take whatever decisions they consider to be

suitable, regardless of risk. This would lead to inconsistent decision-making and

could expose the company to unacceptable risks. ‘Erratic, inopportune risk-

taking is an accident waiting to happen’ (HM Treasury).

 At the other extreme, a risk adverse culture is undesirable, in which managers

are discouraged from taking any risky decisions, so that business opportunities

are not exploited.

3.4 A risk-based approach

The term ‘risk-based approach’ is often used to describe risk management processes.

It is an approach to decision-making based on a detailed evaluation of risks and

Paper P1: Governance, risk and ethics

exposures, and policy guidelines on the level of risk that is acceptable (risk

appetite).

The risk-based approach takes the view that some risk must be accepted, but risk

exposures should be kept within acceptable limits. Decisions should therefore be

based on a consideration of both expected benefit and the risk.

Example

A company might use discounted cash flow to evaluate capital expenditures. If risk

is ignored, the company might have a standard rule that capital investment projects

should be undertaken if they are expected to have a positive net present value (NPV)

when the forecast cash flows are discounted at the company’s cost of capital.

With a risk-based approach, capital investment projects should not be undertaken

unless their NPV is positive and the level of risk is acceptable.

Example

A risk-based approach can also be compared with a ‘box-ticking’ approach. With a

box-ticking approach, certain procedures must be carried out every time an item is

processed. For example, the customs and immigration department at a country’s

airports might have a policy of checking the baggage of every passenger arriving in

the country by aeroplane, because the policy objective is to eliminate smuggling of

prohibited goods into the country by individuals. This would be a ‘box-ticking’

approach, with standard procedures for every passenger.

With a risk-based approach, the department will take the view that some risk of

smuggled goods entering the country is unavoidable. The policy should therefore be

to try to limit the risk to a certain level. Instead of checking the baggage of every

passenger arriving in the country, customs officials should select passengers whose

baggage they wish to search. Their selection of customers for searching should be

based on a risk assessment – for example what type of customer is most likely to try

to smuggle goods into the country?

Chapter 10: Identifying and assessing risk

Identification, assessment and measurement of risk

 Risk identification

 The impact of risk on stakeholders

 Assessing risks: impact and probability

 Measuring risks

 Prioritising risks

 Role of the board of directors in identifying and assessing risks

 ALARP (as low as reasonably practicable) principle

 Objective and subjective risk perception

 Related and correlated risk factors

4 Identification, assessment and measurement of risk

4.1 Risk identification

Risk identification is the initial stage in a system of risk management. A company

needs to understand what risks it faces, both in its environment and markets

(strategic risks) and internally (operational risks).

There are no standard rules about how risks should be identified.

 In a large company, it might be appropriate to identify risks at different levels in

the organisation – on a group-wide basis, and for each business division and for

each department or function.

 Management might be responsible for identifying strategic risks/business risks

for the company, but the internal auditors or external auditors might be more

efficient at identifying operational risks (and suggesting suitable internal

controls to control the risks).

Many large companies set up risk committees to identify risks. These are

committees of managers from several departments or functions. Each committee is

responsible for reporting on a particular category of risk or risks in a particular

geographical area of the company’s operations. A committee meets regularly to

discuss risks and their potential significance, and changes in these risks.

Risks identified by a company will vary in importance. Some risks might be

unimportant, or easily controlled. Some risks will be very significant. Having

identified risks, it is therefore necessary to assess the importance of each risk, in

order to:

 rank the risks in order of significance (order of priority), and

 identify the risks that are the most significant, and

 identify the significant the risks where control measures are urgently needed.

ACCA P1 Governance, Risk and Ethics - 2011 - Study text - Emile Woolf Publishing

Подождите немного. Документ загружается.