ACCA P1 Governance, Risk and Ethics - 2011 - Study text - Emile Woolf Publishing
Подождите немного. Документ загружается.
Paper P1: Governance, risk and ethics
234 © Emile Woolf Publishing Limited
(Deciding on suitable control measures will depend on the significance of the risk,
and the cost of taking control measures. Control measures are only justified if the
cost of the control measures is less than the benefits obtained from reducing the
risk.)
4.2 The impact of risk on stakeholders
The process of identifying risks should concentrate on risks to the company, both
strategic risks and operational risks. However, the risks for a company also create
risks for its stakeholders. Management should be aware of the impact of the
company’s risks on stakeholders, because the risks for stakeholders could affect the
attitude and the behaviour of stakeholders towards to the company.
The impact of a company’s risks on risks for stakeholders varies and depends on
circumstances.
Employees
Employees are exposed to several risks in their job. These include the risk of a loss
of job, and the threat to health or safety in the work that they do. Employment
benefits might be threatened. These risks to employees can be affected by risks that
face their company.
Jobs may be threatened by the strategic choices taken by a company. If a
company makes the wrong strategic decisions, and the company loses money,
many employees could lose their jobs.
Safety risks for a company might be measured in terms of the risk of serious
injuries and minor injuries to employees over a given period of time. (For
example, a company might assess its current safety measures in terms of the
expected number of serious injuries per 1,000 employees per year.)
The risk appetite of some employees might differ from the risk appetite of the
company and the board’s policy on risk. For example, a ‘rogue trader’ working in
the financial markets for a bank might be willing to take high risks for the company
because the potential benefits for him personally (a large cash bonus for making
large trading profits) exceeds the risk (the possible loss of his job).
Investors
When investors buy the shares of a company, they have some expectation of the sort
of company it is and the returns they might expect from their investment. For
example, an investor might buy shares in a company expecting it to be a high-risk
company which could achieve a very high rate of growth in the share price. Or an
investor might buy shares in a company because the company is stable and can be
expected to pay a regular annual dividend.
The board of directors should try to ensure that the risk appetite of the company is
consistent with the risk appetite of its shareholders (and other stock market
investors). A company should not expose itself to strategic risks that expose the
investors to a risk to their investment that the shareholders would consider
excessive.
Chapter 10: Identifying and assessing risk
© Emile Woolf Publishing Limited 235
When a company increases its exposures to strategic risk, many existing
shareholders might decide to sell their shares and switch to investing in a lower-
risk company. Investors with a larger risk appetite might buy the shares.
The board of directors should keep shareholders informed about the significant
risks that the company faces, so that investors can assess their own investment
risk. (In the UK, for example, stock market companies are now required by law
to include disclosures about risks in their annual narrative report to
shareholders, the business review.)
Creditors
The main risks to a company’s creditors and suppliers from the company’s own
risks are that:
the company will not pay what they owe, and
the company will stop buying goods and services from them.
A high-risk company is a high credit risk. The liquidity risk and insolvency risk
facing a company has an impact on the credit risk for a supplier or lender. When a
company asks a bank for a loan, the bank will assess the credit status of the
company, and it will make its decision to lend on the basis of whether it thinks that
the company will be able to pay back the loan with interest and on schedule.
Communities and the general public
Communities and the general public are exposed to risks from the actions of
companies, and the failure by companies to control their risks.
Risks to the general public include:
- the consequences for the country of a decline in the business activities and
profits of a company due to recession, especially when the company is a
major employer
- health and safety risks from failures by a company to supply goods that meet
with health and safety standards
- risks to the quality of life from environmental pollution, due to a failure by
the company to control its environmental/pollution risks.
Risks to a local community also arise from economic risks faced by the company.
If a company is forced to close down a production plant in an area where it is a
major employer, the economy of the entire community would be affected.
Pressure groups and popular action groups come into existence because ‘activist’
members of the general public believe that their well-being is threatened. The cause
of the perceived threat is often the activities of companies.
Some companies take risk-based decisions that expose them to considerable
strategic risk without necessarily considering fully the risk impact on the general
public or local communities. For example, an energy company planning to construct
a new nuclear power station should consider the long-term risks to the community –
and the general public – not just their own business risks relating to costs.
Paper P1: Governance, risk and ethics
236 © Emile Woolf Publishing Limited
Governments
For governments, companies are a source of economic wealth for the country. They
create additional economic activity which creates extra wealth, and they provide
employment and tax revenues for the government.
A risk for government is that major companies will decide to invest in a different
country, or move its operations from one country to another.
For example, manufacturing companies in the European Union have been faced
with the risk of low-cost competition from suppliers in the Far East, where labour
costs in some countries are much lower than in Europe. To overcome this threat,
companies might consider relocating their manufacturing operations to the Far East.
The strategic threat to these companies has an obvious impact on the governments
of European Union countries, because the economies of those countries would be
affected by a loss of manufacturing businesses.
Customers
Some risks facing companies also have an impact on their customers.
A company might face operational risks from human error or system breakdown
in its operations. Errors and delays in providing goods and services have an
impact on business customers. For example, if a company is late in supplying a
key component to a business customer, the customer will be late in supplying its
own customers. Errors and delays work their way through the entire supply
chain.
Product safety risks for a company are also a risk for customers who use them.
For example, manufacturers of foods products, drink products and medicines
and drugs need to consider the potential risk to customers from weaknesses in
their own safety controls.
Business partners
There are risks in joint ventures for all the joint venture partners. A company in a
joint venture might try to dominate decision-making in order to reduce the risk that
the joint venture will not operate in the way that they want it to.
However, by reducing its exposures to risk in a joint venture, a company will affect
the risks for the other joint venture partners.
Risks in partnerships can be controlled for all the partners – to some extent – by
clear terms in the contract agreement between the partners, and by monitoring
performance of the partnership.
A UK public company (with several joint ventures in other countries) has
commented on joint venture governance and partnerships as follows: ‘As we
continue to enter into new partnerships and grow existing joint ventures, the risk
inherent in managing these partnerships increases. It is more difficult to guarantee
the achievement of joint goals and we rely on partners’ reputations. We choose
partners with good reputations and set out joint goals and clear contractual
Chapter 10: Identifying and assessing risk
© Emile Woolf Publishing Limited 237
arrangements from the outset. We monitor performance and governance of our joint
ventures and partnerships.’
4.3 Assessing risks: impact and probability
The assessment of risk is sometimes called ‘risk profiling’ or ‘risk mapping’.
To assess each risk, it is necessary to consider the likelihood that losses will occur as
a consequence of the risk, and the size or amount of the loss when this happens.
A simple approach to risk mapping involves taking each risk that has been
identified and placing it on a map. The map is a 2 × 2 matrix, with:
one side representing the frequency of adverse events or the probability that the
risk will materialise and an adverse outcome will occur, and
the other side representing the impact (loss) if an adverse event occurs or
adverse circumstances arise.
The format of a simple risk map is shown below.
High impact
High impact
Low probability
Consider the need for
control measures, such
as insurance
High impact
High probability
Take immediate action to
control the risk
Impact/size of
potential loss
Low impact
Low impact
Low probability
Review periodically
Low impact
High probability
Consider the need for
control action
Low probability/
frequency
High probability/
Frequency
Probability or frequency of the risk materialising
A risk map can help management to identify risks where immediate control
measures are required, and where the need for control measures should be
considered or reviewed periodically.
‘High impact, low probability’ risks might include the risks of damage to assets
from fire or flooding, the risk of a terrorist attack or the risk of major legislation that
will affect the company’s business. Some of these risks, such as risks of fire, theft
and criminal damage, can be insured. Insurance reduces the residual risk by the
amount of the insurance cover obtained.
All key risks should be ‘owned’ by specific individual managers, who should be
required to take the necessary control measures and report to their senior manager
about what they have done.
Paper P1: Governance, risk and ethics
238 © Emile Woolf Publishing Limited
Risk assessment as an ongoing process
It is important to appreciate that organisations differ in their exposure to changes in
internal and external risks. Some companies are involved in industries that are
subject to a wide range of local and international influences (eg shipping,
telecommunication and technology) and may, therefore operate in a dynamic risk
environment. It is vital that such companies assess the risks faced on an ongoing
basis so that they might respond to changes immediately. Risk assessment should
be an ongoing process for these companies and risk mapping as illustrated above
can be a useful tool in this process.
Example
A possible financial risk is the risk of changes in interest rate on the cash flows of an
organisation.
20X1 An organisation with low gearing operates in an environment where interest
rates have been low for some time. This company would identify interest rate risk as
low impact/low probability.
20X2 The organisation borrows a large amount (in the context of its capital structure)
in order to finance an expansion. The company might now categorise identify
interest rate risk as high impact/low probability.
20X3 There is a change in government. The new government enters into financial
policies that result in high interest rates compared to those enjoyed previously. The
company might now categorise interest rate risk as high impact/high probability.
In both 20X2 and 20X3 the risk has changed resulting in a repositioning on the risk
map. In both cases, the strategy adopted for managing the risk will be likely to
change.
4.4 Measuring risks
Whenever possible, risks should be measured. Measuring risk means quantifying
the risk. When risks are quantified, the risk can be managed through setting targets
for maximum risk tolerance and measuring actual performance against the target.
Risk measurements can be financial measurements (for example, a measurement of
the expected loss) or non-financial (for example, a measurement of expected injuries
to employees at work).
However, not all risks can be measured. Where risks are assessed in qualitative
terms, risk management decisions become a matter of management judgement.
Chapter 10: Identifying and assessing risk
© Emile Woolf Publishing Limited 239
Example
Banks use risk modelling to measure their main risks. A commonly-used model for
measuring credit risk is called a Value at Risk model (VaR model). This can be used
to estimate, at a given level of probability, the expected bad debts from the bank’s
current borrowers. For example, a VaR model could be used to predict at the 95%
level of confidence that the bank’s bad debt losses from its current borrowers will
not exceed, say, £5 million in the next month.
Bank set targets for VaR limits, and monitor the actual credit risk by comparing
actual value at risk against the maximum or target limit.
4.5 Prioritising risks
Within a system or risk management, companies need to establish a process for
deciding which risks are tolerable and which might need more control measures to
reduce the risk. (Sometimes, it might be decided that control measures are excessive,
and that money can be saved by reducing the controls, without increasing risk
above acceptable levels.)
Deciding on priorities for risk management might be a matter of management
judgement.
Some companies and non-business entities use formal techniques to help them with
the prioritisation of risk. One such technique is a risk dashboard.
Risk dashboard
A risk dashboard can be used to identify which risks need further control measures.
On a simple dashboard, each risk that has been identified is represented by a
‘coloured light’. These are usually green, amber and red, representing the colours of
traffic signals. When a risk has a red light, this indicates that further risk measures
are needed. A green light indicates that the risk is under control. An amber light
indicates that the risk needs to be kept under review.
A more complex risk dashboard can be used, for each risk, to show:
the total amount of risk, assuming that no control measures are in place to
contain the risk
the residual risk, which is the remaining exposure to risk after allowing for the
control measures that are in place
the risk appetite of the company for that particular risk, which is the exposure to
risk that the company is willing to accept in order to obtain the expected benefits
from its activities.
Paper P1: Governance, risk and ethics
240 © Emile Woolf Publishing Limited
Risk dashboard
Risk item
Level of risk Red High risk
Red/amber
Green/amber
Green Low risk
Risk appetite and residual risk can both be shown on the dashboard.
The company’s risk appetite for a particular risk might be low, in which case it can
be recorded in the ‘green’ section of the dashboard. If the risk appetite is higher, this
can be shown in the green-amber or red-amber sections. It is unlikely that a
company will have an appetite for a very high risk, so risk appetite is unlikely to be
shown in the red section.
Residual risk can also be recorded, in the green, green-amber, red-amber or red
sections of the dashboard.
When risk appetite and residual risk are in the same section of the dashboard,
this means that current risk management/risk control measures are appropriate
for the risk.
When the risk appetite is in a lower-risk section of the dashboard than the
residual risk, this indicates that further control action is needed to reduce the
residual risk to an acceptable level.
4.6 Role of the board of directors in identifying and assessing risks
As discussed earlier in this chapter, risk management is largely a responsibility for
management. Management:
is normally responsible for identifying key risks (although the board of directors
might take on responsibility, with advice from management and auditors)
is responsible for assessing risks and for designing and implementing risk
controls
is responsible for monitoring the effectiveness of risk controls, and keeping risks
under review
should report regularly to the board of directors on risks and risk management.
Chapter 10: Identifying and assessing risk
© Emile Woolf Publishing Limited 241
The board of directors has overall responsibility for risk management, just as it has
overall responsibility for the system of internal control.
The board should set the company’s policy for risk, and give clear guidance
about the company’s risk appetite.
In the UK, the Combined Code states that the board should conduct a review at
least once a year of the effectiveness of internal controls, and this includes the
effectiveness of risk management systems.
The UK Combined Code also requires the board to report to shareholders on its
review of internal control.
The evaluation of risk management systems, and the board’s responsibilities for
reporting to shareholders, are the same as the board’s responsibilities for internal
controls. These responsibilities have been described in an earlier chapter, and are
not repeated here.
4.7 ALARP (as low as reasonably practicable) principle
Common sense suggests that low risk is more acceptable than high risks. The
following diagram illustrates this relationship.
High
Risk
Low
Low
Acceptability
High
This does not mean that all risk should be avoided. It suggests rather that there is an
acceptable level of risk in a given circumstance to achieve a given objective. It is
important to remember that risk and return are usually linked in a positive way so
that higher return is often associated with higher risk.
ALARP is a term that is associated with safety precautions. It stands for "as low as
reasonably practicable" and derives from UK Health and Safety legislation.
The ALARP principle is that it is usually impossible (or if it is possible it is grossly
expensive) to eliminate all risk but that any residual risk should be as low as
reasonably practicable. A risk is said to be ALARP when the cost involved in
reducing it further would be grossly disproportionate to the benefit gained.
ALARP should not be thought of a simple quantitative measure of cost against
benefit because any safety improvement would not be worthwhile only if the costs
Paper P1: Governance, risk and ethics
242 © Emile Woolf Publishing Limited
were disproportionately more than the benefit achieved. This is a matter of
judgement and might vary from country to country.
4.8 Objective and subjective risk perception
Risk assessment might be a vitally important activity for an organisation. When this
is the case it is important to be able to assign accurate and reliable values to the
likelihood and impact of a risk. This can be done with a high degree of certainty for
some risks but it can be difficult to do this for others.
If both variables can be measured accurately (where hard information is available)
the risk might be described as having been objectively assessed.
In many cases and it is difficult to assign a value to either likelihood or impact with
any degree of accuracy. In such cases subjective judgements must be used. The
following table contains illustrations of risks where impact and likelihood might be
objective or subjective.
ObjectivelikelihoodmeasurementSubjectivelikelihoodmeasurement
Qualityfailureinabatchofcomponents
(basedonpreviousmanufacturing
experience)
Anoilwelldisasteroccurringthis yearin
Siberia
Objectiveimpactmeasurement Subjectiveimpactmeasurement
Thechangeininterestpaymentsasa
resultofa1%increaseininterestrates.
Changeinrevenueduetochangein
consumertaste
Assessment of a risk based on objective measurement of likelihood and impact is
more robust than if based on subjective judgement. This will affect the risk
management strategy.
4.9 Related and correlated risk factors
Related risks are those that are often present at the same time.
Risks might also be correlated. This means that they vary together. Risks might be
positively correlated (both go up or down together) or negatively correlated (one
falls as the other increases).
Correlation might be due to the risks having a common cause or because one type of
risk might give rise to the other.
Example
Smoking increases the risk of heart disease and the risk of lung cancer.
Both risks rise together when people smoke and fall together when people give up
smoking. These risks are therefore, positively correlated as they have a common
cause.
Note that correlation is a measure of association but not necessarily causation. If two
factors are strongly correlated this suggests that one risk causes the other or that
both risks have a common cause but it does not prove either of these to be the case.
Chapter 10: Identifying and assessing risk
© Emile Woolf Publishing Limited 243
Factors might show strong correlation due to another unknown connection or by
coincidence. In the above example where there is correlation between heart disease
and lung cancer it might appear that one causes the other but this is not correct.
Both are caused by another factor – smoking.
When two factors appear to be correlated without any direct connection between
the two this is known as spurious correlation.
Failure to understand the relationship between risks (if there is one could lead to
inappropriate risk response strategies.
Example
Environmental risks and reputation risks might be correlated.
BP is a company engaged in oil and gas exploration and extraction. In 2010,
Deepwater Horizon, a BP owned oil platform suffered a catastrophic accident in the
Gulf of Mexico. BP is now paying the huge costs associated with the environmental
clean up operation and also the costs of repairing its damaged reputation.