ACCA P1 Governance, Risk and Ethics - 2011 - Study text - Emile Woolf Publishing
Подождите немного. Документ загружается.
Paper P1: Governance, risk and ethics
254 © Emile Woolf Publishing Limited
Example
Investors in shares often diversify their investment risks by investing in a portfolio
of shares of different companies in different industries and different countries.
Some investments will perform well and some will perform badly. The losses on
poor-performing shares should be offset by higher-than-expected returns on others.
Risk is also reduced because if an investor suffers a loss on some shares, the rest of
the investment portfolio retains its value. The maximum loss in any single
investment is limited to the amount that has been invested in the shares of that
company.
When is diversification appropriate?
Diversification is appropriate in some situations, but not in others.
A diversification strategy by a company might be appropriate provided that its
management have the skills and experience to manage the portfolio of different
business activities. For example, a film studio diversifies into films for the
cinema, films for television and other home entertainment products. If there is a
decline in the market for cinema films, the market for television programmes or
downloading films from the internet might remain strong.
A diversification strategy by a company is much more risky (and less
appropriate) when it takes the company into unrelated business activities. For
example, a company that diversifies into making tobacco products, selling
insurance products and providing consultancy services could be exposed to very
large risks, because its senior management might not have the skills or
experience to manage all the different businesses. Each business is very different
from the others. Investors in the company might also disapprove of such
diversification: if investors want to diversify into different businesses, they can
do so by buying shares in specialist companies rather than buying shares in a
company that diversifies its activities.
Risks are not reduced significantly by diversifying into different activities where
the risks are similar, so that if there is an adverse change in one business activity,
there is a strong probability that adverse changes will also occur in the other
activities. For example, a company that diversifies into house-building,
manufacturing windows and manufacturing bricks would be exposed in all
three businesses to conditions in the housing market.
3.3 Risk transfer
Risk transfer involves passing some or all of a risk on to someone else, so that the
other person has the exposure to the risk.
A common example of risk transfer is insurance. By purchasing insurance, risks are
transferred to the insurance company, which will pay for any losses covered by the
insurance policy.
Using insurance to manage risk is appropriate for risks where the potential losses
are high, but the probability of a loss occurring is fairly low.
Chapter 11: Controlling risk
© Emile Woolf Publishing Limited 255
3.4 Risk sharing
Risk sharing involves collaborating with another person and sharing the risks
jointly.
Common methods of risk sharing in business are partnerships and joint ventures. In
a joint venture, all the joint venture partners share in the investment, the
management, the cost of the investment, the risks and the rewards.
Companies pursuing a strategy of developing their business in other countries
might use joint ventures as a way of entering the market in a different country. For
the ‘global’ company, the joint venture partner would be a local business whose
management have knowledge of the local market. For a local business, a joint
venture with a foreign company reduces the financial risk, and also improves the
opportunities for expansion and growth.
3.5 Hedging risks
The term ‘hedging’ risks is used extensively in the financial markets, and hedging is
commonly associated with the management of financial risks such as currency risk.
Hedging risk means creating a position (making a transaction) that offsets an
exposure to another risk. For example, if a company has an exposure to currency
risk, and will lose money if the US dollar falls in value against the euro, a hedge can
be created whereby the company will make a profit if the US dollar falls in value
against the euro. The loss on the original risk exposure will be offset by a gain on the
hedge position.
Risks can be hedged with a variety of derivative instruments, such as futures,
options and swaps. A detailed knowledge of these instruments is outside the scope
of the syllabus for this examination paper.
3.6 Risk avoidance and risk retention
Measures to control risk through diversification, risk transfer, risk sharing and
hedging risks can help to reduce the risks. Similarly, internal controls can reduce
risks to prevent problems from happening or identify them when they occur.
Control measures do not eliminate risk. They only reduce them. The risks that
remain after risk control measures are implemented are the ‘residual risks’.
An entity needs to develop a strategy towards these risks. The basic choice is
between risk avoidance and risk retention.
Risk avoidance means not having any exposure to a risk. A business risk can
only be avoided by not investing in the business. Risk avoidance therefore
means staying out of a business, or leaving a business and pulling out of the
market.
Risk retention means accepting the risk, in the expectation of making a return.
When risks are retained, they should be managed, to ensure that unnecessary
risks are not taken and that the total exposure to the risk is contained within
acceptable limits.
Paper P1: Governance, risk and ethics
256 © Emile Woolf Publishing Limited
Risk appetite and risk retention
The choice between avoiding risks and accepting risk depends on risk appetite. This
was described in an earlier chapter. Risk appetite is the amount of risk that an entity
is willing to accept by investing in business activities, in order to obtain the expected
returns from the business.
Risk appetite varies from one company to another. Some companies are willing to
take fairly large risks whereas others are ‘risk averse’. In general, companies expect
higher returns by taking larger risks.
Risk appetite should be established by the board of directors, which should
formulate a policy for strategic risk/business risk. Limits to strategic risks can be
expressed in several ways.
The board of directors might indicate the risks that it is not prepared to accept,
where risks should be avoided. For example, a water supply company might
establish a policy of not investing water supply operations in any other country,
because it considers the risks too great.
Risk limits can be established in terms of the maximum new investment that will
be approved in each area of business activity.
As indicated in an earlier chapter, a risk dashboard might be used as a method
of establishing appetite for particular risks and for monitoring residual risks.
It is easy to think of ‘risk’ as something undesirable, to be avoided. This attitude to
risk focuses on downside risk. It is important to recognise that risk is unavoidable in
business and that risks must be taken in order to make profits and a return on
investment.
A key aspect of risk management is therefore managing the level of risk and:
deciding which risks are acceptable and which are not: setting risk limits
communicating the policy on risk, and
monitoring risks, and taking appropriate measures to prevent the risks from
becoming excessive.
Variations in risk appetite between different companies
Risk appetite varies between different companies, and might vary according to the
size, structure and development of the business.
Small companies are often more entrepreneurial than larger companies, and are
willing to take bigger risks in order to succeed and grow. Entrepreneurial
business leaders are associated with risk-taking. The leaders of small businesses
might consider that they can take risks because:
- The directors of the company are also its owners; therefore they are not
accountable to other investors for the risks that they take.
- In small companies, the risk of loss is limited by the size of the company. The
worst that can happen is that the company will fail and go into liquidation. If
the company is small and does not have large amounts of financing, this risk
might be acceptable.
Chapter 11: Controlling risk
© Emile Woolf Publishing Limited 257
- In large companies with a high value, large risks will often be avoided if they
threaten to reduce value significantly.
On the other hand, large companies can afford to take bigger risks than small
companies when they are well-diversified. For example, a large bank can accept
the credit risk from a major borrower, because if the loan turns into a bad debt,
the bank’s total profits might not be affected significantly.
As companies become larger, with a hierarchical management structure, they
might become more bureaucratic. Bureaucracies are often the opposite of
entrepreneurial businesses, because they are risk-averse. Managers are unwilling
to take on risk, and because of the hierarchical nature of the management
structure it might be difficult to promote a culture of risk awareness and embed
risk within the management processes.
Business risk is often higher in markets where conditions are volatile and subject
to continual and unpredictable change. When a new market emerges, risks are
high. Companies investing in the new market must have an appetite for taking
on the high risk because they expect the potential benefits to be large. As a
market matures, it becomes more stable and more predictable. Volatility falls
and there is less risk. As a consequence, the risk appetite of companies operating
in a developed and mature market could be fairly low.
3.7 The TARA framework for risk management
Some of the risk management policies described in this section can be seen as four
different approaches to risk management, which can be used to identify alternative
strategies. These four approaches are known as the TARA framework for risk
management.
TARA stands for:
Transferring risk
Avoiding risk
Reducing risk
Accepting risk
Risk transfer has been described: a common method of risk transfer is to buy
insurance, and transfer risk to the insurance company.
Risk avoidance usually means ‘not doing’ something or withdrawing from an
activity that creates risk. It could make sense to avoid risk if the risk is too high for
the expected returns. In order to make entrepreneurial profits however, some
business risks have to be taken.
Risks can be reduced by various measures. In particular risks of errors and fraud
can be reduced by means of a sound system of internal control.
Accepting risk can be a sensible option. If the risk is not too great, and the cost of
reducing or transferring the risk would not be worthwhile, exposure to a risk may
be acceptable.
Paper P1: Governance, risk and ethics
258 © Emile Woolf Publishing Limited
Policies and techniques
Enterprise risk management (ERM)
ISO31000 on risk management
4 Enterprise risk management
This section summarises and adds to many of the risk topics dealt with so far in
order to provide an overview of an effective approach to risk management.
4.1 Enterprise risk management (ERM)
The board should ensure that there is a robust framework for risk management.
Many companies have established an enterprise-wide risk management framework,
so that the approach to risk management is consistent throughout the
company/group.
A risk can be defined as any event or action that might result in a failure by the
company to achieve its strategic objectives, which in turn will add to stakeholder
value. An approach to risk management should start with an understanding of how
stakeholders measure value.
A framework for risk management might be applied at three levels or in three
stages:
Establishing the approach to risk management and creating a risk management
‘vision’
Committing resources to risk management, and ensuring that an infrastructure
for risk management is put in place and that the company/group has the
capabilities and skills for managing risk
Implementing systems for risk assessment, the application of controls and other
management systems for risk, and monitoring risks and the effectiveness of the
risk management arrangements.
Chapter 11: Controlling risk
© Emile Woolf Publishing Limited 259
The following is a framework for controlling risk
Risk capabilities
Personal objectives / plans
Training / education
Early warning systems
Stakeholder
value
Risk management vision
Strategy / goals / objectives
Culture / languages
Common framework
R
Risk infrastructure
RM leadership / support
Policies / procedures
Specialist functions
Risk assessment
Risk identication
Ownership / accountability
Risk treatment
Control design
Control eectiveness
Residual risk
Risk monitoring
Control self assessment
Performance KPIs
Reporting routines
Stage 2
Resources
Stage 3
Implementation
Stage 1
Approach
Proling / measurement
(Source: Crowe Clark Whitehill LLP)
Approach to risk management
The overall approach to risk management should be established by senior
management.
The company/group should have a clear risk strategy. This should be well
defined and communicated throughout the company.
There should be a culture of risk management. Consistent definitions should be
used throughout the company, providing appropriate and simple terminology
to support the risk management process.
A common framework and approach to risk management should be used across
the entire company/group.
An infrastructure for risk management
There should be an infrastructure for risk management:
There should be a risk management structure, providing leadership and support
in the area of risk management and internal control.
There should be appropriate risk management policies and procedures. These
should be kept-up-to-date and should be readily available.
Appropriate specialist risk management and assurance functions should be
established where appropriate, such as capabilities in internal audit, health and
safety management, IT assurance, insurance management and environmental
risk management functions.
Paper P1: Governance, risk and ethics
260 © Emile Woolf Publishing Limited
Risk capabilities
The company should have the capabilities for managing risk which might include:.
Employees being given structured training in basic risk management procedures
and internal control systems.
Individuals having personal objectives that make reference to their performance
in areas of risk and control.
Systems capable of providing early warning of any major control breakdowns or
problems.
Risk assessment
To implement risk management systems, there must first be processes or procedures
for identifying risks and measuring them and assessing their potential significance.
The measuring and assessment of risk is sometimes called ‘risk profiling’ or ‘risk
mapping’.
A simple example of risk mapping involves placing each identified risk in an
appropriate position in a 2 × 2 matrix, according to:
the frequency of adverse events or the probability that the risk will materialise
and an adverse outcome will occur, and
the expected loss or impact in the event of an adverse outcome.
Companies in more complex business sectors may need a more sophisticated
approach, using scenario analysis and arithmetic calculations.
All critical risks should be ‘owned’ by designated managers.
The treatment of risk
Controls should be designed to mitigate the risk. There should also be some form of
testing controls for both their design and their operating effectiveness.
Controls for significant or ‘critical’ risks should be reviewed regularly to ensure
that they are still an appropriate control to apply.
The effectiveness of controls in reducing critical risks should be tested.
‘Residual risk’ is the risk that still remains after the controls have been put in
place and implemented. Management should understand and monitor these
residual risks, to ensure that they remain at acceptable levels.
Monitoring risks
Risks should be monitored by managers who have responsibility for those risks. In
addition, risks can be monitored at a more senior level through key performance
indicators (KPIs) or key risk indicators (KRIs).
The board should be provided regularly by management with clear reports on risk
management and internal control, such as reports on:
the company’s risk profile, and
Chapter 11: Controlling risk
© Emile Woolf Publishing Limited 261
control testing, the results of those tests and action plans resulting from the test
findings.
4.2 ISO31000 on risk management
In 2009, the International Organization for Standardization issued a Standard on the
implementation of risk management systems: ISO31000. ISO31000 may be used by
any organisation in any industry or sector, and can be applied to any type of risk. Its
purpose is to promote international standardisation in risk management systems.
In 2010, the Institute of Risk Management (IRM), in collaboration with the
Association of Insurance and Risk Managers (Airmic) and the public risk
management association Alarm, issued guidance on ISO31000.
ISO31000 puts forward a framework for risk management that has three main
elements:
Risk architecture: This consists of the roles and responsibilities for risk
management within the organisation and the risk reporting structure. For
example it consists of the respective roles and responsibilities of the board, the
audit committee, the group risk management committee, the risk disclosures
committee, the CEO, business unit managers, individual employees, risk
managers, specialist risk management functions and internal auditors.
Risk strategy: The risk strategy of the organisation should be specified,
including the risk appetite of the board. There should be a risk management
action plan and resources to support risk management activities.
Risk protocols: These are the rules and procedures for implementing risk
management and the risk management methodologies that should be applied.
For example there should be rules, procedures and methodologies for risk
assessments, risk responses, and incident reporting; a business continuity plan;
and arrangements for auditing the efficiency and effectiveness of controls.
ISO31000 uses the ‘7Rs and 4Ts’ of risk management as a framework for the
implementation of a risk management system:
Recognition/identification of risks
Ranking or evaluation of risk
Responding to significant risk
Risk treatment:
− Tolerate: accept the exposure to risk
− Treat: take measures to control or eliminate the risk
− Transfer: transfer the risk to someone else
− Terminate: terminate the activity that gives rise to the risk
Resourcing controls
Reaction planning
Reporting and monitoring risk performance
Reviewing the risk management framework
Paper P1: Governance, risk and ethics
262 © Emile Woolf Publishing Limited
© Emile Woolf Publishing Limited
263
Paper P1
Governance,riskandethics
CHAPTER
12
Ethical theories
Contents
1 Ethics and accountants
2 Ethical theories of relativism and absolutism
3 Kohlberg’s stages of moral development
4 Ethics: deontological and teleological approaches
5 Ethical decision-making models