ACCA P1 Governance, Risk and Ethics - 2011 - Study text

Подождите немного. Документ загружается.

Paper P1: Governance, risk and ethics

404 © Emile Woolf Publishing Limited

investors, suppliers and employees. For example, companies that conduct

scientific research using live animals attract the hostility of ‘animal rights

activists’.

Employees might also be a source of reputation risk, by behaving rudely to

customers or the general public. Some companies, for example, have a poor

reputation for dealing with requests to a call centre from customers asking for

help.

Some companies have suffered damage to their reputation from the activities

of suppliers, for example by purchasing supplies from manufacturers who use

child labour.

The impact of an event on reputation risk can be substantial when the event is

publicised in the media, such as television or the newspapers.

(b) The effect of reputation risk is difficult to predict, and adverse effects may be

either short-term or long-term. In a large global company, the effect of

reputation risk may also be localised, because an event that damages the

company’s reputation in one part of the world might not be considered so bad

in other countries.

 A reputation for unethical selling or poor quality can have a lasting

impact on customer demand. Some years ago, the owner of a chain of

jewellery stores in the UK criticised the poor quality of the goods sold in

his stores. The effect was a very large fall in sales for the group, and the

company had to change its name as one measure for overcoming the

reputational damage.

 Reputation can affect the choice of one producer’s goods or services in

preference to another. For example, a reputation for high prices or poor

quality, compared with rival products, can be damaging for sales.

 A bad reputation can make a company a target for pressure groups and

activists.

 In some cases, damage to reputation can lead to intervention by the

government, which may introduce new laws or regulations.

29 Technology risk

There are several ways in which a company might be affected by technology risk.

 There is a risk that a company might fall behind in the use of new technology in

its operations. If the new technology is successful, rival companies might gain a

competitive advantage by making earlier use of the technology. There is also a

risk that a company might decide to invest in a new technology, only to find that

it is much less popular than expected with customers.

 There is also a risk that a company might fall behind its rivals in the

development of an existing technology, such as the use of new versions of

computer software.

Answers to practice questions

 Occasionally, there may be two different technologies to choose from, and there

is a risk of choosing the technology that will prove inferior. This risk can affect

companies that manufacture products (such as high definition digital

televisions) and have to choose between the rival technologies for sin gin their

products.

 The potential cost of investing in new technology can be a serious risk for

profitability.

Technological risk is greater when the pace of technological change is faster. Many

companies are facing greater technological risk than in the past, as the life cycle of

products appears to get shorter.

30 Liquidity risk

Liquidity is cash or ready access to cash. Liquidity risk for a company is the risk that

it will not have sufficient cash, or ready access to sources of cash, to settle liabilities

when they fall due. Faced with a liquidity ‘crisis’, a company might be at risk from

insolvency.

Sources of ready cash are near-cash assets, such as money market securities that can

be sold quickly in the financial markets to obtain cash. Companies sometimes invest

surplus cash in money market securities (rather than holding on to the cash)

because securities earn interest.

Another source of liquidity is an available line of credit from a bank, such as an

overdraft facility or a revolving credit facility. In the past, however, a problem for

some companies has been that when they have been faced with a liquidity shortage,

their bank has withdrawn an overdraft facility. When the companies needed the

liquidity most, their banks took away the line of credit.

An essential requirement for liquidity risk control is careful cash budgeting or cash

forecasting. Companies should keep expected cash inflows and payments under

continual review. Forecasting cash flows will help a company to anticipate

temporary cash shortages and to take measures in advance to deal with them, such

as delaying non-essential expenditures or negotiating an overdraft with a bank.

Companies should also avoid taking actions that could create long-term liquidity

problems, such as regularly paying for capital expenditures out of operating cash

flows, when the company cannot afford this.

Efficient working capital management can also help to improve cash flows and

reduce liquidity risk. In particular, companies should avoid investing in slow-

moving inventory, and should have efficient procedures for collecting receivables.

Paper P1: Governance, risk and ethics

406 © Emile Woolf Publishing Limited

31 Market risk and derivatives risk

Market risk is risk arising from unexpected changes in the market price of items or

in market rates. The risk is higher when market prices are volatile, and subject to

large and unexpected movements both up and down.

For the treasury department of Sham Group, there is an exposure to market risk for

any assets or liabilities whose value fluctuates with changes in market prices. It

might invest in shares of other companies or market instruments whose value is

linked to the market price of commodities. If so, it has an exposure to market risk,

because share prices and commodity prices might change unexpectedly, creating

profits or losses.

The treasury department might also hold investments or have liabilities whose

value is affected by changes in foreign exchange rates or interest rates. For example,

it might hold bonds as investment, and the market price of bonds varies with

changes in long-term interest rates. Similarly the department might hold

investments denominated in a foreign currency, and the value of these investments

will change (in the department’s reporting currency) with changes the currency’s

exchange value.

The head of the treasury department is likely to insist that the department sets limits

to its exposures to market risk, and the treasury team will not be allowed to deal in

the financial or commodity markets in a way that exceeds the risk limits that have

been set.

Derivatives risk is the risk of unexpected gains of losses on trading positions in

derivatives. Derivative instruments, such as options, futures and swaps, can be used

to hedge exposures to risk and reduce residual risks. In the case of Sham Group, it

seems probable that the treasury team can trade in derivative instruments with the

intention of making a profit.

Gains or losses on derivatives depend on changes in the market value of the

underlying items to which the derivatives relate, such as share prices, commodity

prices, interest rates, exchange rates and bad debts (credit default swaps). A

significant risk with trading in derivatives is that a relatively small investment in

derivatives can create an exposure to major losses if the underlying market prices

move adversely.

There have been reported cases in the past where treasury departments of

companies or government organisations have suffered severe losses through

speculation in derivatives.

Trading positions in derivatives need to be monitored regularly, and trading limits

should be set to restrict the exposure to losses to a level that the treasury

department considers acceptable.

Answers to practice questions

32 Charity

(Tutorial note: There is no ‘correct’ answer to this question. A suggested solution is

given here.)

From the limited amount of information available, it is difficult to identify in any

detail the key risks facing the charity organisation.

The main function of a charity is to raise money for spending on the charitable

cause. Key objectives should therefore be (1) to raise a sufficient amount of funds

and (2) to spend the funds effectively.

A major risk must be that Whitecoats will have difficulty in raising enough funds to

invest in the research projects that it would like to support. There are three other

charity organisations that might, to some extent, be competing for funds from the

same sources. One of these other charity organisations, Medhelp, is much larger and

is presumably much more successful at raising funds, from private and government

sources. The management of Whitecoats must therefore consider the risk that

funding will possibly be less than expected, due to competition from other sources.

The ability to raise funds for the charity could also be exposed to the risk of a

downturn in the general economy (which might reduce funding from private

sources) or in the state of the government’s finances (which might reduce funding

from government sources).

Another major risk is that Whitecoats might invest its funds in unsuccessful

projects. Each new research project uses up a large part of its annual funding

income. Unsuccessful projects would mean that Whitecoats is not as successful as it

would like to be in achieving its objectives. A lack of success could also damage the

perception of Whitecoats as a worthwhile charity, and persuade individuals and

organisations to give their money to Medhelp instead.

There will be some key risks affecting the operational effectiveness of Whitecoats.

An important requirement will be the need to recruit and retain individuals who

have the skills that are necessary to make Whitecoats successful. For example, it will

need to attract and retain fund-raisers. It is not clear whether Whitecoats employs

scientific or medical experts: if it does, recruiting and retaining these individuals

will also be important. The risks are that Whitecoats will fail to attract high-quality

individuals, or having recruited talented individuals, will fail to retain them.

Like any other organisation, Whitecoats will face a range of financial risks,

operational risks and compliance risks. The proposal by the new managing director

to improve risk management systems is a very good one.

33 Risk appetite and other terms

(a) Exposure to risk. All business activities involve some risks and whenever a

risk exists, there is an exposure to that risk. This means that the actual

outcome might be worse (or better) than expected. For example if a company

makes a strategic capital investment, there is a risk that the investment will

make a loss, or will fail to provide an adequate return. With credit risk, there

Paper P1: Governance, risk and ethics

408 © Emile Woolf Publishing Limited

is a possibility that when a company gives credit to its customers, the

customer might fail to pay what he owes, and there will be a bad debt. With

credit risk, the total exposure to risk can be measured as the total amount of

receivables.

(b) Risk of losses. When a business entity has exposures to risk, there is a risk

that some unexpected losses will occur if adverse events occur. The amount of

the loss that might occur is rarely the full amount of the exposure. For

example, if a company has an exposure to bad debts, with receivables of $10

million, it is most unlikely that all the receivables will become bad debts. Even

when a customer becomes a bad debt, some of the debt might be recovered in

legal proceedings. The risk of losses is an estimate of what the losses might be

from a given exposure to risk.

The risk of losses cannot always be measured, but with credit risk, it might be

possible to estimate the risk of losses from an exposure to credit risk as:

Total exposure (= total receivables) × Probability of default × Loss in the event

of a default

For example, if a company has $10 million of annual sales, there is a 2%

probability of default and in the event of default by a customer only (on

average) 25% of the debt will be recovered, the risk of losses is:

$10 million × 2% × 75% = $150,000.

control measures to reduce or contain the risk. In the case of bad debt risk, the

risk might be reduced through better credit-checking procedures, or more

efficient debt collection procedures. The finance director of Basket Company

thinks that the bad debt risk can be reduced by improving debt collection

procedures. If the probability of default could be reduced to, say, 1.8%, and

sales will increase by 20% each year to $12 million, the risk of losses would be

reduced to $12 million × 1.8% × 75% = $162,000.

(d) Risk appetite. Risk appetite describes the amount of risk (losses) that an entity

is prepared to accept in order to obtain the expected benefits. In this example,

if the company is willing to increase the credit period allowed to customers

from 30 days to 60 days, the risk of annual losses from bad debts will rise from

$150,000 to $162,000.

The company must decide whether it has the ‘appetite’ to accept the risk of

losses of $162,000 in order to obtain the benefits of higher annual sales ($2

million) and the additional profits from those sales.

34 Risk map and risk dashboard

A risk map and a risk dashboard are both simple visual aids to assist management

with the understanding and assessment of risks.

Answers to practice questions

(a) A risk map in its simplest form is a 2 × 2 matrix, where one side of the matrix

represents the probability that an adverse outcome or event will occur, and

the other side of the matrix represents the amount of the loss that is likely to

occur when there is an adverse outcome.

Loss given an adverse outcome (= Impact)

Low

High

Probability or

frequency of adverse

event

High

Low

The concept of a risk matrix is based on the assessment of risk as:

Risk = Probability of adverse event × Loss when an adverse event occurs.

A risk map can be used to place individual risks on the map. This provides a

visual aid to understanding the nature and severity of each risk. It can be

useful for management when risks are prioritised and decisions are taken

about how risks should be managed.

For example, priority for risk management and control should be given to

risks with a high probability of occurring and a large loss when an adverse

outcome occurs. Risks with a low impact and low probability might be

considered acceptable. Measures such as insurance might be considered for

risks with a low probability of happening but a high impact.

(b) A risk dashboard is another visual aid for risk management. There are

different ways of constructing a dashboard, but the basic idea is that it

indicates which risks are dangerously high (coloured red), which are

relatively small (coloured green) and which are somewhere between (coloured

amber). A dashboard can also be used to indicate the current exposures to the

risk (residual risk) and the ‘risk appetite’ of the company for accepting

exposures to the risk. Residual risk should not exceed the company’s appetite

for that risk.

35 Approaches to risk management

(a) Risk reduction. Risk reduction involves the application of control measures.

A risk that exists before the control measures are applied is reduced to a

residual risk. The aim of risk reduction should be to restrict residual risks to

an acceptable level. Internal controls reduce the operational risks (risks from

human error, fraud, technological failures, and so on). Financial risks can be

reduced by means of forward contracts or derivative instruments: ‘hedging’ a

financial risk reduces the residual risk.

Paper P1: Governance, risk and ethics

410 © Emile Woolf Publishing Limited

(b) Risk transfer. Risk transfer involves moving the risk to another person.

Usually, a payment has to be made for the risk transfer. The most common

form of risk transfer is probably insurance. By paying the premium for an

insurance agreement, a person can transfer all or most of the risk to an

insurance company.

business, it is impossible to invest and operate without having some risk

exposures. Avoiding risk therefore means not investing, or withdrawing from

an investment.

(d) Risk sharing. With risk sharing, the risk is divided between two or more

people/organisations, who are all exposed to the risk of losses or the ability to

benefit from unexpected gains. Joint ventures or partnerships are examples.

36 Risk management review

(Tutorial note: There is no single ‘correct’ answer to this question. The list of

questions below is indicative of the questions that Robert Lam should ask.)

Questions:

1 Does the company have a system for identifying risks (and if so, what is it)?

2 Does the company have a system for assessing risks and prioritising risks?

3 Does the company actively manage its risks?

4 Has the board of directors communicated to management what levels of risk

are acceptable? (Or: Has the board formulated and communicated a clear policy

on risk and risk management?)

5 Has the board of directors identified the limits of its ‘risk appetite’?

6 Should certain risks be taken at all, or should they be avoided? (Or: Should the

exposure to certain risks be increased/reduced?)

7 Do independent non-executive directors occasionally select and challenge

operational risk reports and investment decisions by management?

37 Risk model

A risk model is usually a mathematical model. The model contains a number of

variables, and the relationships between the variables are expressed in the form of

mathematical formulae.

Models vary in complexity, and range from simple models with a small number of

variables, to much larger models with a large number of different variables and

complex relationships between the variables.

The variables in a model are either input variables or output variables. Input

variables are items whose value is either known or estimated. Output variables are

items whose value depends on the value of the input variables.

Mathematical models are used to predict what will happen, or what might happen.

By giving values to all the input variables in the model, the model user can calculate

values for the output variables. For example, a simple model for the total costs of

Answers to practice questions

production might be y = a + bx. By giving values to fixed costs, the variable cost per

unit and the number of units (a, b and x respectively) we can calculate the total

costs, y.

With risk models, there is some uncertainty about the value of the input variables in

the model, or about the mathematical relationship between the input variables. This

means that there is also some uncertainty about the value of the output variables. By

altering the value of the input variables, different values for output variables are

obtained.

Mathematical models can therefore be used to prepare forecasts, with some

statistical analysis of the range of different possible outcomes. Models can also be

used to assess risk, also be measuring and analysing different possible results under

differing circumstances. The risk in any situation can often be quantified

mathematically, in the form of a probability distribution.

Risk models can, in some cases, be used to control risk levels. For example in

banking Value at Risk models are used to assess credit risk, and measure the

possibilities of losses of differing amounts from bad debts. Value at Risk models can

be used to control the total credit risk, by restricting the total credit that a bank gives

to customers. The total bad debt risk can be kept within acceptable limits at a

specified level of probability.

Risk models can also be used for stress testing. The purpose of stress testing is to

predict how an operation or activity will perform under extreme conditions. If the

model predicts that the operation or activity will not function adequately under

extreme conditions, extra risk control measures can be planned and introduced, to

make the operation or activity more ‘robust’. For example, a company operating

train services might use a risk model for stress testing, by predicting what might

happen if the total volume of passenger traffic on the trains were to increase by, say,

20%.

In summary, mathematical risk models can be used to obtain quantified

measurements of risk.

38 Embedded

‘Embedding’ means that risk awareness and risk control procedures and

management practices should be an integral part of operational and management

systems within an organisation.

It can be distinguished from risk control that is applied occasionally by an external

agency. For example, the annual audit of a company’s financial statements by the

external auditors is a form of risk monitoring, but it is not embedded within the

company’s own systems. It is a risk control measure applied from outside the

company. Similarly, inspections by external agencies, such as government

inspectors, are not embedded risk control measures.

Controls that are applied internally might not be ‘embedded’ when they are carried

out occasionally as a special initiative. For example, a company might carry out a

Paper P1: Governance, risk and ethics

risk review, but if this is a one-off exercise it is not an embedded feature of the risk

management system.

Risk (or risk awareness) should be embedded in a company’s culture. This means

that an awareness and understanding of risk should be a part of the thinking of

management and other employees. Decision-makers within a company should

consider the risks when they make their decisions. Employees should be conscious

of the need to control risks and apply risk controls in the work that they do.

Risk (or risk awareness) should also be embedded in a company’s values. This

means that the company should recognise the importance of risk management when

setting targets for performance and when judging actual performance. Reward

systems should not be based on profit maximisation: the payment of rewards

should also be linked to successful risk management. A frequent criticism

investment banks is that traders are rewarded for maximising profits on trading,

without regard for the risks they take: as a result, risk management might not be

given the status and recognition that it ought to have.

Risk should also be embedded within a company’s procedures. There should be

suitable internal controls within operating procedures, and employees should apply

those controls at all times. For example, safety procedures should be taught to all

employees and properly carried out at all times.

39 Consequentialist

(a) A consequentialist approach to ethics (also called a teleological approach) is to

take the view that the ‘correctness’ or ‘rightness’ of an action depends on its

outcome. An example of this approach is utilitarianism, which is the view that

the ethics of an action should be judged in terms of the good that it brings, and

the best course of action is the one that brings the greatest good to the greatest

number of people. The ‘rightness’ of an action therefore depends on the

circumstances of the situation.

A deontological approach to ethics is associated with the ideas of the

eighteenth century philosopher Kant. This approach takes the view that

certain actions are ethically right and others are wrong. It is the action itself

that makes it ethical or unethical, not the consequences of the action. This

view can be simplified into a statement that it is the means that is more

important than the result or ‘ends’ and if it is not ethical, ‘the means’ can

never justify the ‘ends’.

An example can illustrate the difference. There are differing views about

whether it is ethical to conduct experiments on animals in order to conduct

scientific research into developing new medicines for humans. A

consequentialist approach might be that the means justifies the ends, and

although experimentation on animals is unpleasant, it is necessary in order to

develop new medicines to save more human lives. A deontological approach

might be that experimentation on animals is wrong, and cannot be justified

even for the purpose of medical research.

Answers to practice questions

(Tutorial note: You might choose a different example for your answer, to

compare the two approaches. A commonly-used example is whether it can be

right to tell a lie. A consequentialist approach is that telling a lie can be

justified if the end result is ‘good’ or beneficial. A deontological approach is

that it can never be ‘right’ to tell a lie.)

(b) A consequentialist approach to business ethics is common. Many businessmen

who regard themselves as ethical individuals will take the view that the

‘rightness’ of an action can often be judged by the moral benefits that it will

bring.

This approach is often essential, because situations occur in business where a

deontological approach could have unacceptable consequences. Business is so

complex that it forces individuals into compromises.

For example, a deontological approach to ethics might be that it is wrong to

take away the job from an individual who has worked well and shown loyalty

to the employer. It is difficult to take this approach in a situation where a

company is losing money and will become insolvent unless it takes measures

to cut costs, including making some employees redundant. A consequentialist

approach would be that although it is unpleasant to make employees

redundant, this might be the right thing to do in order to keep the business in

existence, providing work to the employees who remain.

A major problem with a consequentialist approach, however, is that it is

largely subjective in its evaluation of what is right. It can be used, for example,

to justify the view that the purpose of a company is to maximise the wealth of

shareholders, and all actions by a company can therefore be justified on ethical

grounds if they add to profits. This approach would not be accepted by

someone who argues that a company has obligations to its employees, society

and the environment, as well as to its shareholders.

In an extreme form, a business man might argue that he always ‘knows what

is right’ and so will always act in an ethical way. This would be a highly

subjective view, which uses an ethical argument to justify selfishness and

egotism.

Although ethical views vary between different cultures, it might be argued

that business ethics ought to be determined to some extent by ‘core values’,

and that a deontological approach is appropriate to deciding what is right and

wrong, at least in certain situations.

40 Kohlberg

Kohlberg identified three levels of morality and six stages of moral development.

He suggested that individuals progress through the stages of moral development

during their life, one stage at a time. Many individuals do not progress to the higher

stages, but cease to progress when they have reached a lower level. Although the

ethical behaviour of individuals is sometimes at a lower stage of development than

the one they have reached, they do not regress to a lower stage of development

having reached a higher one.

ACCA P1 Governance, Risk and Ethics - 2011 - Study text - Emile Woolf Publishing

Подождите немного. Документ загружается.