Paul Hopkin. Fundamentals of Risk Management

Подождите немного. Документ загружается.

Deﬁ ning the upside of risk

Upside of risk

Deﬁ ning the upside of risk is one of the greatest challenges for risk management. The overall

contribution of risk management is to help deliver compliance, assurance, as well as enhanced

decision making and efﬁ ciency/effectiveness/efﬁ cacy (CADE3). However, there is a desire

amongst risk management practitioners to identify a more dynamic range of beneﬁ ts that can

be delivered by successful risk management.

A range of interpretations of the upside of risk is possible and some of these are offered in

Table 17.1. There is a belief amongst risk management practitioners that risk management

makes a signiﬁ cant contribution to the operation of the organization, and this contribution is

often described as the upside of risk. In simple terms, the upside of risk is achieved when the

beneﬁ ts obtained from taking the risk are greater than any beneﬁ t that would have resulted

from not taking it. In other words, the organization has received an overall beneﬁ t from under-

taking the activities that resulted in exposure to the risk or set of risks involved.

At its most simplistic, the upside of risk in relation to hazard management is that there is less

downside. Good standards of risk management will ensure that there is less potential for dis-

ruption to normal, efﬁ cient, routine operations. However, it is clearly not sufﬁ cient to say that

the upside of risk is simply that there would be less downside. A more proactive interpretation

of the upside of risk is when an organization realizes that solving a particular risk-based

problem has brought a beneﬁ t, rather than a cost.

For example, a manufacturing company that produces waste by-products that create a dis-

posal problem may achieve the upside of risk by selling that unwanted by-product or identify-

ing a means of adding value to the waste product and selling it as another product stream. This

is an example of identifying a difﬁ culty for the business and, in solving that difﬁ culty, acquir-

ing additional beneﬁ ts that had not been foreseen and were not otherwise available.

154

Deﬁ ning the upside of risk 155

Table 17.1 Upside of risk

Fewer disruptions to normal operations and greater operational efﬁ ciency resulting •

in less downside of risk

Ability to seize an opportunity denied to competitors because a better-informed

•

view of the management of risk is taken

Deliberately identifying events that will be positive during the risk assessment and

•

deciding how to manage those events

Opportunity management, whereby a detailed evaluation is undertaken of new

•

business opportunities before deciding to take the opportunity

Achieving a positive outcome from a situation that could have gone wrong without

•

good judgement/risk management

Achieving compliance/risk assurance in difﬁ cult circumstances as an unintended/

•

automatic consequence of good risk management

Another interpretation of the upside of risk is that the risk assessment workshop should also

focus on identifying risks that have an upside outcome. The risk assessment workshop would

therefore address questions like: ‘What events would create a better outcome than expected?’

A register of positive outcome risks can then be identiﬁ ed and actions can be taken to make

those upside risks more likely to occur or have more beneﬁ cial consequences when they do

materialize.

A more satisfactory explanation of the upside of risk is that the organization will be able to

undertake activities that it would not otherwise have the appetite to undertake. In a com-

mercial sense, this is enabling an organization to seize a business opportunity that a com-

petitor does not have the appetite to take, or considers to be too risky. This may be because

of the greater efﬁ ciency within the organization, or because a cost-effective means of chang-

ing the organization by a development project has been identiﬁ ed that the competitor failed

to see. On a strategic level, this upside of risk may arise from the organization identifying a

means of targeting the business opportunity, but only the proﬁ table component of that

business opportunity.

Another way of looking at the upside of risk is to reﬂ ect on a business venture that turned out

successfully in circumstances where failure could have been foreseen. This is a somewhat ret-

rospective approach based on the analysis ‘that could have gone wrong, but it did not and

therefore we have enjoyed the upside of taking that risk.’ This approach to the upside of risk

depends on the organization being willing to pursue a risky venture, albeit with adequate con-

trols in place, that leads to a positive outcome in circumstances where a competitor may not

have been willing to take the risk.

Finally, there is the analysis of the upside of risk that reﬂ ects on the beneﬁ ts of having a

robust risk management process. Achieving the CADE3 beneﬁ ts, especially beneﬁ ts related

156 Risk assessment

to compliance, may be considered to be a sufﬁ cient reason for undertaking a risk manage-

ment initiative. In these circumstances, certain organizations may consider that achieving

compliance is an upside of risk.

Opportunity assessment

Successfully embracing business opportunities is more likely to be achieved if the organization

undertakes opportunity assessments. Many consultancy ﬁ rms undertake a detailed evaluation

of each new business prospect. The organization will look at the new business prospect and

evaluate the scope for a proﬁ table partnership, opportunities to earn extra income and the

reputational beneﬁ ts that might arise from having that potential client as a customer.

Opportunity assessment can be undertaken in relation to new business ventures, as well as

new clients. This opportunity evaluation is designed to identify the additional business oppor-

tunities that could arise from winning that client business. The evaluation will also look at the

potential disadvantages of successfully acquiring the client prospect. When undertaking such

an opportunity assessment, there has to be the possibility that the organization will advise the

client prospect that they do not wish to tender for the business.

Consider the options for a theatre that discovers that fewer people are coming to perform-

ances and decides to look at the opportunities to take more money from those who continue

to attend. The options may include general improvement to the catering facilities within the

theatre and the provision of organic produce. Additionally, there is the possibility of selling

merchandise themed to the particular performance.

As well as looking at increased revenue during performances, the theatre may also look at

sponsorship arrangements and open dialogue with local businesses to discover what type of

production would be most likely to gain local support and sponsorship. In future, part of the

assessment of any proposed new production could include an evaluation of the level of spon-

sorship that might be available. As well as generating greater income, this approach could also

enable the theatre to stage productions that otherwise would have been considered too risky.

Many organizations already practise opportunity management, although it may not be seen

explicitly as a risk management approach. Ideally, opportunity management should be embed-

ded into work processes for developing and implementing strategy and/or taking advantage of

business opportunities. Some organizations do not have explicit opportunity management

procedures for the evaluation of new business prospects, or for the evaluation of merger/

acquisition opportunities.

Deﬁ ning the upside of risk 157

Riskiness index

The risk proﬁ le of an organization can be represented in many ways. The most common

method used is to prepare a risk register that contains details of the signiﬁ cant risks faced by

the organization. However, a disadvantage of the risk register is that it is usually a qualitative

evaluation of individual risks. Organizations need to develop a means of measuring, evaluat-

ing and quantifying the total risk exposure of the organization.

One of the features of the enterprise risk management approach is to develop the consolidated

view of the risk exposure of the organization. The approach based on calculating the total risk

exposure of an organization is similar to the approach taken to the measurement of risk in

operational risk management.

This Part introduces the idea of a ‘riskiness index’. The idea is to present a semi-quantitative

approach that takes a snapshot of the overall level of risk embedded in the organization. The

overall level of risk will pay regard to the strategy currently being followed by the organization,

the projects that are in progress, and the nature of the routine operations being undertaken.

Table 17.2 presents a set of questions that can be used to develop a riskiness index for an

organization. The table uses the structure of the FIRM risk scorecard as a means of categoriz-

ing risks. By using the riskiness index, it should be possible for an organization to identify the

level of risk faced by its ﬁ nances, infrastructure, reputation and the level of risk that it faces in

the marketplace.

Having completed the riskiness index, the organization can then seek additional controls to

reduce the level of risk. The main focus of risk management is then simply to reduce the

level of riskiness within the organization without affecting the strategy, project or opera-

tions of the organization. The upside of risk then becomes that the organization can follow

the desired strategy, projects and operations at the lowest level of risk that is reasonably and

cost-effectively achievable.

It will then be for the board of the company to decide whether the level of risk identiﬁ ed by the

riskiness index analysis is aligned with the risk appetite of the board and within the risk capac-

ity of the organization. The level of risk identiﬁ ed by the riskiness index represents the risk

exposure of the organization. The board can then compare this level of risk exposure with the

risk capacity of the organization and the appetite of the board towards risk.

158 Risk assessment

Table 17.2 Riskiness index

Allocate a score of between 0 and 5 to each component of the generic example of the

FIRM risk scorecard to determine the level of risk within the organization, project,

operation or location being evaluated.

Financial component of the FIRM Risk Scorecard

Index Description Score

1.1 Lack of availability (or unacceptable cost) of adequate funds to fulﬁ l

the strategic plans

1.2 Insufﬁ

ciently robust procedures for correct allocation of funds for

strategic investment

1.3 Inadequate internal ﬁ nancial control environment to prevent fraud

and control credit risks

1.4 Inadequate funds to meet historical liabilities (including pensions)

and meet future anticipated liabilities

TOTAL for the ﬁ nancial component

Infrastructure component of the FIRM Risk Scorecard

Index Description Score

2.1 Inadequate senior management structure to support organization

and embed ‘risk-aware culture’

2.2 Insufﬁ

cient people resources, skills and availability, including

concerns about intellectual property

2.3 Inadequate physical assets to support the operational and strategic

aims of the organization

2.4 Information technology (IT) infrastructure has insufﬁ cient resilience

and/or data protection

2.5 Business continuity plans are not sufﬁ ciently robust to ensure

continuation of organization after major loss

2.6 Product delivery, transport arrangements and/or communications

infrastructure unreliable

TOTAL for the infrastructure component

Deﬁ ning the upside of risk 159

Table 17.2 continued

Reputational component of the FIRM Risk Scorecard

Index Description Score

3.1 Poor public perception of the industry sector and/or potential for

damage to the brands of the organization

3.2 Insufﬁ

cient attention to ethics/corporate social responsibility/social

environmental and ethical standards

3.3 Poor governance standards and/or sector is highly regulated with

high compliance expectations

3.4 Concerns over quality of products or services and/or after sales

service standards

TOTAL for the reputational component

Marketplace component of the FIRM Risk Scorecard

Index Description Score

4.1 Insufﬁ cient revenue generation in the marketplace or inadequate

return on investment achieved

4.2

Highly competitive marketplace with aggressive competitors and

high customer expectations

4.3 Lack of economic stability, including exposure to interest rate

ﬂ uctuations and foreign exchange rates

4.4 Marketplace requires constant innovation and/or product

technology is rapidly developing

4.5 Supply chain is complex and lacks competition and/or raw materials

costs are volatile

4.6 Organization is exposed to potential for international disruption

because of political risks, war, terrorism, crime or pandemic

TOTAL for the marketplace component

160 Risk assessment

Table 17.2 continued

Score Description of the level of risk Score Description of the level of risk

0 No risk 3 Medium risk

1 Little risk 4

High risk

2 Some risk 5 Extreme risk

Upside in strategy

Organizations will have a mission statement, together with a set of corporate objectives and an

understanding of the expectations of the different stakeholders in the organization. The board

of the organization then needs to develop an efﬁ cacious strategy that will deliver exactly what

is expected in terms of the mission, objectives and expectations. In order to make correct stra-

tegic decisions, the board of the organization will need access to risk information. A risk assess-

ment of the proposed strategy, together with a risk assessment of any viable alternative

strategies, should be undertaken. The availability of this risk assessment information will

ensure that the strategic decisions are more likely to be correct.

For opportunity risks, there is probably even less data available on which to predict risk likeli-

hood. An organization may see an opportunity to acquire a new client or develop and market

a new product. Accurate risk assessment of the likelihood of positive and negative events will

be necessary in order to determine whether the new venture should go ahead. When a new

product is launched, the requirement may well be to increase the likelihood of a positive event

occurring. If a new product is being launched, then advertising and press coverage will need to

be maximized up to the point that it remains cost-effective. Actions should therefore be taken

to increase the level of media interest in the launch.

Strategic core processes bring the disciplines of strategic planning and risk management

together. Strategic planning is a systematic process for obtaining a consensus at board level on

the small number of issues that could have a massive effect on the long-term performance of

the organization. Strategic issues are vitally important and failure to implement strategy or the

selection of an inappropriate strategy can be amongst the most devastating risks to hit an

organization. Implementation of strategy is usually achieved by way of projects and then ulti-

mately delivered by operational core processes.

The box below describes an attitude to risk management that sees a risk as opportunity. This

approach to the management of the organization demonstrates the desire to embrace the

upside of risk.

Deﬁ ning the upside of risk 161

Opportunity management

Most managers treat risk as an unwanted by-product of the business – something to be

controlled whenever possible. That way of thinking stems from an overly simplistic

view of risk. Some risks should be minimized, but others should be embraced in the

drive for growth. Indeed, the pursuit of growth requires placing bets on speciﬁ c

products, customer segments, channels, company alliances and so on – all of which

entail management of strategic risk. The most successful companies do not try simply

to defend against bad risk events; they also deﬁ ne and predict the upside risks that,

when well managed, can deliver the maximum rewards.

Upside in projects

It is essential that every organization adopts the correct core processes. A core process may

be considered as the collection of activities that deliver a speciﬁ c stakeholder expectation.

This is the meaning of core process that is allocated by business process re-engineering

(BPR) practitioners.

There is a difference between a process being efﬁ cient and effective. An efﬁ cient process means

that there is no disruption and no excess cost. However, the process may be the incorrect one

for cost-effectively delivering the requirements. Where processes need to be improved, a

project will normally be undertaken and change achieved. In circumstances where a series of

projects are required, this is often referred to as a programme of work. When a project, or pro-

gramme of work, is implemented by an organization, the desire will normally be to improve

the effectiveness of core processes.

By undertaking adequate risk assessment of the intended change, the organization should be

able to ensure that the project is more successfully delivered on time, within budget and to

speciﬁ cation. Achieving the upside of risk in the project or programme management requires

that projects are adequately managed and that the correct project or priorities have been

selected by the organization.

Often, organizations will undertake a post-implementation review to ensure that the beneﬁ ts

expected from the project have been delivered in practice. This review is often undertaken by

internal audit and is designed to ensure that the project was delivered successfully, delivered

the beneﬁ ts that were required and was overall worthwhile. During difﬁ cult ﬁ nancial times, it

is important that the organization selects projects that are not only successful, but represent

the best possible allocation of limited resources when compared with alternative projects that

have not been selected.

162 Risk assessment

Upside in operations

It is a fundamental requirement for organizations that they have efﬁ cient operations. Efﬁ cient

operations should make best use of the resources of the organization and should operate

without unplanned disruption. Undertaking efﬁ cient operations that use minimum resources

and produce maximum output will deliver the greatest beneﬁ t to the organization.

Risk management evaluation of operations can enable the organization to deliver the most

efﬁ cient activities, operations and processes. By delivering the most efﬁ cient operations, a

commercial organization can achieve beneﬁ ts over a competitor and undertake work for a

lower cost and still make a proﬁ t.

For public services, the delivery of efﬁ cient operations is equally important. Most public serv-

ices have targets for delivery that can be complex and challenging. Failure to anticipate and

manage risks appropriately can undermine the delivery of public services. The contribution of

risk management will also help achieve sustained improvements in service by bringing ﬂ exi-

bility and resilience to the way in which services are delivered. This contribution by risk man-

agement may be considered to be part of delivering the upside of risk.

In a competitive marketplace, achieving the upside of risk will often be to the detriment of

competitors, suppliers or other third parties. The box below describes a situation whereby a

restaurant company was able to take advantage of the market conditions during the global

ﬁ nancial crisis.

Embracing opportunities

Consider two simple examples where the global ﬁ nancial crisis has resulted in beneﬁ t

or upside risk for organizations. An international restaurant brand has discovered that

landlords in city centre locations are looking for tenants. This has enabled the

restaurant business to relocate into busier parts of a city centre at reduced rents, whilst

also increasing trade and proﬁ ts.

With the reduction in industrial activity resulting from the global ﬁ nancial crisis, an

electricity generating company has been able to decommission old, costly generating

facilities, and thereby reduce the overall cost per unit of producing electricity. This has

increased proﬁ t per unit and enabled the company to revise strategic plans for future

additional generating capacity to reduce generating costs over the long term.

Business continuity planning

Importance of BCP and DRP

There has been considerable interest in the subjects of business continuity planning (BCP)

and disaster recovery planning (DRP) in recent times. Several standards have been published

around the world. This illustrates the importance of BCP as an integral part of risk manage-

ment. This increased concern has been reinforced by the potential for major disruption posed

by extreme weather events, terrorist attacks, civil emergencies and the fear of a ﬂ u pandemic.

In simple terms, BCP is how an organization prepares for future incidents that could jeopard-

ize its existence. The range of incidents that should be covered will include everything from

local events like ﬁ res through to regional disruption such as earthquakes or national security

incidents and extend to international events like terrorism and pandemics.

British Standard BS 31100 deﬁ nes business continuity planning as a ‘holistic management

process that identiﬁ es potential threats to an organisation and the impacts to business opera-

tions that those threats, if realised, might cause, and which provides a framework for building

organisational resilience with the capability for an effective response to safeguard the interests

of its key stakeholders, reputation, brand and value-creating activities’.

In case of a serious incident such as loss of access to premises or failure of a major part of an

organization, it is important to have in place a well deﬁ ned, documented and tested disaster

recovery plan. Such plans inevitably focus on recovery of access to IT systems and data, but

also commonly cover the provision of alternative premises (if needed) and other facilities, as

well as setting out plans for communications with employees and with other stakeholders such

as suppliers, customers and the media at a time of crisis.

Business continuity plans build upon this by setting out longer-term plans for restoration

of ‘business as usual’ in the immediate aftermath of a disaster. A business continuity plan

is an important part of reducing the impact of a hazard incident. The plan should include

163