Risk Management Notes (Last-Minute)

  • Topic: Risk Management
  • Focus: Key concepts, steps, tools, and treatment options for last-minute review.

Risk Attitude and Definitions

  • Risk Appetite (Risk Appetite/Research): broadly defined as the maximum level of risk an organization is willing to accept or take.
  • Risk Tolerance: level of variation the organization is willing to tolerate around objectives.
  • Risk Attitudes:
    • Risk Seekers / Takers: comfortable taking on risk.
    • Risk Averse: dislike uncertainty; seek clarity and control.
    • Risk Neutral: indifferent to risk in decision-making.
  • Inherent Risk: risk level present before controls.
  • Residual Risk: risk remaining after mitigation/actions.
  • Some people are more calculative and weigh pros/cons before deciding to take on risk.

Continuous Risk Management Process

  • A continuous cycle with steps:
    1. Understanding strategies & objectives
    2. Risks Identification
    3. Risk Assessment
    4. Risk Prioritization
    5. Risk Treatment
    6. Monitor & Communication
  • Begin with a clear risk framework that aligns with strategy and objectives.
  • A cross-functional team (often led by a Risk Management Coordinator) conducts the process.

Risk Identification

  • Involves identifying risks from various sources and across the organization.
  • Cross-functional team approach is typical.
  • Common techniques:
    • Brainstorming sessions (group problem solving; spontaneous contributions from all members)
    • Event inventories / historical data to list possible risks
    • Self-assessment and interviews with project participants or experts
    • Facilitated workshops focusing on future uncertainties
    • SWOT Analysis (Strengths, Weaknesses, Opportunities, Threats)
    • Risk questionnaires and surveys
    • Scenario analysis
    • Leading indicators and preventive measures
  • Outputs: a set of identified risk areas and potential events that could threaten objectives.

Risk Assessment (Qualitative & Quantitative)

  • Qualitative tools:
    • Risk Map: positions risks by criteria (often Likelihood vs Impact)
    • Risk Heat Map: visual representation of risk severity
    • Likelihood vs Impact axes: extLikelihood,extImpactext{Likelihood}, ext{Impact}
  • Quantitative tools:
    • Value at Risk (VaR): measures potential loss over a defined period at a given confidence level; based on a distribution assumption. extVaR=extValueatRiskext{VaR} = ext{Value at Risk}
    • Cash Flow at Risk: sensitivity of cash flows to variations over a period; akin to VaR for cash flows
    • Earnings at Risk: potential downside in earnings over a period; uses confidence intervals
    • Earnings distribution: probabilistic view of earnings outcomes
    • Earnings per share (EPS) distributions
    • Scenario analysis: evaluate outcomes under designated events or conditions
    • Leading indicators: proactive signals that help prevent risk realization
    • Process mapping / flow analysis: to identify control gaps
  • In assessment, consider:
    • Likelihood of occurrence
    • Impact magnitude if it occurs
    • Interrelationships among risks
  • Nature of risks:
    • Inherent risk vs residual risk (after controls)

Risk Ranking and Magnitude Metrics

  • Ranking: prioritize risks by potential impact and likelihood to address high-priority risks first.
  • Loss concepts:
    • Expected loss: average loss anticipated over time
    • Unexpected loss: potential loss beyond expected in a bad year
    • Maximum Probable Loss: largest loss likely under foreseeable circumstances
    • Maximum Possible Loss (Worst case): greatest possible loss under extreme conditions
  • Output: a prioritized list of risks and their mitigation needs.

Risk Treatment (Mitigation Strategies)

  • Once risks are identified and assessed, determine treatment options:
    • Risk Avoiding: eliminate the risk by changing plans or activities (if loss probability is high and unacceptable)
    • Risk Reducing (Mitigation): reduce likelihood or impact
    • Risk Transferring / Sharing: shift risk to another party (e.g., insurance, outsourcing)
    • Risk Retaining (Retention): accept the risk, possibly when costs of mitigation exceed expected benefit
    • Risk Acceptance: intentionally accept risk to pursue potential profits; requires monitoring
  • Insurance is a common transfer method.

Monitoring, Communication, and Control Improvement

  • Continuous monitoring ensures risks are addressed as intended.
  • Communication flows across, down, across, and up the organization to keep all stakeholders informed.
  • Monitor effectiveness of controls and adjust as needed.

Additional Tools and Concepts

  • Process Mapping / Flow Analysis: useful for understanding processes, ownership, and controls; helps identify gaps and improve risk management.
  • Scenario Analysis: design scenarios to test resilience and readiness.
  • Event inventories: keep an organized catalog of potential events to prompt risk identification.
  • Leading indicators: preventive measures and signals that can reduce risk exposure before events occur.

Quick Reference Formulas and Outputs

  • Qualitative mappings use axes: extLikelihoodext{Likelihood} vs. extImpactext{Impact}

  • Quantitative risk measures:

    • extVaRext{VaR}: Value at Risk over a defined period and confidence level
    • extCashFlowatRiskext{Cash Flow at Risk}: risk to cash flows over a period
    • extEarningsatRiskext{Earnings at Risk}: potential decline in earnings over a period
    • extExpectedloss,extUnexpectedloss,extMaximumProbableloss,extMaximumpossiblelossext{Expected loss}, ext{Unexpected loss}, ext{Maximum Probable loss}, ext{Maximum possible loss}

  • Risk treatment choices should be decided before action based on ranking and potential losses.