Lecture 4 – The Case for Risk Management & the Risk Management Process

Brief History of Risk Management

Coping with adversity has always been a part of human existence.
By 3000 BC Chinese merchants used the technique of spreading cargo across different vessels to manage risk of loss.
Around the same time, the Babylonians developed bottomry bonds to mitigate the loss of cargo at sea.
Risk management as a formal business function originated in the US, pioneered by insurance managers in the 1950s.
The concept evolved in process industries, e.g., oil companies, in the context of insurance.
The focus was on minimizing downside risk, i.e., undesirable outcomes.
Opportunities created by risk were not emphasized or appreciated.
By the 1960s, captive insurance companies started to emerge, sponsored by major insurance brokers, especially in Bermuda.
Beginning in the 1970s, risk management expanded from risk financing to other aspects like risk control, loss prevention, and safety management.
Captive insurance companies started to emerge in other offshore centers (tax havens) like The Isle of Man, Guernsey, and others.
By the 1980s, self-insurance programs other than through captives started to develop.
Environmental damage, consumerism, and attitudes of the courts increased corporate concerns for negligence liability.
By the 1990s, the lack of insurance and reinsurance capacity for large corporations led to new forms of protection such as risk securitization and alternative risk transfer.
There was recognition that risk management needs to be integrated into overall corporate strategy.
In the 2000s, a growing number of organizations dedicated to developing risk management standards such as ISO and COSO emerged.
These risk management standard-setting bodies emphasized the need for integrating risk management into corporate strategy.
The concept of enterprise-wide risk management (ERM) started to develop.

Definition of Risk Management

ISO31000: “… coordinated activities to direct and control the organization with regard to risk.”
PWC- COSO … “The culture, capabilities, and practices, integrated with strategy-setting and its execution, that organizations rely on to manage risk in creating, preserving, and realizing value.”
Most definitions of enterprise risk management emphasize its focus on managing risk through:
- Recognizing culture and capabilities.
- Applying practices.
- Integrating with strategy-setting and its execution.
- Managing risk to strategy and business objectives.
- Linking to creating, preserving, and realizing value.

Examples of Recent Risk Events

Corporate trading and fraud risks:
- Collapse of Barings Bank ( $1995$ ).
- Collapse of Enron ( $2002$ ).
- VBS Mutual Bank ( $2018$ ).
Supply chain risks – integrated global production systems due to globalization.
Epidemics and pandemics:
- Ebola outbreak in West Africa ( $2014$ ).
- Covid-19 global pandemic ( $2020$ ).
Operational risks – Deep Horizon environmental disaster ( $2010$ ).
Cyber risks – Sony Pictures Entertainment server attack ( $2014$ ).
The $2018$ Boeing 737 Max-8 disaster.
Natural disasters:
- Hurricane Katrina ( $2005$ ).
- Japanese earthquake and tsunami ( $2011$ ).
- Cyclone Idai ( $2019$ ).
Public relations and reputational risks – KPMG ( $2017$ ).
Accidents and Human error:
- Bhopal disaster ( $1984$ ).
- Chernobyl nuclear disaster ( $1986$ ).

Benefits of Risk Management

Improved planning, performance, and effectiveness.
Improved information for decision-making.
Greater time and cost certainty.
Fewer surprises.
More efficient use of resources.
Enhanced quality of output.
Improved communication and stakeholder relationships.
Value creation.
Enhanced opportunities for success.
Exploitation of opportunities.
Greater certainty in delivery and the effective realization of required business outcomes.
Objective comparison of business options.
Optimal placement of risk.
Prioritization of team efforts.
More effective management of change.
Enhanced reputation.
Integration of trade and production processes due to globalization implies that risk has no political boundaries.
Risk management reduces the long-term financial variability of corporate earnings, i.e., RM stabilizes firm earnings.
Improved credit standing.
Reducing the chance of firms going bankrupt – risk can cripple a firm if left unmanaged.
Lowering the cost of production thereby creating more value.
In developing countries, risk management is a tool for development and poverty alleviation.
The link between the lack of risk management options and poverty is now widely acknowledged.
Risk management improves the ability to cope with change.
Managing risk successfully brings other benefits that are not often understood.
Risk is not only exclusively about negative outcomes; it also creates opportunities.
For example, the Covid-19 pandemic was a global risk event but also created opportunities for manufacturers of drugs and other equipment.
One way to illustrate the benefits of risk management is to use the Risk-Reward Pyramid.
The essence of it is that there is a reward to managing the main risks facing an organization, be they strategic, operational, financial, or insurable risks.
The risk-reward pyramid further reminds us that risk is not only about undesirable or negative outcomes.
Balancing risk-taking and risk management brings handsome rewards.

Explaining the Risk-Reward Pyramid

A firm’s business and operating environment determines the strategic, operational, financial, and insurable risks it faces.
Strategic risks are linked to business plans, strategy, and execution methods.
Strategic risks have a direct impact on corporate objectives.
Therefore, they pose a greater danger to the survival of a firm and its ability to create value.
The reason for this is that there are more options to deal with other risk types, e.g., borrowing, insurance, and other market instruments, which are unavailable for strategic risks.
Organizations can recover quickly from things like fire than from failed strategies.
For example, there is no market instrument for compensating a firm for losses from a failed business relationship.
Operational risks arise from a firm’s people, systems, and processes.
Effective management of these risks improves efficiency and competitiveness.

The Cost of Risk

Regardless of the type of risk one faces, risk is costly if left unmanaged.
Risk management seeks to deal with the cost of risk ex ante, i.e., before they occur.
The cost of risk has 5 main components:
- Expected losses
- The cost of loss control
- The cost of loss financing
- The cost of internal risk reduction
- The cost of residual risk that remains after loss control, loss financing, and internal risk reduction methods have been implemented.
Residual risk = Inherent risk – Controlled risk.
Residual risk can be accepted, or action may be taken to deal with it or its perceived consequences.

Obstacles to Adoption of RM

Although the case for managing risk is compelling, organizations often struggle to put sound risk management systems in place.
The main constraints that organizations face include:
- Lack of resources.
- Lack of information and data.
- Missing markets and public goods to support risk management, especially in developing countries.
- Social and economic externalities that distort incentives to manage risk.
- Public risks (e.g., pandemics, environmental damage) require collective action between governments to manage them effectively.
In some countries, there is mistrust bordering on hostility between government and the private sector.

RM and Shareholder Value

Current RM practice through market instruments is heavily biased towards financial and insurable risks.
Consequently, the greatest risks contributing to the loss of shareholder value out of the 4 generic risk types are:
- Strategic risks, followed by
- Operational risks embedded in organizational factors
The reason why this is so is that most aspects of the 2 risk types above are not transferable.
For example, no market instrument exists to protect a firm against its own inefficiency or its poor strategy.
Equally, there is no market instrument to deal with the fallout from launching an inappropriate product.
Therefore, successful firms tend to be those that get it right in terms of managing strategic and operational risks.

Risk Management and Societal Welfare

Minimizing the total cost of risk leaves society facing an efficient level of risk.
However, the benefits and costs of risk management are often difficult to measure.
By creating an environment where economic agents can operate in otherwise risky environments, risk management maximizes societal welfare by creating opportunities for accelerated wealth creation.
The absence of efficient risk management options is increasingly being viewed as one of the reasons why the poor remain so.
This is because the poor cannot manage risk efficiently, causing them to opt for low-risk activities that have low pay-offs.
Partaking in low-risk-low payoff activities slows down the transition from poverty.
By making human environments safer, risk management enhances the well-being of society.
Also, by preventing people from engaging in activities they deem necessary, risk contributes to the loss of welfare for those people.

The Risk Management Process

The RM process is the “systematic application of management policies, procedures, and practices to the tasks of communication, consultation, establishing the context, identifying, analyzing, evaluating, treating, monitoring, and reviewing risk” (ISO31000:2009).
Notable features of this definition include:
- Risk management is a dynamic process, not a checklist.
- The risk management process involves matching the actual risks taken by the firm to the risks that the firm believes it “should be” taking.
Risk management should be embedded in all the organization's practices and processes in a way that it is:
- relevant,
- effective, and
- efficient.
The risk management process should become part of, and not separate from, those organizational processes (ISO31000:2009).

What the RM Process Should Provide

The risk management process must provide guidelines on the following:
- The means to identify risks – different operating environments require different risk identification tools and techniques.
- The means to measure and assess the level of risk exposure – risk measurement and assessment informs risk prioritization.
- The means to prioritize risks for treatment – risk prioritization is critical for decision-making and resource allocation.
- The means to identify treatment options – risk treatment options are context-specific.
- The means to communicate risk information
- The means to continuously improve the project risk management process.

ISO31000 RM Process

Establish Business Context:
- Strategy, Business Objectives, Risk Tolerances, Risk Owners, Stakeholders, Risk Language
Identify Risks:
- What can happen?/When and where?/How and why?
Assess Risk & Controls:
- Identify existing control
- Determine Impact
- Determine likelihood
- Determine Level of Risk
Evaluate Risk:
- Compare against criteria
- Set priorities
Treat Risk:
- Identify treatment options, analyze, and evaluate residual risk, prepare and approve treatment plans, implement plans
Monitor/Review
Communicate and Consult

ISO31000 RM Process - Establishing the Business Context

Need for a good understanding of the organization in terms of its:
- Business activities
- Business model
- Operating environment
- People, systems, and processes
The purpose of this is to identify all risks embedded in strategy.
Strategy = an organization’s plan to achieve its goals/objectives and gain a competitive advantage.
Failed strategy leads to failure to meet objectives. Failure to meet objectives implies failure of the business venture itself.
A tool that can be used to achieve this is the performance-driven strategy (PDS).
The PDS framework provides a lens to deconstruct and analyze strategy and its critical elements.

Risk Identification

Risks facing a company are determined by several factors. The main ones include:
- (i) What does the organization do? (Objectives/activities).
- (ii) How does it carry out its business activities? – (Strategies, processes, systems, procedures, etc).
- (iii) Where does the company conduct its business? –location (external environment/context e.g., social, political, economic factors).
Therefore, some risks facing a financial services company differ from those facing a manufacturing company.
Where the company conducts its business is also a determinant of risks it faces.
A company operating only in South Africa faces different risks to one with foreign branches.
Corporate strategy is also a major determinant of risks facing a company.

Risk Identification Techniques

There are multiple risk identification techniques, which include:
- Physical inspections and surveys
- Checklists
- Hazard and operability studies (Hazop studies)
- Organizational and Flowcharts
- Fault tree analysis
- Legislation and Codes of Practice
- Financial statement analysis
- Failure, mode, and effect analysis (FMEA)
Some of the above techniques, e.g., Hazop studies and FMEA, are sophisticated techniques which may require specific expertise.
No one technique provides all the answers; hence, the strengths and weaknesses of each technique must be understood.

ISO31000 RM Process - Analyze Risk

The process of managing risk involves risk analysis.
A primary objective of this step of the ISO31000 RM process is two-fold:
- To identify inherent risk
- To identify residual risk
The impact of risk control measures and their constraints must be considered.
Inherent risk must be analyzed in terms of likelihood and impact.
The relationship between frequency and severity must be understood.
This process also informs risk prioritization.
Existing controls must be identified and assessed.
Determine residual risk in terms of impact and likelihood.

Risk Ranking Criteria

Severity Ranking:
- Critical: Negative outcomes or missed opportunities that are of critical importance to the achievement of objectives.
- Major: Negative outcomes or missed opportunities that are likely to have a relatively substantial impact on the ability to meet objectives.
- Moderate: Negative outcomes or missed opportunities that are likely to have a relatively moderate impact on the ability to meet objectives.
- Minor: Negative outcomes or missed opportunities that are likely to have a relatively low impact on the ability to meet objectives.
- Insignificant: Negative outcomes or missed opportunities that are likely to have a relatively negligible impact on the ability to meet objectives.
Likelihood Category:
- Common: The risk is already occurring, or is likely to occur more than once within the next 12 months.
- Likely: The risk could easily occur and is likely to occur at least once within the next 12 months.
- Moderate: There is an above-average chance that the risk will occur at least once in the next 3 years.
- Unlikely: The risk occurs infrequently and is unlikely to occur within the next three years.
- Rare: The risk is conceivable but is only likely to occur in extreme circumstances.

Risk Registers

One of the tools used in risk analysis is the risk register.
Risk Registers capture risk information from the “bottom-up” within each Service Area.
The risk register is a primary tool for risk tracking and will contain the overall system of risks and the status of any risk mitigation actions.
The Risk Register provides the latest details on identified risks and their current status.
Typically, the register would provide the following information for each of the identified risk items:
- Unique risk identification number
- A description of the identified risk, its causes, and consequences
- Details of existing control measures
- Analysis of consequence/and probability, given the controls
- Risk rating
- Suggested risk treatments
- Nominated person(s) responsible for specific risk treatments (where approved) and associated timeframes for implementation.
- Review arrangements

Risk Evaluation

The likelihood of an event is linked to its frequency.
High likelihood of occurrence tends to lead to high frequency and vice-versa.
Frequency measures the number of events happening in each period.
Assume Company X had 15,000 employees over the past 5 years, and the company had 1,600 injuries over the same period.
Then the probability of a particular worker being injured is: $1,600 / (15,000 * 5) = 0.02$ per year.
Above determination is only possible if historical data on accidental injuries exists.
Severity of loss measures the magnitude of loss per occurrence. One way to do this is to use the average severity of loss per occurrence from past events.
Thus, if the 1,600 injuries at Company X cost R4m, the expected severity would be: $R4,000,000 / 1,600 = R2,500$
Again, the above estimate of severity assumes the availability of historical data.

Risk Measurement

In Lecture 1, we saw that economics and finance define risk as the variation of actual outcomes from expected outcomes.
Risk can be evaluated or measured from this perspective.
Investment A is riskier than Investment B because Investment A has a wider dispersion of potential outcomes than Investment B.
An alternative way of measuring risk is to use the downside risk concept.
This method of measuring risk focuses on adverse outcomes (downside).
The method sets a tolerable level of loss, i.e., the level of loss an organization is willing to accept.
Beyond the tolerable loss level is downside risk.
The variation of outcomes method of measuring risk is more mathematically tractable and resonates with the theory of economics and finance’s conceptualization of risk.
The downside risk method has more intuitive appeal, i.e., it is consistent with what people ordinarily regard as risk.
Nevertheless, no one method is better than the other – it all depends on what the decision-maker wants to achieve.

Risk Evaluation (Loss Estimations)

Risk managers are also interested in estimating expected losses from risk events.
There are various loss estimations that can be used.
The differences among them lie in the assumptions built into each method.
Methods of estimating loss include:
- Maximum Foreseeable Loss (MFL) – this method is based on the worst-case scenario assumption.
- Estimated Maximum Loss (EML) – this method of estimating loss assumes that there is some measure of efficacy in loss prevention measures that are in place.
- Normal Loss Expectancy (NLE) – this method of estimating loss relies on historical data to determine average loss sizes. It also uses the assumption that loss prevention measures operate as they are expected to.
These loss estimation methods are typically associated with downside risk events.

Risk Control/Treatment

Risk control or treatment is any conscious action (or decision not to act) taken that reduces the frequency, severity, or unpredictability of risk.
This is the most practical stage of the RM process and one where the buy-in of the whole organization is required.
Risk control is often called a staff function.
The purpose of risk control is to protect the resources of an organization or household by eliminating or limiting the frequency or severity of losses.
Since risk control involves interventions, it relies heavily on risk identification and risk analysis or evaluation.
Total risk facing a firm is the sum of:
- Strategic risks that cannot be transferred from the firm
- Risks that can be treated internally by the firm using its own resources
- Risks that can be transferred to markets, e.g., through insurance, hedging, and sub-contracting
- Risks that the firm tolerates and does not deploy formal management techniques.
Not all risks are controllable. Controllable risks have certain distinct properties.

Risk Control/Treatment Measures

(i) Risk avoidance
(ii) Risk elimination
(iii) Risk reduction, e.g., by targeting frequency or severity
(iv) Transfer or sharing
(v) Risk acceptance
Risk control is not costless – it involves expenditure.
The desirability of any risk control measure must be analyzed in relation to its cost and benefit.
Risk control expenditure is justified when it is less than the value of the benefit it generates.
Risk control is investment in value creation. It is justified when it generates returns that create value for the firm.
Some risk control measures may be prescribed in legislation.
For example, the South African Mine Health and Safety Act 1996 prescribes some risk control measures.

Monitoring & Evaluation

Risk management is a continuous activity.
It requires constant monitoring and review of residual risk.
The main functions of monitoring and evaluation in the RM process are:
- It helps identify deviations from set objectives
- It enables assessments to be made to see whether the RM process is delivering value
- It enables the organization to determine whether the cost of the RM process is justified
- It enables the organization to identify new and emerging risks and trends.
Adjustments to the RM process can only be informed by a monitoring and review process.
Monitoring and review must cover the entire process, not just parts of it.
Monitoring helps to see what is working and what is not, as well as determine what can be done.

Risk Financing

Risk financing has 2 aspects to it:
- Costs of risk control efforts
- Costs of loss financing
Risk financing options available to an organization depend on various factors such as:
- the size of the firm,
- the state of the risk transfer market, and
- the cost of risk financing options etc.
Market products like insurance are part of risk financing.
People pay premiums to finance future losses.
The degree of success at the risk control stage influences the resources needed for risk financing.
Insurance companies reward organizations with sound risk control systems by:
- quoting them lower premium rates
- offering premium discounts.

Retention or Insurance

An obvious question one may pose at this point is – When is it ideal to retain a risk, and when is it ideal to transfer it, e.g., to insurance markets?
There are no rules that are cast in stone on this.
However, conventional theory and wisdom have some vital insights.
Conventional risk management theory suggests that retention is ideal for risks that have high frequency and low severity because they are statistically more predictable.
Conversely, risks with a low frequency and high severity should be transferred because they are unpredictable.
The logic in the above is obvious – retention relies on internal resources to finance losses, and for that, one needs some reliable estimate of what the cost of those losses will be.
Low-frequency, high-impact events like earthquakes come with too much uncertainty, e.g., when will the event occur, what will be the magnitude, where will the event occur, how many people will be affected, etc.

The Story of BP

British Petroleum is the 2nd largest company in the UK on the Fortune Global 500 list, which ranks companies by annual revenue.
On the Forbes list, BP is ranked the 3rd largest company in the UK. The Forbes list considers several factors, e.g., revenue, net profit, total assets, and market value, using a weighting system for each factor.
At some point in the early 1990s, it was also the second-largest company in Europe.
BP has operations worldwide in the oil and gas sector executed through 4 companies, namely;
- (i) BT Exploration – upstream activities
- (ii) BP Oil – downstream activities
- (iii) BP Chemicals
- (iv) BP Nutrition
BP has 2 major concentrations of asset values: its production licenses and its facilities (e.g., rigs, pipelines) in the North Sea and Alaska North Slope.

BP's Insurance Buying Strategy

Despite conventional wisdom, some companies view retention and insurance differently.
Case in point is British Petroleum’s insurance buying strategy.
Following a study of their losses over a 10-year period, BP decided to depart from the conventional approach.
They buy insurance for high frequency-low severity losses and retain low frequency-high severity ones.
Their rationale is based on several factors including:
- Competition and efficiency of insurance markets
- The value offered by insurance companies at the low frequency-high severity risk level, especially given the nature of BP’s business
- BP’s claims experience over a 10-year period
- The degree of sophistication of the risks involved.
The nature of BP’s operations means that they are exposed to high-end risks that most insurance markets cannot handle adequately.
Hence, the absence of adequate capacity in the transfer market can force an organization to retain some risks.

Closing Remarks

A strong and rational case exists for managing risk.
The main ingredient in risk management decisions is information and its accuracy.
If complete and accurate information is available, decision-making is enhanced and simplified.
However, the real world is typified by missing or incomplete information, which in turn makes risk management complex.
The process of managing risk is highly integrated, involving risk identification, risk analysis, risk evaluation, risk treatment, risk financing, and monitoring and review.
Most companies are largely guided by the conventional approach when it comes to risk retention and transfer decisions.
The BP strategy is unique and cannot be generalized.
A large portion of BP’s risks remains largely undiversified due to the concentration in its asset values.
Furthermore, a large portion of BP’s risk profile comprises highly specialized risks that require unique expertise that only BP possesses.
Above two factors largely dilute the value of risk transfer mechanisms like conventional insurance.
Consequently, the company decided to go for a different approach to risk retention and transfer.