Risk Management

CIMA-P2 · Chapter 17

Risk Management

1 Why incur risk?

Chapters 15 and 16 measured risk. This chapter is about what an entity does with the measurement: how it identifies the risks it runs, decides how much of them it is willing to carry, responds to the rest and reports on what is left.

The starting point is that risk is not something to be eliminated. An entity that took no risk would launch no products, enter no markets and buy no equipment.

Accepting and managing risk effectively can enhance short- and long-term profitability.
Controlled risk taking can be a source of competitive advantage — competitors who will not take the risk cannot take the reward either.
The greater the risk, the greater the expected reward: returns tend to be higher on riskier projects, which is why chapter 15 discounts a riskier project at a higher rate.
The rewards are not always financial. They may be intangible — better information, faster learning, increased innovation.

What matters is that the risks taken are known, deliberate and within the entity's capacity to absorb them. That is what risk management means.

2 Risk management responsibilities

Risk can adversely affect the achievement of the entity's objectives, so managing it is a management responsibility, not a specialist one.
A risk is managed by reducing the likelihood of the event, its impact if it happens, or both.
An effective risk management system is a fundamental requirement of best-practice corporate governance, and boards are expected to be able to describe theirs.

Two named frameworks set out how to do it: the COSO Enterprise Risk Management framework, and CIMA's own risk management cycle. The rest of this section follows the CIMA cycle, from Risk Management: A Guide to Good Practice (CIMA).

3 The risk management process

Managing risk means identifying and assessing risks, setting a risk policy, determining risk responses, and reporting on both the risks and the responses — and then doing it again, because the risks change.

This lecture covers sections 1 to 5 of this chapter — the process, the cycle, the categories of risk, the risk map and TARA — and then works Example 1. All four TARA quadrants are stated correctly. Notice one. It stops after Example 1. Nothing on it reaches section 6's stress testing or section 3.6's link to the information systems that chapter 18 covers. Notice two. It never uses the gross / net / residual vocabulary that section 5 uses for a risk before and after its response, so the tape's “risk” and the chapter's “gross risk” are the same idea under two names. The chapter's second recording, on the CIMA Code of ethics, is at section 7.

YouTube video

3.1 Identify the risk areas

Analyse and evaluate risks through a process of identification, description and estimation.
The approach must be methodical, and all risk types must be considered. It needs a thorough knowledge of the entity, including current information on its competitors, its industry, its products and its organisational structure.
Identification techniques include risk workshops, benchmarking, what-if analysis and consultation with stakeholders.
Risks identified should be displayed in a structured format — normally a table.
A risk register recording the detail of every risk, its owner and its response is recommended.

3.2 Risk management policy and risk appetite

Risk appetite is the amount of risk the entity is willing to accept in pursuit of its objectives. It is influenced by the type of organisation, its size, its industry, its culture and its resilience — its ability to withstand an adverse event without failing.

The appetite is what turns risk assessment into decisions. The same risk map produces different responses in a start-up and in a pension fund, and it should.

3.3 Risk responses

Selecting and implementing measures to manage the risk.
The responses generally take the form of the TARA framework — transfer, avoid, reduce, accept (section 5.2).
They should include contingency plans as well as avoidance plans.
Recommendations for implementation, with an owner and a date, are part of the response.
The process is continuous: evaluate the responses, monitor them, re-analyse, and respond again.

3.4 Risk reporting

Reporting is both internal and external, and should meet the requirements of the applicable corporate governance code.
Reporting compares gross risk — the risk before any response is applied — with net risk, the risk that remains after it. What is left is the residual risk, and it is reported precisely because it has not been managed away.

Gross, net and residual

Gross risk is the exposure before the response; net risk is the exposure after it; residual risk is the net risk the entity has decided to live with. A report that shows only gross risk overstates the exposure; one that shows only net risk hides how much work the controls are doing.

3.5 CIMA’s risk management cycle

The cycle is not a project with an end. Stage 7 feeds stage 1: the risk environment changes, so the register, the appetite and the responses are revisited, and the assessment is made again.

3.6 Information systems in the risk process

Every stage of the cycle runs on data. Risks are identified from operational and external data; they are assessed from historic frequencies and loss values; the responses are monitored through exception reporting and continuous monitoring; and the reports that go to the board are drawn from the same systems that produce the performance reports of chapter 5.

Chapter 18 deals with this in detail — the sources and integrity of the data, the business intelligence tools that process it, and the risks the data itself creates.

4 Types of risk

There is no single system of risk categorisation, and the risks an entity faces depend on the entity and on its circumstances. What follows is a working vocabulary, not a closed list; many risks fall into more than one category.

4.1 Upside and downside risk

Downside risk	Upside risk
The possibility that the outcome is worse than expected — the loss, the failure, the overrun. This is what risk usually means in conversation.	The possibility that the outcome is better than expected. It is a real part of the risk, and an entity that manages only the downside systematically gives away the upside as well.
Managed by reducing likelihood or impact, or by transferring or avoiding the risk.	Managed by being positioned to exploit it — spare capacity, an option to expand, a supply agreement that can be scaled up.

4.2 Risk categories

Category	What it covers
Strategic	Failure of the business strategy itself — a failed product launch, an acquisition that does not deliver.
Operational	Business failure or poor operational processes: breakdowns, delays, quality failures.
Product	The risk that the product range fails to sell, through loss of interest or a change in taste.
Market	Risks associated with the sector or industry in which the entity operates.
Credit	The entity's own credit rating, and therefore its ability to raise finance; and the risk that its customers do not pay.
Liquidity	Being unable to meet debts as they fall due because of insufficient cash.
Technology	Technological change, or technological failure, that affects the entity or its products.
Political, legal and regulatory	The need to comply with law and regulation, and the risk that either changes.
Environmental	Risks arising from environmental issues, including physical climate risk and the cost of transition.
Corporate reputation	Damage to the entity's image from poor performance or adverse publicity.
Product reputation	A change in the perception of a particular product's image.
Commodity price	The effect of a price movement in a commodity the entity buys or sells, such as oil.
Contractual inadequacy	Contract terms that do not cover all the outcomes that can occur.
Fraud	The impact of fraudulent activity on the business.
Employee	Employee error, malicious damage and employee malfeasance.

The value of a list like this is as a checklist during identification. Working down it forces the obvious risks — employee error, a supplier failure — to be named and assessed rather than assumed away.

5 Risk assessment: risk mapping and TARA

5.1 The risk map

Every risk identified is assessed on two dimensions: the likelihood that it occurs, and the impact if it does.
Each is classified, at its simplest, as high or low, which produces four combinations.
Plotting the risks on the resulting matrix — the risk map — turns a long register into a prioritised one, and points to the response.

	Impact HIGH	Impact LOW
Probability HIGH	AVOID	REDUCE
Probability LOW	TRANSFER	ACCEPT

High probability, high impact — avoid. These need urgent attention. Where the exposure cannot be brought down to something the entity can carry, the activity is not undertaken.
High probability, low impact — reduce. These will happen, so the work goes into limiting what they cost: controls, redundancy, procedures.
Low probability, high impact — transfer. These are the classic insurable risks: unlikely, but unaffordable if they occur. Insurance, a joint venture, a hedge or a contractual indemnity moves part of the exposure to someone better able to carry it. A contingency plan is the minimum.
Low probability, low impact — accept. Active management would cost more than the risk. Accepting is a decision, not neglect: the risk is still recorded, and it is monitored in case the likelihood or the impact changes.

5.2 TARA

Response	What it means	Typical form
Transfer	Share the risk with, or pass it to, someone else.	Insurance, a joint venture, franchising, a forward contract, a contractual indemnity.
Avoid	Do not undertake the activity that carries the risk.	Withdrawing from a market; declining a project; not launching the product.
Reduce	Lower the likelihood, the impact, or both.	Controls, training, dual sourcing, maintenance programmes, hedging part of an exposure.
Accept	Carry the risk, having decided that the cost of managing it exceeds the benefit.	Retention, self-insurance, a contingency budget.

TARA is a response framework, not a ranking. Which response is appropriate comes from the risk map, and from the entity's risk appetite.

Birdy Co need to evaluate the risks related to a new business venture in a foreign country. They wish to use risk mapping and the TARA framework to formulate an appropriate response to these risks.

(a) Suggest some risks that the new foreign business venture may create.

(b) Assess these risks in terms of probability and impact, and then formulate a response using the TARA framework.

(a) Risks the venture may create

The product is not a success on the foreign market.
The exchange rate moves unfavourably when a large payment or receipt falls due in the foreign currency.
The foreign government seizes the assets and takes control of the business.
The foreign rate of taxation increases, raising the tax expense.
Staff do not learn the language sufficiently to be able to operate the business abroad.
The working culture in the foreign country differs from the home country's, and the entity's management practices do not transfer.

(b) Assessment and response

The assessment depends on the country and the product, so what follows is the reasoning rather than a single right answer. What the examiner is looking for is that each risk is placed on the map and that the response follows from where it lands.

Risk	Assessment	Response
Product not accepted in the foreign market	High impact. High probability if the product is new and untested; lower if it already sells well in comparable markets.	Avoid if the probability is high — do not enter. If the probability is lower, transfer part of the exposure through a joint venture with a local company, or by franchising and taking a fee.
Assets seized by the foreign government	Potentially very high impact; the probability depends on the country's history of nationalisation and its political stability.	Avoid if both are high. If the impact is high but the probability low, transfer — a joint venture with a local partner, or political risk insurance.
Adverse exchange rate movement	High probability — rates always move. Impact usually moderate and quantifiable.	Reduce by hedging: a forward contract fixes today the rate that will apply to a future receipt, removing most of the exposure.
Foreign tax rate increases	Low probability in a stable jurisdiction; impact usually modest.	Accept, and monitor. Managing it actively would cost more than it saves.
Language and working-culture differences	Probability and impact both depend heavily on the country.	Reduce — language training for staff who transfer, and local managers recruited into the operation rather than expatriates only.

Note how the same risk attracts a different response as the assessment changes. That is the point of mapping the risks before choosing between transfer, avoid, reduce and accept.

6 Stress testing

A stress test asks how well the entity would cope under adverse conditions — a cyberattack, an economic downturn, the loss of its largest customer. Chapter 15 applied the idea to a single project; here it is applied to the business as a whole.

Robert Simons, in Stress Test Your Strategy: The 7 Questions to Ask (Harvard Business Review, 2010), sets out questions a board can use to test whether its strategy is robust. Four of them bear directly on the management accountant's work:

Prioritisation. Who is your primary customer? Once that is settled, the majority of the entity's resources should be directed to supporting their needs — and the management accounts should show whether they are.
Measurement. What critical performance variables are you tracking? The metrics that matter are the few that actually drive performance, not the many that are easy to collect.
Productivity. Are you generating creative tension? Disagreement that challenges the current way of doing things should be encouraged, because it is what produces new ideas; an organisation in which nobody argues is not being tested.
Flexibility. What strategic uncertainties keep you awake at night? Rapid change in technology, regulation and customer behaviour means a business optimised for today's conditions may not survive tomorrow's. The question tests whether the entity is monitoring the uncertainties that could invalidate its strategy, and whether it could adapt in time.

The remaining questions concern how core values rank the claims of shareholders, employees and customers; what strategic boundaries have been set — what the entity will not do; and how committed employees are to helping each other.

A stress test is not a forecast. Its output is a judgement about survivability and about what should be arranged now — a contingency plan, a facility, a break clause — so that the entity is not making the arrangement in the middle of the event.

7 Ethics and risk

Ethical failure is a business risk. It carries reputational, regulatory and legal consequences, and it belongs on the risk register with the rest of them. It also arises from exactly the work this paper is about: preparing performance reports, setting transfer prices, appraising investments and reporting results.

This recording covers section 7 — CIMA's five fundamental principles, the threats to them and the safeguards at the level of the profession, the entity and the individual — as they apply to any accountant.

Notice one. P2 examines ethics through its own work, above all transfer pricing: chapter 6, section 11 applies the same principles to setting a transfer price. The tables in sections 7.2 and 7.3 set out the threats and safeguards that arise in this paper.

Notice two. It also touches on confidential information and whistle-blowing, which belong to the wider Code; the scope note at the end of this section says where P2 draws the line. Where it points you to “the next two pages”, read the tables in sections 7.2 and 7.3.

YouTube video

7.1 The five fundamental principles

CIMA's code of ethics consists of five fundamental principles, which apply to everything a management accountant does:

Integrity — being straightforward and honest.
Objectivity — not allowing bias, conflict of interest or undue influence to override professional judgement.
Professional competence and due care — maintaining the knowledge and skill the work requires, and applying it carefully.
Confidentiality — not disclosing information acquired at work without proper authority or a legal duty to do so.
Professional behaviour — complying with relevant laws and regulations and avoiding conduct that discredits the profession.

They can be remembered by the mnemonic OPPIC: objectivity, professional competence and due care, professional behaviour, integrity, confidentiality.

7.2 Threats that arise from management accounting work

Threat	How it arises in this paper's territory	Safeguards
Preparation and reporting of information	Pressure to present divisional results, a project appraisal or a set of KPIs more favourably than the facts support — inflating a forecast, choosing the ROI that flatters a division, omitting an unwelcome sensitivity.	Consultation with superiors, with those charged with governance, or with the relevant professional body; documenting the basis of the figures and the assumptions used.
Financial self-interest	A bonus that depends on the results the accountant prepares, or on the approval of a project the accountant is appraising. Short-termist behaviour in a division measured on ROI is the same threat in a different form.	Remuneration determined by others; disclosure of the interest to those charged with governance; independent review of the numbers concerned.
Inducements	Gifts, hospitality or preferential treatment offered by a supplier being appraised, or a division seeking a favourable transfer price.	Do not accept anything beyond the trivial; inform senior management and, where appropriate, take legal advice.
Insufficient expertise	Being asked to appraise or report on something outside the accountant's competence, or under time pressure that makes competent work impossible.	Obtain additional training or advice; negotiate more time; obtain assistance from someone with the relevant expertise.

7.3 Safeguards

Level	Safeguards
The profession	Education, training and CPD requirements; corporate governance regulations and professional standards; monitoring of the quality of professional work, and disciplinary proceedings where it falls short.
The entity	Internal control systems; review procedures; disciplinary procedures; the entity's own code of ethics; separate review and reporting in key areas.
The individual	Compliance with professional standards; keeping records of contentious issues; mentoring; contacting CIMA for advice on an ethical dilemma.

Scope. The 2027 P2 syllabus names ethics in one place only — P2C3b, the use and ethics of transfer pricing — and that is dealt with in chapter 6. This section is confined to the ethical dimension of the risk and reporting work P2 does examine. The full CIMA Code, with its complete table of threats and safeguards, is the territory of the professional-ethics material rather than of P2D.

8 Test your knowledge

Two quick checks before you move on: work through the flashcards to fix this chapter’s key terms and definitions, then sit the objective questions for exam-style practice. Both mark themselves and explain the answers as you go.

Answer the questions one at a time. Your progress is saved so you can leave and come back.

Open chapter practice