The types of risk facing an organisation

1 What is risk?

‘Risk is a condition in which there exists a quantifiable dispersion in the possible outcomes from any activity. It can be classified in a number of ways.’

CIMA Official Terminology, 2005

The key word in this definition is ‘quantifiable’. Both the probabilities that a particular outcome occurs and its impact must be known. If the probabilities of different outcomes occurring are not known then we are working under conditions of uncertainty, not risk.

Note that the strict definition of risk allows for good outcomes as well as bad

For example, insurance companies mostly deal with risk. For example, they maintain detailed statistics of the following:

• The chance of a 20 year-old driver having an accident;

• The chance of a house burning down

• The chance of a burglary

• The chance that someone aged 70 dies within the next 10 years

Risk is often expressed in terms of a combination of the consequences of an event (including changes in circumstances) and the associated likelihood of occurrence.

If probabilities, or the chance of an event occurring are not known (uncertainty) then organisations and individuals are working much more in the dark.

YouTube videoLoad YouTube video

2 Types of risk

Risk can be categorised using the following terms:

• Pure risk: this is where there is the chance of loss but no chance of a gain. It is also known as ‘downside risk’. Often when risk is mentioned, this is the type of risk meant, but remember that, strictly ‘risk’ is the spread of all results, good and bad. Examples of pure risk include: fire destroying a factory, an IT system being hacked, an employee being injured at work and fraudulent transactions by an employee.

• Speculative risk: this is where there can be both good and bad outcomes. It might occasionally be called ‘two-way risk’. Examples include developing a new product, entering a new market, buying a more advanced machine and developing a new web-site. Each of these could go well or badly.

• Upside risk: the possibility of making a gain.

3 Conformance and performance

Risks are inevitable when running a business or other organisation. If a business were unable to take any risks it would not buy inventory (in case it wouldn’t sell), it would not extend credit (in case of bad debts), and it would not employ anyone in case they were no good. The same applied in not-for-profit organisations such as a hospital (where surgeons would not operate in case the patient dies) or schools (where sports would be banned in case a pupil were injured).

Favourable outcomes for the organisation and its stakeholders are not available unless risks are undertaken. The key is the balance between the risk and the organisation’s performance.

IFAC’s point is that an organisation must seek to balance conformance and performance: compliance is necessary to avoid failure, but it does not produce success.

Higher risks are needed if you are to produce higher returns. Compliance with rules, regulations and controls does not of itself make an organisation successful. However, poor conformance with controls and risk management strategies can certainly lead to organisational failure.

The aim of risk management is not to eliminate all risks: it is to understand and manage risks in line with shareholders’ expectations about both risk and return.

A simple matrix can be used to illustrate the point:

Examples could be:

• Routine: extending moderate credit to a new customer. The maximum write-off of a debt would be small and the customer will provide some income.

• Avoid: entering a joint venture with a company that has a poor reputation. Returns might be small compared with the risk of the company’s goodwill being tarnished.

• Identify and develop: support of a well-known charity or sporting event to improve the company’s reputation. This could create a very large increase in competitive advantage and the risk would be low provided the third party were carefully chosen.

• Examine cautiously: opening operations in a new country. There are considerable risks that the expansion might fail, but if it is successful the rewards could be huge.

4 Categorisation of risks

There are many ways in which risks can be categorised. In many ways this isn’t important for its own sake but the categories can act as checklists when trying to identify and anticipate risks.

One categorisation is strategic, operational, reporting and compliance risks:

Strategic risks:     these arise from long term effects such as those relating to the nature and type of business, changes in competitive and legal environments, poor long-term decisions being made. For example, a supermarket which did not respond to the growing popularity of on-line shopping would have opened itself to a long-term decline in profits.

Operational risks:     short-term, day-to-day problems. For example, a machine breaking down, a key employee leaving, a fire breaking out in the warehouse or a fraud occurring.

Reporting risks:     risks arising because internal and external reporting are not reliable. For example, management accounts containing errors can lead to incorrect analysis and decisions.

Compliance risks:     the risks arising from not complying with rules and regulations. Penalties, loss of reputation and removal of operating licenses can all result.

Some major risks are set out below, just to give you an idea of the wide variety of risks that organisations might have to deal with. Each type of risk has one example given:

• Environmental: the release of dangerous chemicals into the local river.

• Economic: interest rates being increased so that consumer demand is suppressed.

• Competitor: a competitor launches a fantastic product.

• Product: you launch a poor product

• Commodity: the supply and price of raw materials change adversely.

• Political, cultural and legal: your product, for example cigarettes, becoming illegal or unpopular

• Financial (currency, interest rate, market risk, reporting): you are exporting and the buyer’s currency weakens before you are paid.

• Investment: a subsidiary is bought but it turns out that it isn’t as good as you thought it would be.

• IT: hacking and release of customer details

• Knowledge management: techniques and know-how aren’t captured and recorded so that when employees move-on they leave little behind.

• Property: Fire, flood

• Health and safety risks: injury to employees and fines by regulators.

• Trading risks: irrecoverable debts.

• Resource risks: increasing difficulty recruiting the right people

• Organisational risks: the organisation is too moribund and too slow to respond to developments in the market.

• Inadequate system risks: management information inaccurate and out-of-date.

• Fraud risks: theft of cash or inventory.

• Probity risks (unethical behaviour): an employee acts unethically and the company’s reputation is damaged.

• Reputational risks: products get a name for being unreliable so the company’s reputation is damaged.

5 Risks arising from international operations

Operating across a border does not create a new category of risk so much as it sharpens most of the categories already listed and adds a few of its own. The 2027 syllabus names these risks explicitly, so they are worth setting out separately.

5.1 Political and country risk

Political risk is the risk that a government action, or a change of government, damages the value of an investment. It runs along a spectrum:

• a change in the rules of the game — new local-ownership requirements, higher royalties or taxes, tighter import licensing, price controls;

• restrictions on money leaving the country — exchange controls, limits on remitting dividends, or a requirement to reinvest locally. This is sometimes called transfer or repatriation risk and it can strand cash that is being earned perfectly well;

• at the extreme, expropriation or nationalisation — the assets are taken, with or without compensation;

• and, separately from government action, civil unrest, terrorism or war.

Country risk is broader: it includes the political items above plus the general economic and financial condition of the host country — the risk that it cannot service its own debts, that inflation runs away, or that its banking system fails.

5.2 Currency risk

A foreign operation earns and spends in a currency other than the group’s. That produces three separate exposures:

• transaction exposure — a contracted amount in a foreign currency, such as the imported packaging paid for in US dollars, whose home-currency cost is not yet known;

• translation exposure — the foreign subsidiary’s assets and results are restated into the group’s currency at the reporting date, so the reported numbers move even though nothing has happened in the business;

• economic exposure — a lasting movement in the exchange rate changes how competitive the operation is, whatever is hedged.

5.3 Legal, tax and compliance risk

Employment law, product-safety law, environmental law, data-protection law and tax law all differ. Two points are examined more than the others. First, home-country legislation on bribery and on sanctions commonly applies to what the group’s people and agents do abroad, so a payment that is normal locally can be an offence at home. Second, transfer prices between group companies attract the attention of two tax authorities at once, and a price that suits one may be challenged by the other.

5.4 Operational, cultural and supply-chain risk

Distance and time zones weaken control: the further a unit is from head office, the later a problem is noticed. Local management may read the group’s policies through a different cultural lens — what counts as a gift, how a safety rule is enforced, what a target means. Longer supply chains hold more inventory, cross more borders, and expose the group to the labour and environmental standards of suppliers it does not own, which is where an international operation most often turns into a reputational problem at home.

5.5 Managing them

The responses are the ordinary ones, applied deliberately:

6 Reputational risk

Reputation is what stakeholders expect an organisation to do next, based on what it has done so far. Reputational risk is the risk that those expectations are disappointed and that the disappointment changes their behaviour: customers buy less, staff leave, investors demand a higher return, regulators look harder.

It is unlike most of the risks in section 4 in three ways. It is almost always a consequence of another risk crystallising rather than a risk in its own right; it is realised through other people’s reactions rather than through an event on the organisation’s own premises; and it is asymmetric — reputation is built slowly and lost quickly.

6.1 Sources of reputational risk

• Unethical behaviour. Bribery, mis-selling, misleading disclosure, tax structures that are lawful but indefensible, poor treatment of employees. This is the source the syllabus names first, and Chapter 7 deals with the ethics behind it.

• Product or service failure. A safety defect, a recall, a data error, an outage that stops customers doing something they depend on.

• The supply chain. Labour conditions, environmental damage or corruption at a supplier. The organisation does not control the supplier, but the public does not distinguish.

• Environmental and social conduct. Emissions, waste, water use, closures and redundancies, and — increasingly — the gap between what a sustainability report promises and what the organisation does.

• Data and privacy. A breach that exposes customers’ personal data damages trust directly, which is why Chapter 8 treats reputational loss as one of the named consequences of a cyber incident.

• The conduct of individuals. A director or a well-known employee behaving badly attaches to the organisation.

• Association. Joint-venture partners, sponsorships, customers and lenders all lend their reputations to each other, in both directions.

Two things make a source more dangerous than its size suggests: whether it contradicts something the organisation has publicly claimed about itself, and whether it is easy to explain in one sentence. A small failure that makes a prominent claim look false does more damage than a larger one that does not.

6.2 Impact on brand and on strategy

The financial impact runs through four channels, and only the first is usually quantified:

1. Revenue and margin. Customers leave, or stay and demand a discount. The lost contribution, not the lost revenue, is the cost.

2. Cost of capital. Investors treat the organisation as riskier and price its equity and debt accordingly, which raises the hurdle every future project has to clear.

3. Cost of operating. Recruitment becomes harder and more expensive, insurance premiums rise, regulators inspect more often, and management time is consumed by the incident.

4. Licence to operate. In the worst case a permit, a franchise or a public contract is withdrawn, or a market is closed. This is the channel that turns a reputational event into a strategic one.

The strategic consequence is that options close. An organisation whose reputation is damaged cannot easily raise equity, cannot easily acquire, is a less attractive joint-venture partner, and finds premium pricing withdrawn by its own customers. That is why the syllabus asks for the impact of reputational risk on strategy and not merely on this year’s profit.

6.3 Managing reputational risk

• Manage the underlying risks. Reputation is a consequence; the controls belong at the source — product quality, supplier standards, ethics and speak-up arrangements, information security.

• Say what you are, and be it. The gap between claim and conduct is what turns an incident into a scandal, so the marketing promise and the operating reality are a single risk.

• Monitor deliberately. Complaints, social-media sentiment, employee turnover, regulator correspondence and supplier-audit failures are leading indicators — see section 8.

• Rehearse the response. Speed, candour and a single voice reduce the damage; delay and partial denial increase it. A crisis plan naming who speaks, to whom, and within what time is a cheap control.

• Do not attempt to transfer it. Insurance can pay for the recall and the legal costs; it cannot buy back the customers, and it does nothing about the cost of capital.

7 How much risk should an organisation take on?

‘Risk appetite’ is the term given to describe the amount of risk an organisation is willing to accept in pursuit of value.

Risk appetite is determined by two factors:

• Stakeholder’s attitude to risk

• Risk capacity, which is the amount of risk that the organisation can bear.

Taking a personal example:

Some people are risk seekers and like to gamble; others are risk averse. So, if betting on a horse race, the risk seekers might be attracted to gamble on the high odds 100 to 1 horse. The risk averse person would tend not to consider that sort of gamble. They have different attitudes to risk.

However, let’s say both people had $100,000 in the bank and were being asked to bet $100. Even the risk averse person might be tempted to go for 100 to 1 odds. In this situation they have high risk capacity because losing $100 is of little consequence. But what if each person had only $100 in the bank? There’s a fair chance that neither would bet $100 because the consequences of losing are so serious: they have very low risk capacity.

So, overall their appetite for risk (ie their appetite for the gamble) depends on their own attitudes plus the risk capacity.

7.1 Appetite, tolerance and capacity

Three words are used together and mean different things. They are worth separating before the calculation below:

Appetite is a choice, capacity is a constraint, and appetite can never sensibly exceed capacity. Where the two conflict, capacity wins — which is what the following example is about.

8 Risk analytics

Risk analytics means using data, deliberately and repeatedly, to say something about risk that judgement alone would not say: which risks are moving, how big they are, and how they are related. It is the difference between a risk register that is rewritten once a year from opinion and one that is driven by measurements.

8.1 Key risk indicators

The building block is the key risk indicator (KRI): a measure, taken regularly, that moves before a risk crystallises. A KRI is not a KPI. A key performance indicator reports what has already happened to an objective; a key risk indicator warns that something is about to happen to it.

A usable KRI has four properties: it is defined precisely enough that two people would compute it the same way; it has a threshold set against the board’s appetite (an amber level and a red level); it has an owner; and it has a stated action when the threshold is crossed. A KRI with no threshold is just a statistic.

8.2 The techniques

• Risk maps and heat maps. Likelihood against impact, refreshed from data rather than from memory — Chapter 2, section 6.

• Quantification. Expected values, sensitivity analysis, value at risk and simulation — Chapter 4. These turn a risk into a number that can be compared with capacity.

• Correlation and portfolio analysis. Testing whether risks move together. Two risks that always crystallise at the same time are, in effect, one large risk.

• Scenario analysis and stress testing. Deliberately severe combinations — Chapter 2, sections 4 and 5.

• Predictive models and machine learning. Credit scoring, fraud detection, predictive maintenance, churn models. These find patterns in large data sets that no analyst would find by inspection.

• Text and event analytics. Complaints, incident logs, audit findings and social-media data mined for the risks nobody has registered yet.

8.3 What risk analytics cannot do

• It cannot make a bad measurement good. If the underlying data is incomplete or inconsistently defined, a more sophisticated model produces a more confident wrong answer.

• It reports the past. Every model is fitted to history, and the risks that matter most are often the ones with no history — which is why scenario planning sits beside it rather than under it.

• Correlation is not cause, so a relationship that holds in the data may not hold when the organisation acts on it.

• Models themselves are a risk. A model that is not documented, not owned, not independently reviewed and not re-validated as conditions change is an unmonitored control — and where the model uses personal data, its use is a compliance and reputational risk in its own right.

• It does not set appetite. Analytics says how big a risk is; the board still has to say how much of it is acceptable.

9 Potential advantages of risk management

• More predictable cash flows

• Well-run systems (eg greater efficiency because routine maintenance is used to prevent the risk of machine breakdown).

• Limitation of the impact of disaster (eg, stand-by arrangements are in place to take over IT)

• Greater confidence amongst investors, employees, customers, suppliers and partners.

• Better matching to risk appetite of shareholders.

Remember organisations should obtain an acceptable balance between risk and return.

10 Test your knowledge

Two quick checks before you move on: work through the flashcards to fix this chapter’s key terms and definitions, then sit the objective questions for exam-style practice. Both mark themselves and explain the answers as you go.