Responses to risk

1 A framework for risk management – the CIMA risk management cycle

The framework is logical and easy to understand.

1.1 Establish a risk management group and set goals

Ultimately risk management is the responsibility of the board (or, more broadly, those charged with governance). However, like many functions in organisations the board is likely to delegate responsibility to a sub-group of suitable specialists. The board should set goals which reflect the risk appetite of the organisation. For example, if the organisation is an airline, the board would set goals of Zero accidents but it might be prepared to tolerate a degree of risk of bad publicity from over-booking flights.

1.2 Identify risk areas

It is important not to be complacent about risks. Some will be obvious and well-known but others might be undiscovered until something goes wrong. We will see later in this Chapter methods that might help to discover potential risks.

1.3 Understand and assess the scale of the risk

Not all risks are equal. Some risks that are discovered might be judged as being of little consequence; others could be of major significance. Techniques will be covered later.

1.4 Develop a risk response strategy

Having identified and assessed the risks decisions have to be made about what to do about them. The TARA approach will be explained later.

1.5 Implement strategy and allocate responsibilities

Simply identifying risks and working out suitable responses will not reduce risk: proper actions have to be specified and must then be consistently carried out. For example, ensuring that the safety of machines is monitored or that customer credit limits are regularly reviewed. Individuals have to be put in charge of risk management strategies and procedures and must be held accountable for failures.

1.6 Implement and monitor controls

Controls must then be implemented. For example, setting out dates by which risks have to be addressed, ensuring that inspections are done at regular intervals or by sending staff on training courses. It is very important to document risk reduction strategies and how those strategies are realised.

1.7 Review and refine the process and repeat

Of course, the solutions implemented to deal with identified risks are unlikely to work perfectly the first time. They will often need to be improved. But it is also very important to realise that nothing stands still: risks will be evolving all the time and the organisation must keep them under constant review to ensure that all are properly addressed.

YouTube videoLoad YouTube video

2 Identifying risk areas

The trick is to use every method at your disposal to identify risks. Throw the net as widely as you can at this stage. Later, risks might be dismissed as being of little importance, but it is important that as many as possible potential risks are initially considered.

Methods include:

• Physical inspection and observation (for example, that safety equipment is still used on machinery).

• Inspect documents (for example, the accident log book).

• Internal audit. Internal auditors are employees of the company (usually) who examine and report on the organisation systems of internal control. Not only do they report on financial controls but they can also be required to examine systems such as quality control accident reporting and so on.

• Outside consultants brought in to audit procedures (for example, security consultants to advise on IT security).

• Observation of competitors’ procedures (question why they carry out operations in a particular way).

• Enquiries (for example, ask employees, customers and suppliers about problems).

• Brainstorming (wide-ranging discussions to anticipate potential problems).

• Checklists (for example, use a checklist to evaluate how a job went and consider action where there had been problems).

• Benchmarking (falling short of targets can imply that things are going wrong).

• External events (for example, be alert for economic events that could affect the organisation).

• Internal events (for example, high staff turnover can indicate problems with employments conditions).

• Leading event indicators (for example, if a customer takes longer and longer to pay each month then there would appear to be a risk of non-payment).

• Escalation triggers (for example, if you are twice late filing a tax return, then the third default could be very serious).

• Event interdependencies (for example, a major customer going into liquidation could cause excess inventory problems).

• Scenario planning and stress testing (see below)

3 Analysing strategic choice

Scenario planning and stress testing, in the two sections that follow, ask what the world might do to a strategy. Before either of them is worth running there is a prior question: is the strategy itself a sensible choice? The 2027 syllabus names “analysis of strategic choice” as a topic under P3B1, and it is the first place a strategic risk can be found — not in the environment, but in the decision.

A strategic option is tested on three headings. The risk is what each heading exposes:

Two further questions belong to this stage, and both are risk questions rather than strategy questions:

• What assumptions is the strategy standing on? Write them down as a list. An assumption that is never written down is never tested, and it is the untested assumption — “our main customer will renew”, “the regulator will not intervene”, “we can recruit forty engineers a year” — that turns a good plan into a failed one. This is what P3B1a means by analysing the relevance of the assumptions on which strategy is based.

• Is this an incremental change or a radical departure? An incremental strategy carries execution risk. A radical one carries execution risk plus the risk that the organisation has no experience of the new territory, so its own estimates are worth less. Section 5 makes the same point when it stress-tests a strategy.

4 Scenario planning and stress testing

4.1 Introduction

Scenario planning looks at all the things that could happen (and there can be many permutations of future events) and from those builds viable scenarios: a number of believable, internally consistent futures. This greatly reduces the number of ‘universes’ that need to be considered and allows the organisation to focus on the relatively few most likely scenarios.

It operates on the principle that, for some decisions, thinking in terms of multiple possible futures, or scenarios, is more effective than relying on single-point forecasts about the future.

For example, our political horizon might suggest that either Government 1 or Government 2 will be elected within the next year. Our economic predictions might suggest that interest rates will be either 3% or 5%. However, if Government 1 favours high public expenditure then this makes 5% interest rates much more likely as high interest rates are offered to allow government borrowing. If Government 2 favours austerity, then interest rates are likely to stay at 3%. Therefore, the only two viable scenarios are:

• Government 1; 5%

• Government 2; 3%

Other permutations can be ignored because they are implausible.

4.2 Steps in scenario planning

1. Define the scope, for example: What time horizon? Which part of the business? Which country (for multi-national organisations)?

2. Identify which factors will most affect the organisation.

3. What are the plausible outcomes for each factor?

4. What are the plausible, internally consistent combinations of factors?

5. What effect would each scenario have on the organisation?

6. How should the organisation respond? For example, it could decide to retreat to an Internet-only presence, it could move up-market/down-market, or it could withdraw from the market.

7. Go back and recheck assumptions and scenarios in the light of the decisions made, as some of those decisions might affect them.

4.3 Advantages and disadvantages of scenario planning

Scenario planning can have the following advantages:

• It challenges managers and other stakeholders to be more forward-looking when business planning.

• It challenges assumptions about the future, and about the drivers and forces that influence its industry sector.

• It forces managers to consider previously unimagined possibilities and tests the rationale for current strategies.

• It does not attempt to forecast the future – almost certainly a lost cause. Instead it results in several outcomes, each of which can have a planned response.

• It encourages communication and planning within the company as scenario building requires inputs from many areas.

• It can encourage the identification and evaluation of ‘weak signals’. Weak signals are small signs of changes that do not currently have much effect but which might be game-changing in the future. For example, early adopters of Facebook might have used it for purely personal use, but some might have foreseen the major effect it would have on marketing.

Scenario planning can have the following disadvantages:

• It can be very time-consuming: identification of all the relevant variables, collection of data and the distillation to a few plausible, internally consistent scenarios.

• It is important to use experts who can assess possible outcomes – and the cost of experts‘ time can be considerable.

• It is important not to eliminate all scenarios except the most likely one or the most attractive one. The point of scenario planning is to obtain a range of possibilities – both favourable and unfavourable - and to plan for those.

5 Stress testing strategy

If there is one certainty in business it is that strategic plans rarely produce outcomes that are precise matches for the original plan. A strategic plan has a time horizon of around five years and an awful lot can happen in that time. So, what happens if unfavourable events occur? Will the company survive? Does the strategic plan have enough flexibility built into it so that it can be adapted part way through? Are there enough resources (such as cash) to see the company safely through bad times? Stress-testing attempts to identify risks and scenarios that might occur to help organisations understand where vulnerabilities exist and to build in risk resilience.

A stress test is, therefore, an assessment of how a system or strategy is likely to function if severe adverse events occur. For example, would your company survive if your major customer went into liquidation? What would happen if a major product had to be withdrawn (in 2019 Boeing had to ground its whole 737 MAX fleet after two similar accidents involving nearly new aircraft and the airlines that operated them sought compensation). What would happen if a monopoly supplier of a vital component were taken over by one of your rivals?

Stress tests should be carried out on all strategies, whether an existing strategy is being followed (perhaps it has become high risk) or a new strategy is planned.

Of course, there will always be a problem envisioning all the things that can go wrong and deciding if their probabilities are significant and many organisations can disapprove of the Jeremiahs in their midst who think about calamity when the rest of the organisation is expected to embrace enthusiastically and, perhaps sycophantically, the board’s new strategy.

It is therefore important that in the rules and culture of the organisation stress-testing becomes mandatory and valued.

There are many potential approaches to stress testing, but the following list is as helpful as any:

• Look to the future. What consumer trends, technical developments and political changes might occur and which will affect the business. Going through the PESTEL headings and projecting these into their possible future effects on the business can be a good start. Don’t flinch from unpleasant possibilities or engage in wishful thinking: evaluate events’ likelihood and their effects.

• Understand what makes your business currently successful. Understand your value chain and what you are good at. What would happen if your unique capability in an important area were to disappear? For example, if you were a pharmaceutical firm, what will happen when your patent on a block-buster drug runs out? If you are a car manufacturer, what would happen if a competitor discovers a battery technology that increases range by a factor of 10? What happens if you are a firm of lawyers and artificial intelligence develops to such a degree that reliable advice can be offered on line and perhaps even disputes can be judged on-line?

• Does the strategy embody objectives? If there are no objectives (eg following the SMART pattern of specific, measurable, achievable, relevant and time-limited) then the strategy is useless as it will not be achieved.

• Is the strategy an incremental change to the current strategy (relatively safe) or a radical departure (relatively dangerous)? Sometimes a radical approach is needed to save businesses but be aware that the company is then venturing into areas where it will have little expertise or market knowledge. Assumptions and feasibility have to be examined much more critically.

• Have stakeholders bought into the strategy? If there are powerful dissenters then the strategy will probably not work.

• Does the new strategy offer the hope of adding value for customers?

• Set up a financial model and change the parameters and assumptions used to examine how sensitive success or survival is to each. We can all produce cash flow forecasts on a spreadsheet which allows our company to live within its overdraft limit. Simply change assumptions about sales, costs etc until you get the required answer. But that is no way to stress test. Be at least realistic, then be pessimistic. No reward will come without risk, but at least understand the risks arising from the strategy.

So, questions that could be asked and scenarios that could be played out could include:

• What happens if interest rates double?

• What happens if there is a serious recession?

• What would happen if our major customer failed?

• What would happen if a major product was discovered to have a serious flaw?

• What happens if a competitor makes an important technical breakthrough?

These can be built into sets of viable, if unpleasant, scenarios and the company can then respond however it sees fit.

6 Understand and assess the scale of the risk

The scale of the risk depends on:

1. The likelihood that the event will occur; and

2. The impact of the event.

Of course, these will be estimates, particularly the probability of an event occurring. However, precise figures are not needed, just an idea of whether they are ‘high’ or ‘low’. Nevertheless you will see some mathematical techniques that can be used to quantify events.

A very standard tool to assess the scale of the risk is a risk map — sometimes called a risk heat map. It is not the same thing as an assurance map, which is a different technique, dealt with in section 11:

Note that there is nothing absolute about the categorisation of these risks. For example, the chance of flight disruption has been assessed as high, but that depends on the airports used. Similarly, the loss of a mobile has been categorised as being of low impact – but this wouldn’t be correct if that mobile was the only place where important contact data is held.

The severity of the risk can be estimated by methods such as:

• Calculation of average/expected loss, largest predictable loss

• Exposure of physical assets: total loss, repair, decrease in value

• Exposure of financial assets

• Exposure of human assets (injury, death, staff leaving)

Obviously, great attention should be given to risks in the bottom right hand quadrant (high/high) whereas those risks in the top left quadrant are less important.

7 The interaction of risks

A risk map treats every risk on its own. Real risks are not independent, and the 2027 syllabus asks specifically for an analysis of the interaction of different risks. Three interactions matter.

7.1 Risks that move together

Two risks that are driven by the same thing will crystallise at the same time. A recession raises the risk of customer default, of falling volumes and of a covenant breach at once — and it does so precisely when the organisation is least able to absorb any of them. Assessing the three separately, and finding each of them tolerable, misses the point. Two risks that always crystallise together are, in effect, one large risk.

7.2 Risks that offset each other

The opposite also happens, and it is why risk is consolidated at group level rather than managed unit by unit (Chapter 3). If one subsidiary earns US dollars and another spends them, the group’s net exposure is smaller than the sum of the two — and a treasury policy that hedged each subsidiary separately would spend money removing an exposure the group does not have.

7.3 Risks that cause each other

Some risks are linked in sequence rather than in parallel. Falling sales produce an inventory-valuation problem and a cash-flow problem; an IT outage produces a service failure, then a compliance breach, then a reputational one. The risk register lists these as separate lines, which is why an event that looks small on its own line can still escalate. The identification checklist in section 2 names both of these effects — escalation triggers and event interdependencies — and they belong to the assessment stage as much as to identification.

The practical consequence for the map: alongside each risk, record what else moves with it. A risk that is amber on its own and red in company with two others has been assessed wrongly if only the first number is written down.

8 Risk response

The risk responses can be remembered by the TARA approach:

(You might occasionally see these approaches referred to as the 4Ts: Transfer, terminate, treat, tolerate.)

The four responses can be mapped onto the risk map as follows:

So, phones are lost (or stolen) from time to time and most people live with that risk (though insurance is always a possibility and might be taken out for very expensive phones).

The complete breakdown of an IT system could be dealt with by outsourcing the system so the supplier shoulders the risk.

Routine staff turnover has costs associated with it (recruitment and training) so better employment policies might be worthwhile to reduce the cost and disruption.

Flights to an airport with very bad weather or safety records might simply be abandoned because they cause more trouble than they are worth.

9 Gross and net risks

It is important to know these terms:

Gross risk = the risk before any mitigation (reduction) procedures. Gross risk is sometimes referred to as inherent risk.

Net risk = the residual risk after reduction and mitigation.

The gross risk is initially dependent on:

• The asset: what you are trying to protect. For example, property, cash, people, reputation and so on.

• The threat: what you are trying to protect against. For example, destruction of property, theft of cash, injury to people, damage to reputation.

• The vulnerability: weaknesses or gaps that can be exploited. For example, no fire alarms, cash not banked, no hand rails on stairs, poor PR.

The gross risk can be reduced to a lower net risk, or residual risk by reducing any of these variables through the application of counter-values or counter-measures.

Management must then decide whether the residual risk is within the organisation’s risk appetite.

Examples:

Asset: the inventory in warehouse; threat: fire; vulnerability: full of inflammable material

Counter values could be:

Asset: reduce the amount of inventory

Threat: impose no-smoking rules (if not already present),

Vulnerability: install smoke detectors and a fire suppression system that is suitable for the type of inventory stored.

Asset: valuable sales manager; threat: moves to a competitor; vulnerability: enticing offers from competitors.

Counter values could be:

Asset: divide sales over two managers (each person is half as valuable).

Threat: impose contracts that require 3 – 6 months’ notice to make moving more difficult

Vulnerability: offer good pay, conditions and prospects.

10 The risk register

Identified risks, their probability of occurrence, impact and responses to them should be entered into a risk register. Typical contents of a risk register are:

• Description of the risk

• Date identified

• Its estimated likelihood of occurrence before mitigation

• Its likely impact before mitigation

• Pre-mitigation rating

• The risk owner (who is responsible for dealing with the risk)

• Detailed response strategy to the risk (TARA)

• Its estimated likelihood of occurrence after mitigation

• Its likely impact after mitigation

• Post mitigation rating

• Date by when response should be implemented

• Date response implemented

• Signed off by risk owner

The board and risk management committee should take an active interest in the risk register to ensure that identified risks have been satisfactorily dealt with.

11 Assurance mapping

Risk identification and risk mapping identify the problems and their severity, but those processes are a waste of time if suitable responses are not made. The risk register is one way to record risks and to assign responsibilities for mitigating the risks where necessary. Another approach to ensure that risks are properly dealt with is to construct an assurance map. The aim of an assurance map is to identify where the safeguards against risks are to be found.

An assurance map sets out where an organisation’s assurance over each risk comes from. The roles that provide it are conventionally grouped into three:

Some organisations group the roles differently, and the grouping matters less than the question the map is asking: for this risk, who is doing something about it, and is that enough?

A table is then drawn up listing the risks, how important each one is, and what assurance each role actually provides over it. For example:

The last column is the one that makes the map usable. Without a view of how much assurance each risk NEEDS, a row of three “moderate” entries cannot be judged: moderate assurance may be ample for a medium risk and quite inadequate for a high one.

Read it row by row. Two rows are doing what they should: finance and IT have assurance from several sources, and the strongest source is in the place you would expect. Three rows are findings:

• health and safety has strong first-line and second-line assurance and nothing independent at all. If the supervisors are wrong, nobody would know;

• retention is a medium risk with only moderate assurance and no independent source. That may be an acceptable answer — it is a medium risk — and the map’s job is to make the choice visible rather than accidental;

• supplier conduct is a high risk with weak assurance from one source and nothing anywhere else. That is a gap, and it is the row the board should be asked about.

The map also finds the opposite problem: a low-importance risk with four strong sources is over-assured, and the effort spent on it is effort not spent on the row above.

12 Test your knowledge

Two quick checks before you move on: work through the flashcards to fix this chapter’s key terms and definitions, then sit the objective questions for exam-style practice. Both mark themselves and explain the answers as you go.