Risk assessment is an ongoing process because companies operate in a risk dynamic environment. Assessing risk is sometimes called risk profiling or risk mapping. To assess each risk, it is paramount to consider the likelihood that losses will occur probable amount of loss as a result of risk factor will determine the priority given to each risk in risk assessment.
A risk map helps to identify risks where immediate control measures are required and where the need for control measures should be reviewed periodically.
High impact, low probability risk could be risks of damage to assets from fire, risk of terrorist attack, theft and criminal damage which can be insured, For high impact, high probability risks, immediate control action are needed to salvage the situation. Low impact, low probability risks must be reviewed periodically to remove residual risks while low impact, high probability risks should be given adequate consideration to limt the frequency of occurrence.
Risks Prioritisation
For the fact that risk assessment is an ongoing process in organisations, it is needful for companies to establish a process for deciding which risks are tolerable and which might need urgent attention. Setting priority on risk management might help companies prevent excessive spending on controlling risks.
A risk dashboard can be used to decide which risk need immediate attention for control measures, It might be used as a method of establishing appetite for particular risks and for monitoring residual risks.
The dashboard is similar to the traffic light signals. Each risk is represented by ‘coloured light,’ including green, amber and red. A red light on the dashboard indicates further risk measures are needed meaning it is mandatory to attend to such risk. A green light indicates that the risk is under control meaning risk should be given low priority of not essential while amber light indicates risk under medium priority and needs to be kept under review.
An advanced risk dashboard can be used to show:
- the total amount of risk
- the residual risk and
- the risk appetite
Risk appetite can be classified under the green section when it is low. If risk appetite is higher, it can enter green-amber or red-amber sections. Companies try to avoid very high risk, so risk appetite may not enter the red section.
Residual risk can fall within the green and green-amber or red and red-amber sections of the dashboard.
When risk appetite and residual risk are related i.e. falling within the same section of the dashboard, it means the current risk management/control measures are appropriate for the risk. When risk appetite and residual risk are correlated i.e. they vary together and risk appetite is in lower-risk section of the dashboard than residual risk then further control action is needed to reduce the residual risk to the acceptable level.
Risk Acceptability
The information flowing from the above suggest that not all risks should be avoided. There is an acceptable level of risk in a given circumstance to achieve a given objective. It should be remembered that higher return is often associated with higher risk.
The ALARP (as low as reasonably practicable) principle is predicated on safety precautions Although, it is not possible to eliminate all risk but the remaining exposure to risk should be as low as reasonably possible. ALARP should not be used as a simple quantitative measure of cost against benefit because it is not reasonable when the cost of controlling a risk outweigh its benefit.
Risk Control in Organisation
There is no clear-cut approach to the management of risk in organisations. Each business entity develops its own risk management structure according to the uniqueness of its business environment, Some of the approaches that might be used include:
- Diversification of risks
- Risk transfer
- Risk sharing
- Hedging risks
Diversification of Risks
The purpose of risk diversification or ‘spreading risk’ in business is to invest in a range of different business activities called strategic business units (SBUs). According to BCG portfolio analysis, the good performers will balance the shortcomings of the bad performers so that the entire business as a whole can provide, on the average, the expected returns. Examples are investors in shares who spread their investment risks by investing in shares of different companies.
Risk Transfer
Risk transfer, just as the name suggests, is passing some or all of a risk on to someone else in order to reduce or remove the burden of the risk. Example of risk transfer is insurance company who takes on the risk of a company by paying for losses covered by the insurance policy.
Risk Sharing
Risk sharing involves collaborating with another person to share the risks jointly. Common examples are partnerships and joint ventures.
Hedging Risks
Hedging is commonly associated with the management of financial risks such as currency risk. Hedging risk in the financial market means making a transaction that offsets an exposure to another risk. For example, if a company is exposed to the risk of US dollar falling in value against the naira, a hedge can be created whereby the loss on the original risk exposure will be offset by the gain on the hedge of the hedge position.
The degree of risk is an important measure of acceptability of strategy. A strategy may be potentially profitable but may be too risky in a number of ways. For instance:
A strategy that will reduce the liquid level of the company beyond comfort zone may be too risky to contemplate and therefore may be discarded.
If the capital structure of the company alteration is deemed unfit by a particular strategy, then the strategy may be rejected.
Managers should use risk analysis to determine the amount of various assumptions underlining the strategy and evaluating the effect the strategy wilI have on the organisation. Strategy evaluation may lead to picking a strategy within medium return rates coupled with low risk involvement.
Who Should Manage Risk in Organisation?
Many opinions follow who should be responsible for the management of risk in organisations. There is no specific accepted structure to the management of risk. Different entities develop their risk management structure according to their needs and perception. Basically, it is the role of the board of directors to identify, assess and manage risk in companies. Following are approaches that might be used.
The Role of the Risk Manager
A risk manager provides information, assistance and advice as to how to improve risk awareness and encourage the adoption of sound risk management practice. Risk manager might be appointed to carry out specific roles such as:
- Insurance
- Finanacial risk
- Human resources
- Health and safety
- Information systems and Information technology
- Compliance with specific laws or industry regulations.
Risk manager according to Institute of Chatered Accountants of Nigeria (lCAN) might tricle down to the followings:
- Helping with identification of risks
- Establishing ‘tools to help with the identification of risks
- Establishing modeling methods for the assessment and measurement of risks
- Collecting risk incident reports (e.g. on heath and safety incident reports)
- Assisting heads of department and other line managers in the review of reports by the internal auditors
- Preparing regular risk management reports for senior managers or risk committees
- Monitoring ‘best practice’ in risk management and encouraging the adoption of best practice within the entity.
The Role of Risk Committee
A risk committee might be constituted of the board of directors responsible for fulfill the corporate governance obligations of the board to review the effectiveness of the system of risk management. Other risk committee might be inter-departmental committee including internal auditors and risk managers, responsible for identifying and monitoring specific aspects of risk, such as;
- Strategic/business risks
- Operational risk
- Financial risk
- Compliance risk.
- Environmental risk.
Risk committees management authority is to the extent of identifying, monitoring and reporting risks on the effectiveness of risks management to the board or top management. The board should receive regular reports and review them periodically.
The Role of Risk Auditing
Risks should be monitored through auditing for the purpose of ensuring that:
- Processes and procedures for identifying risk are effective
- Internal controls and risk management processes are available for managing risks
- The level of risk faced by the entity is consistent with the polices on risk that are set by the board of directors
- Failures in the control of risk are identified and investigated
- Weaknesses in risk management processes are identified and corrected.
The four stages in a risk audit are:
Risk ldentification: The first stage in risk audit is to identify what the risks are in a particular situation, strategy. procedure or system. The changing environmental situation affect the nature of risk an entity is faced with at a particular time. The volatile business environment demands that the current risks are identified.
Risk Assessment: The next stage after identifying risk is to assess them. The probability of adverse occurrence and the impact of adverse occurrence should be measured. A risk can be assessed by its expected loss. Meaning: the expected loss = probability impact.
Risk Review: The auditor looks at the control measures that the management put in place to manage risk in the event of adverse occurrence. Risk auditor ensures that the controls for each material identified are properly audited.
Risk Report: The risk audit is reported to the board of directors or to management depending on who commissioned the audit.
The Role of the Board of Directors in Risk Management
Providing answer to who should be responsible for risk management in organisations should remain the jurisdiction of the board.
The management normally performs the role of identifying, assessing, monitoring and controlling key risks and report to the board. t is the responsibility of the board to act on the report. They perform this overall responsibility by:
- setting the company’s policy for risk and giving clear guidance about the company risk appetite.
- reviewing periodically the effectiveness of risk management systems.
- reporting to the shareholders on its review of internal control/risk management systems.
Creating Risk Awareness in Organisations
It is important that all the stakeholders within the organisation are aware of risk and the need for appropriate risk control. Managers make decisions that expose the organisation to risk. They should be mindful of the consequences of their action in that the risks taken are justified by the expected benefits.
Risk awareness creation should be ’embedded’ in the culture of every organisation. It is clear that the risk management team cannot put a culture in place that establishes risk awareness and transparency. The awareness should be set by the board of directors and top management into the company’s systems and procedures.
Embedding risk is a situation where risk becomes an integral part of the management practice to the extent that all stakeholders within the system become conscious of the need to manage risk. Senior managers are responsible for the management of business risks strategic risks. Employees also need to be conscious of the need to contain operational risks in their day-to-day activities. Business risk volatile environment that is subject to continual and unpredidable change.
The TARA Framework for Risk Management
TARA describes risk management policies which can be used to idenify alternative strategies. TARA is an acronym for:
- Transfering risk
- Avoiding risk
- Reducing risk
- Accepting risk
Risk transfer is a common methods of shifting the risk to another party like insurance company.
Risk avoidance means ‘do nothing’ or withdrawing from activities that creates risk. This is saying if you must take business risk, the benefits must justify the risk.
Risk reduction can come in various ways. The risk of fraud for instance can be reduced by a sound system of internal control.
Accepting risk means you are ready to do business. If the end justify the means of risk, then exposure to risk may be acceptable.
Enterprise Risk Management (ERM)
Enterprise risk management is a strong framework for risk management facilitated by the board in order to ensure that the approach to risk management is consistent throughout the company. The framework for risk management might be applied in three stages:
Stage 1: Establish the Approach
The senior management should establish the approach to risk management create a risk management vision with a clear risk strategy. A common structure culture polices and procedures for risk management should be consistent throughout the company
Stage 2: Commit Resources
The resources to manage risk must be there. Employees must be trained on basic risk management procedures and internal control. The infrastructure for risk management should be in place to ensure the company has capabilities for managing risk. the company.
Stage 3 Implement the Systems
Stage 3 and the last stage talks about the board should implement the system for risk assessment, the application of controls and other management systems for risk. The monitoring system should evaluate identified risks and ensure there are effective controls to mitigate the risk.
Risk Management Framework
International organisation for standardisation proposes a framework for the implementation of risk management system. They identified three main elements that guide the operation of the framework as:
Risk Architecture: Is the structure that spelt out the roles and responsibilities for risk management within an organisation. This includes the risk reporting structure. It consist of the different roles of the board, the risk managers, the audit committee, the CEO, SBU managers, individual employees and the internal auditors.
Risk Strategy: The long term risk management plan of the organisation should be specified, including the risk appetite of the board. Risk strategy should have a risk management action plan and resources to support the plan.
Risk Protocols: Consists of the rules and procedures for implementing risk management. The methods that should be applied to risk management should be there. Such protocols according to ICAN should be applied for risk assessment, risk responses and incident reporting; a business continuity plan; and arrangement for auditing the effectiveness and effectiveness of controls.
ISO 31000 identified ‘7Rs and 4Ts’ of risk management as a framework for the implementation of a risk management system:
- Recognition/identification of risks
- Ranking or evaluation of risk
- Responding to significant risk
Risk treatment
- Tolerance – accept the exposure to risk
- Treat-take measures to control or eliminate the risk
- Termminate – the activity that gives rise to the risk
- Transfer- the risk to someone
- Resourcing controls
- Reporting and monitoring risk performance
- Reaction planning
- Reviewing the risk management framework
Written by
Eyemeka Uwadia