P3 - Risk Management CH1 – Risk

Chapter 1
Risk

Chapter learning objectives:

Lead Component Topics to be covered

A.1 Analyse sources Analyse: • Upside and downside risks

and types of risk (a) Sources of risks • Risks arising from internal and external
(b) Types of risks sources
• Risks arising from international operations
• Strategic and operational risks

A.3 Discuss ways of Discuss: • Role of board and others in the

managing risks (a) Roles and organisation for identifying and managing
responsibilities risks
(b) Risk tolerance, • Risk mitigation including TARA – transfer,
appetite and capacity avoid, reduce, accept
(c) Risk management • Assurance mapping
frameworks • Risk register
(d) Risk analytics • Risk reports and responses
• Ethical dilemmas associated with risk
management

Page 1
 P3 - Risk Management CH1 – Risk

1. What is risk?
Risk is the chance the future events or results may not be as expected for a business.

Risk is a condition in which there exists a quantifiable dispersion in the possible outcomes
from any activity. It can be classified in a number of ways. - CIMA
• The key word in this definition is quantifiable. Both the probabilities that a particular
outcome occurs and its impact must be known.
• If the probabilities of different outcomes occurring are not known then we are
working under conditions of uncertainty, not risk.

TYPES OF RISK:
Upside Risk Downside Risk Speculative Risk

• When there is the chance • When there is the chance • Is a two way risk.
that results may be better that the results may not be
• Actual outcomes may
than expected. better than expected, it is the
either be worse or better
down-side risk.
than expected.
• Down-side risk is also known
as Pure risk
• Such risk involves the
probability of loss with no
possibility of gain.

Note:
In business decisions, there is always an element of “speculative risk”; since management
is aware of that the outcomes of business decisions could be better or worse than forecast.

RISK AND UNCERTAINTY

Risk Uncertainty

Risk describes a situation in which there is a Uncertainty refers to the condition where one
chance of loss or danger. cannot be sure of future outcomes.

We usually use the terms risk and uncertainty interchangeably, but they differ in several
respects.

Page 2
 P3 - Risk Management CH1 – Risk

Comparison Chart for Risk and Uncertainty

Basis for Comparison Risk Uncertainty

The probability of winning or

Implies a situation where
Meaning losing something of worth is
future events are unknown
known as risk
Ascertainment Measurable Not measurable
Chances of outcomes are
Outcomes The outcome is unknown
known
Control Controllable Uncontrollable
Minimisation Yes No
Can be assigned to a set of
Probabilities Cannot be assigned
circumstances

Note: Risk can be measured and quantified using different models, whereas it is not
possible to measure uncertainty in quantitative terms because future events are
unpredictable.
No Risk, No Gain

A Good Tip
If an organisation wants to survive in the long run, it has to take calculated risks where the
probability of loss is comparatively low and the probability of gains is higher.
However, uncertainty is inherent in every business, and no one can accurately predict what
will happen in the future.

WHY INCUR RISK?

• To generate high returns.
• To make the business dynamic.
• To be the trendsetter or market leader.
• To gain competitive advantage over other organisations.
• To gain financial and non-financial benefits.

Page 3
 P3 - Risk Management CH1 – Risk

How the business should deal with risk:

Activity level

Low High

Low 2. Routine 4. Avoid

Ability to gain
competitive advantage High 1. Identify and develop 3. Examine carefully

2. CIMA’s risk management cycle

Page 4
 P3 - Risk Management CH1 – Risk

3. Types and sources of risk for business organisations

IDENTIFYING AND CATEGORISING RISK

Organisations place risks into several categories to help identify and assess them

Political, legal and regulatory risk

Political risk:

• Risk due to political instability.

• External to the business.

Legal / Litigation risk - the risk that litigation will be brought against the business.
Regulatory risk – risk of changes in regulations that may adversely affect the business.
Compliance risk – risk of non-compliance with the law resulting in fine and penalties.

Page 5
 P3 - Risk Management CH1 – Risk

Business Risk

Strategic risk:

• Arises from the possible consequences of the strategic decisions made by the
organisation.

• Organisations adopting the strategy of organic growth have low strategic risk compared
to those with growth by acquisition, which may promise higher returns.

• Should be identified and assessed at senior management level and at corporate level.
Product risk:

• The risk that customers may not buy the new products provided by the organisation.

• Sales demand may decline unexpectedly.

• A new product launched to the market may fail to achieve the expected volume of sales.

• Product risk should be identified and assessed at management level or departmental

level.
Commodity Price Risk:

• Businesses may be exposed to the risk of rise of an unexpected rise or fall in the price
of a key commodity.

• They may be exposed to the risk of an increase in the price of a key material used in
their products.

• Example: airlines are usually exposed to the risk of an increase in the price of fuel.
Product reputation risk:

• The risk that the reputation of the product may be adversely affected by an unexpected
event.

• Such risk may arise from an adverse public attitude to the product or from adverse
publicity.

Page 6
 P3 - Risk Management CH1 – Risk

• There could also be risk from changes in customer perception about the quality of
product.
Operational risk:

• Refers to potential losses that may arise in the business operations.

• It is also referred to the risk of losses resulting from inadequate or failed internal
processes, people and systems or external events.

• Organisations have internal controls systems to manage the operational risks.

Contractual inadequacy risk:
When a business negotiates contracts without adequate business consideration of what may
happen if the things don’t go according to the plan.
Fraud and employee malfeasance:
Will be explained later.

Economic risk
• This is the risk that changes in the economy might affect the business.

• Such changes include inflation, unemployment rates, international trade relations, or

fiscal policy decisions by the government.

• It is also external to the business.

Financial risk
• This is the major risk affecting the business.

• It is the risk that a change in the financial position such as the exchange rate, interest
rate or credit rating of the customer may affect the business.

Page 7
 P3 - Risk Management CH1 – Risk

Technology risk
This is the risk that technological change will occur that either:

• Presents new opportunities, or

• Will render existing processes obsolete or make them inefficient.

Cyber risk:
It is the risk of financial loss, disruption, or damage to an organisation caused by issues with
the information technology they use.

Environmental risk:
• This is risk that arises from the changes in the environment such as climate change or
disasters.

• Some businesses perceive this as low, but for others, like insurance companies, it is
significant, as they are likely to receive more claims in the event of a disaster or natural
catastrophe.

• An organisation has no direct control over some such risks, e.g. global warming.

• There may be some for which the organisation may be responsible, such as pollution,
chemical wastage, etc.

Fraud risk
• This is a type of operational business risk.

• It is the vulnerability of an organisation to fraud.

• Some businesses have more vulnerability to fraud and need to have stronger controls
to detect and prevent fraud.
Magnitude of the fraud risk:
The magnitude of the fraud risk for any organisation depends on:

• The probability of the fraud occurring.

• The size of the losses if fraud occurs.

Fraud management:

• Fraud prevention by ensuring that the opportunities to commit fraud are minimised.

• Fraud detection and deterrence:

• Designing detection measures to identify fraud after it has occurred.

• The management of fraud risk should be an element of an organisation’s internal

control system.

Page 8
 P3 - Risk Management CH1 – Risk

Corporate reputation risk:

• This is a downside risk for many organisations.

• Arises from:

• Environmental performance.

• Social performance.

• Health and safety performance.

• Fraud risk factors lie outside the control of the organization.

Examples of corporate reputation risks:

• Employing child labour at low wages.

• Public suspicion about damage to health from using a company’s products.

• Involvement in business scandals such as mis-selling products, etc.

Employee malfeasance risk:

• Malfeasance means doing wrong or committing an offence.

• Organisations might be exposed to the risk of the actions of employees that result in
an offence or crime.

• This is a type of operational business risk.

Risks in international operations:

Cultural risk:

• The risk that there may be significant cultural differences in countries in which the
company operates.

• The risk that products or services may not be appreciated or acceptable in different
countries due to cultural differences.

Page 9
 P3 - Risk Management CH1 – Risk

• Failure to understand a national or local culture is an indication that the company may
fail to establish its business in a country in which it wishes to.
Litigation risk:

• A lack of understanding of local legislation could expose a business to litigation risk.

Credit risk:

• Chasing debt is more difficult and expensive.

• In the event of non-payment by the customer, legal action might be more difficult to
arrange.

• There is a high credit risk at international business level.

Items in transit:

• The risk that goods may be lost in the transit or held up.

• Goods lost might not always be covered by the insurance.

Financial risks:

• Foreign exchange risks.

4. Chapter Summary

Page 10