Please enable JavaScript.

Coggle requires JavaScript to display documents.

Risk, Identify risks, Embedding financial risk management, Project 1, • …

- - - - a risk that affects a part of the company or its normal/day-to-day business operations and systems
      - can arise from failures in processes, systems, people (normal business operations), or external events
      - have lower stakes (lower hazards and lower returns)
      - managed at risk management level and mitigated by internal control systems
      - • Risks connected with internal resources, systems, processes and employees that affect day-to-day activities
      - • Examples of operational risks with serious or frequent impacts
        
        e.g. data breach, machine failure, staff turnover, and product quality• Information and IT risk: Risk that arises from the use or misuse of data or technology (e.g., data breach, cyberattack, system failure)
      - • Responsibility for operational risk management by the board, risk committee, risk management function, line managers and employees
        
        the board (ensuring control systems)
        
        risk committee (monitoring exposure and actions)
        
        risk management function (establishing framework and policies)
        
        line managers (managing local risks)
        
        employees (operating controls)
      - • Management of operational risks by insurance, contingency plans, prevention, detection or correction
        
        insurance (covering losses)
        
        contingency plans (dealing with emergencies)
        
        prevention (stopping problems)
        
        detection (finding problems)
        
        correction (fixing problems)
    - - • Poor responsiveness, internal knowledge, communication and flexibility
      - • Old-fashioned methods of communication and website design
      - • Difficulty or interruption of accessing or using cloud-based services
  - - - a risk that affects the whole company, its objectives and performance, its overall strategic positioning of the company in its environment, and its future strategic success.
        
        rather than just parts of it
        
        the case company vertically integrated and heavily dependent on the material supply
        
        require the company's largest investment programme
        
        new debt changing its financial structure
        
        making it more vulnerable to liquidity issues.
        
        alter the industry's economics
        
        affecting future costs, revenues and profits
        
        possibly triggering retaliation by competitors.
        
        reducing its competition
        
        changing its strategic fit and its five forces positioning
        
        affect reputation among investors, suppliers, employees, and other stakeholders.
        
        polarise stakeholders' views of the organisation (a crisis issue)
        
        may lose confidence or trust in the company.
        
        affect resource supply and market value
        
        pose a threat to the company's survival
        
        depending on the size of the liabilities and the ability of the company to handle the issue
        
        Size of the liabilities: The environmental risks stem from being a chemical company, which has higher environmental risk than other industries because of its chemical processing and potential stakeholder impact.
      - can arise from changes in the external environment or internal decisions.
      - have very high stakes (high hazards and high returns)
      - managed at board level and form a key part of strategic management
      - • Risks of failing to achieve business objectives
      - • Subdivision of risks as business and non-business
        
        business (related to products or services)
        
        non-business (related to financing or other factors)
      - • Responsibility for strategic risk management by the board
      - • Factors affecting strategic success and failure
        
        choice and clarity of strategy
        
        strategy execution
        
        responsiveness to changes, mergers and acquisitions
      - • Management of strategic risks by accepting, reducing, transferring or avoiding
        
        accepting (taking opportunities)
        
        reducing (mitigating threats)
        
        transferring (sharing or outsourcing)
        
        avoiding (rejecting) them
    - - • Business risks
        
        • The risks that can threaten the survival of the business as a whole from its business model and strategy
        
        • They can arise from many sources, such as external threats, strategic failures, competitive pressures, etc.
        
        • They can affect the going concern status and make the continuation of the business uncertain
        
        • Business risk: Risk that arises from the organisation's core activities or objectives (e.g., product, environmental/PESTEL, stakeholder, investment)
      - • Failure to fulfil clients’ evolving demands
      - • Lack of awareness, resources or high-level expertise
      - • Competitor actions or business models
      - • Lack of innovation
      - • Non-business risk:
        
        Risk that arises from external or internal factors that are not directly related to the organisation's core activities or objectives (e.g., financial, event, climate)
    - - • Manage by strengthening financial performance and position, through improving profitability, efficiency, and growth, to increase shareholder value and market share
      - • Manage by having a more sustainable portfolio of assets and liabilities, through balancing risk and return, diversifying sources of income and funding, and managing interest rate and currency risks
      - • Manage by increasing capital adequacy ratio (CAR), through raising equity capital or retaining earnings. to meet regulatory requirements and absorb potential losses
    - - • Conclude by acknowledging past failures. such as liquidity crisis. investment losses. reputation damage. and strategic errors. that led to government intervention and shareholder dissatisfaction
      - • Conclude by appointing new external auditors. who have no previous connection with the bank. to ensure independence. objectivity. and quality of audits
      - • Conclude by committing to improve financial performance and position. internal controls. reporting and risk management. to restore shareholder confidence and trust in the bank
  - - - • Fundamental risks:
        
        risks that affect society in general or broad groups of people, and are beyond the control of any one individual; examples include natural disasters, wars or pandemics
      - • Particular risks:
        
        risks that affect specific individuals or organisations, and can be controlled or influenced by them; examples include smoking, driving or investing
      - • Speculative risks:
        
        risks that have both positive and negative outcomes; examples include business ventures, gambling or innovation
      - • Pure risks:
        
        risks that have only negative outcomes; examples include fire, theft or illness
- - - - Option A: offers a higher return but a higher risk profile
        
        likely to be selected by
        
        • Risk-seeking businesses/ investors: high risk appetite, want to maximise returns (although, more volatile level of returns) regardless of risks (higher level of uncertainty)
        • Risk seeker: Taking risks to maximise returns regardless of the level of risk
        
        pursue growth opportunities and satisfy shareholders.
        
        the best way to achieve ambitious levels of growth is to adopt a higher risk appetite and accept more uncertainty and volatility in its operations.
        
        gain higher returns provided that it had effective internal controls to manage the risks
        
        Option A has a higher political risk, a threat to the integrity of the company (by paying the bribe) and an element of reputation risk
        
        • These are likely to be shares in companies in complex or more turbulent environments, possibly less diversified, and with a possibility of substantial loss as well as capital growth
        
        companies with a beta greater than one, a company whose stock returns are more volatile than the market returns, the company's stock price tends to move more than the market price in the same direction.
        
        accept a supply contract with challenging terms and conditions, such as logistics, payment and foreign exchange risks.
        
        expand in, a country with high economic potential but also high political and operational risks.
      - Option B: offers a lower return but also a lower risk profile
        
        likely to be selected by
        
        • Risk-averse businesses/ investors: low risk appetite, want to minimise risks (low level of uncertainty) and only take them if they are worth it (predictable level of returns).
        • Risk averse: Taking risks only if they have acceptable returns or both positive and negative outcomes
        
        Option B has negligible political risk but a slightly higher risk that internal controls will be difficult to implement
        
        • Typical lower-risk investments are company bonds or government bonds
  - - - due to where they lie in the priority of claims in liquidation: the order in which the creditors get paid when a company goes bankrupt and has to sell its assets to pay off its debts
      - Liquidators costs
      - Creditors with fixed charge over assets
      - Costs incurred by an administrator
      - Amounts owing to employees
      - Creditors with floating charge over assets
      - Unsecured creditors
      - Shareholders
    - - • Risk
        
        inherent in any business activity that aims to create value
        
        a trade-off between return and uncertainty
        
        a source of competitive advantage if managed well
        
        should be weighed against the financial return that can be achieved
        
        • The strategic reason for bearing risk: the expected return
      - • Return
        
        the benefit or reward that a business expects from an investment or strategy
        
        should be measured by indicators such as net present value, internal rate of return, or payback period
        
        should be compared with the cost of capital, opportunity cost, or benchmark rate
      - • Why is risk always present for our organisation?
        
        • Changing business environment: PESTEL factors (such as consumer tastes) or Porter's five forces (such as competition) can affect our business
        
        • Individual decisions: Employees at all levels make decisions about products and services that involve risky activities
        
        • Control failures: Controls may be bypassed or ineffective due to our rapid growth
        
        • Unexpected hazards: Faulty equipment, user error or freak accidents can happen in any sector
      - • Why might we wish to embrace more risk?
        
        • Stakeholder demands: Customers, suppliers, lenders and shareholders may expect us to increase risk for more growth or investment
        
        • Market competition: We may need to innovate to stay ahead of our competitors, which may require more risk (such as new products and services or changing existing services)
  - - - • Portfolio heavily skewed towards X32 (60% of business)
        
        • Implication: high dependence on a single material; high vulnerability to any health threat that X32 poses; low diversification of assets and expertise
      - • Plant cannot be adapted to produce other materials
        
        • Implication: limited ability to switch to alternative materials; high sunk costs and fixed costs; low operational flexibility
      - • Processing plants dedicated exclusively to X32 and cannot be modified
        
        • Implication: limited ability to switch to alternative materials; high sunk costs and fixed costs; low operational flexibility
      - • Unlikely to dispose of X32 assets profitably due to health concerns and social reaction
        
        • Implication: low market value of X32 assets; high exit barriers; low attractiveness to potential buyers
      - • Limited options for developing new products due to low retained earnings and high gearing
        
        • Implication: low financial resources for investment; high borrowing costs and financial risk; low feasibility of share issues
    - - • Reduce overall risk: Lower the total risk exposure or volatility of the organisation by combining risks that cancel out or offset each other
      - • Increase overall return: Increase the total return or profitability of the organisation by combining risks that have different levels of return or reward
      - • Enhance resilience and flexibility: Improve the ability of the organisation to cope with changes or uncertainties in the environment by having a range of options or alternatives
    - - • Correlated risks: Two risks that vary together. If positive correlation exists, the risks will increase or decrease together. If negative correlation exists, one risk will increase as the other decreases and vice versa
        
        • Purpose and benefits: Correlated risks help an organisation to:
        
        • Identify relationships between risks: Analyse how different risks are related or connected, and measure the degree or strength of their correlation
        
        • Choose complementary risks: Select risks that have negative correlation, meaning that they tend to move in opposite directions, and combine them to diversify risks
      - • Related risks: Risks that are connected because the causes of the risk are the same
        
        • Purpose and benefits: Related risks help an organisation to:
        
        • Identify common causes of risks: Analyse how different risks are caused by the same factors or events, and measure the extent or magnitude of their impact
        
        • Avoid similar risks: Avoid risks that have positive correlation, meaning that they tend to move in the same direction, and diversify them with unrelated or independent risks
  - - - based on its impact and likelihood
      - a risk may be high if it can cause a lot of damage or happen frequently
      - a risk may be low if it can cause little damage or happen rarely.
    - - • The strategic reason for bearing risk: the expected return
- - - - • Example: Peter believes Harry and Laura should be removed
    - - • Example: Peter blamed Harry and Laura for the risk problems while they blamed Peter for his budgetary allocations
    - - • Example: He is sceptical about risk systems and focused on short term financial measures
    - - • Example: Harry and Laura have low respect from their staff and colleagues
  - - - values, beliefs, and assumptions that guide the behaviour and actions of the organisation and its members
      - Example
        
        The IT department has an implicit understanding that sensitive data is not transferred to portable laptops
        
        A job description might have a risk check included in it
        
        All employees are aware of the risks and their responsibilities to manage them
        
        • Making risk an integral aspect of standard railway operating practices and business culture, • Considering risk when developing business strategy and pursuing growth opportunities
      - • Risk management is normal behaviour at all levels and not seen as odd or interfering
    - - • Risk-related metrics are incorporated in the budgetary control and reward systems
        
        Example
        
        Harry Ho’s accident rate is a metric built into his annual appraisal
        
        budgetary control system reflects the risk metrics in the embedded system
      - Risk awareness and risk management are integrated with other systems, such as planning, budgeting, reporting, or rewarding, human resource management, and not seen as separate or additional tasks, • The idea is to make risk awareness a part of the everyday work culture and behaviour of all employees, rather than a separate or additional task.
      - • Risk awareness and risk management are prerequisites for other internal controls to function properly, such as quality control, compliance, or audit
  - - - • Benefit:
        
        Risk awareness becomes a part of the norms and assumptions of the organisation
      - • Method:
        
        Aligning individual goals with organisational goals and building them into the culture
        
        • Staff training at all levels on risk issues and responsibilities in risk awareness
        
        Conducting regular training workshops for existing staff to reinforce the risk management philosophy and processes
        
        Demonstrating top level commitment
        
        Establishing a board level risk committee to provide leadership and direction for the company
        
        • Mention a general observation about the risk committee and suggest an improvement, such as more frequent meetings
    - - • Benefit:
        
        Employees are motivated and rewarded for their risk awareness behaviour: take calculated risks and report failures or errors without fear of punishment, identify and report risks, including those arising from the behaviour of management, without fear of retaliation or negative consequences.
        
        Ensure that risk awareness is embedded into employees' work roles and responsibilities.
        
        • Success stories and rewards are needed to create a positive attitude towards risk management and to recognise and appreciate employees' contributions to reducing probity risk and enhancing trust in the business; Staff are informed and reminded of risk issues and best practices, and encouraged to learn from others' experiences
      - • Method:
        
        Linking rewards to risk-related metrics and outcomes, such as project success or risk mitigation , • Rewarding risk awareness behaviour that offers incentives or recognition for employees who demonstrate high levels of risk awareness or who make significant contributions to reducing probity risk or enhancing trust in the business.
        
        Evaluating objectives relating to risk in individual performance appraisals and reward systems
        
        Establishing reward systems that recognise risk-taking and avoid blame culture.
        
        • Publicising success stories that showcase examples of good practice or positive outcomes from risk awareness behaviour, such as identifying a new risk, preventing a potential loss, or improving a process or product quality.
        
        Publicising success stories Using internal communication channels, such as newsletters, intranet, or meetings, to share risk information and stories
        
        • Workshops to share best practice/eliminate poor practice
    - - • Benefit:
        
        Employees at all levels have clear and defined risk roles and expectations
        
        Emphasising the duty of all employees to recognise and act on risks in their job descriptions
        
        establishing a common understanding and culture of risk among all members of the organisation
      - • Method:
        
        Including risk responsibilities in job descriptions, • Integrating risk awareness into job descriptions that specify the expected level of risk awareness for each position and the key risks that need to be managed or reported. Reviewing and updating job descriptions to reflect risk duties and accountabilities
        
        Including detail of ERM initiatives in induction programmes for new employees, • Shadowing employees
        
        • Integrating risk awareness into appraisals that evaluate employees' performance on risk awareness criteria and provide feedback and improvement suggestions.
        
        • Integrating risk awareness into disciplinary actions that penalise employees for integrity failures or probity breaches that increase probity risk or harm the business.
      - risk philosophy: the set of beliefs and attitudes that determine how an organization perceives and deals with risk
      - • Developing a philosophy and culture of risk awareness that recognises the importance of all risks and seeks to address them as far as possible, rather than ignoring or hiding them.
    - - • Risk identification
        
        • Identifying and mitigating risks that may prevent the achievement of corporate objectives
        
        Weaknesses
        
        was thorough but treated as a one-off project rather than an ongoing activity.
        
        Solution:
        
        • Communicate with staff and volunteers to explain the ongoing nature of risk management and encourage them to identify and report risks as they arise.
        
        • Identifies and describes risks such as giving poor advice, trading in different cultures, etc.
        
        • Identify risks: Find out what could go wrong and why
        
        • Methods for identifying risk: Different ways to discover and list potential risks
        
        • Brainstorming and workshops: Group discussions to generate and share ideas
        
        • Stakeholder consultation: Asking for input from people who are affected by or interested in the organisation or project
        
        • Benchmarking: Comparing with other organisations or projects that have similar goals or activities
        
        • Scenario analysis: Imagining different possible situations and how they would affect the organisation or project
        
        • Results of audits and inspections: Checking the quality and compliance of the organisation or project against standards or regulations
        
        • Use of standard checklists: Following a set of common questions or criteria to identify risks
      - • Risk assessment
        
        Meaning:
        
        • Risk assessment is the process of evaluating the importance of a risk by estimating its probability and impact
        
        Listing and prioritising the main risks that the company faces
        
        • Probability: the likelihood of the risk materializing, expressed as a percentage or a proportion
        
        • Impact: the value of the loss if the risk materializes
        
        Assessment of risks should be more detailed than serious or non-serious
        
        • Should assess impact and probability of each risk as high or low
        
        • Should indicate how the seriousness of risks was determined
        
        • Should consider the interrelationships and dependencies among risks
        
        • Assesses risks based on likelihood and impact
        
        How likely and how severe are the risks
        
        • Assess risks: Quantify or qualify risks and their effects
        
        Weaknesses
        
        was missing from the process, making it hard to prioritise and plan for the most important risks.
        
        • John's impact assessments are uncertain and not justified by the case
        
        • Impact and probability are difficult to measure with hard data
        
        • Many risks are uncertain and complex in nature
        
        • Many risks are influenced by external factors that are beyond control
        
        • Many risks are subjective and depend on perception and judgment
        
        • Risk perception:
        
        the belief about the chance and effects of a risk, whether rational or irrational, held by an individual or a group.
        
        • Subjective by nature: difficult to quantify the likelihood or scale of impact of any risk
        
        2 more items...
        
        • Best guess: based on limited or uncertain data and assumptions
        
        2 more items...
        
        Weaknesses:
        
        • Highly subjective and unverifiable: based on a single study with no empirical or historical evidence
        
        2 more items...
        
        • Unclear and vague: did not specify the probability or impact of a major earthquake near the factory
        
        2 more items...
        
        • Unhelpful and misleading: did not provide any guidance or recommendations for risk management strategies
        
        2 more items...
        
        • Inconsistent and contradictory: did not consider other factors that may affect the risk, such as proximity, duration, frequency, etc.
        
        2 more items...
        
        • Absolute measures of risk are not as straightforward as John suggests
        
        • Ranking risks from 1 to 3 implies a linear scale of measurement
        
        • Ranking risks does not account for the variability and interdependence of risks
        
        • Ranking risks does not provide enough information for decision making
        
        Solutions
        
        • Add risk assessment to the register by estimating the likelihood and impact of each risk and ranking them accordingly.
        
        • Risk assessment should consider both impact and probability
        
        • Risk assessment should be based on reliable data and assumptions
        
        • Data should be collected from credible sources and verified
        
        • Assumptions should be realistic and consistent
        
        • Data and assumptions should be updated regularly to reflect changes in the environment
        
        • Continuous and ongoing: the need to update risk assessment regularly because of two reasons
        
        • Strategic importance and dynamic nature of risks: some risks increase or decrease over time depending on changes in the business environment
        
        • Adjustment of risk management strategies: the probabilities and impacts of risks can change over time as environmental changes take effect, requiring different responses
        
        4 more items...
        
        Types
        
        Subjective risk assessment
        
        estimating the probability or impact of a fire, explosion, oil spill, sabotage, etc. on a rig; based on historical records, expert opinions, industry standards, etc.
        
        Drawbacks
        
        may limit the accuracy of Gerry Jupp's risk assessments because it may involve a degree of uncertainty or bias that may affect the estimation of probability or impact of each risk
        
        may also vary from person to person or situation to situation, depending on the source, method or criteria of estimation
        
        may not reflect the actual or potential changes in the environment or circumstances that may affect the occurrence or outcome of each risk
        
        based on personal judgement, intuition or experience; less reliable and precise; used when data or information is scarce or uncertain
        
        • Subjectivity: The problem of personal or subjective judgement influencing the assessment of risks/ the choice of response
        
        • Examples and consequences: How subjectivity can affect risk assessment and lead to inaccurate or misleading results
        / can affect risk response and lead to inappropriate or ineffective strategies
        
        • Faulty measurement techniques: Using inappropriate or unreliable methods to quantify/assess risks based on assumptions, biases, or outdated data (e.g., using historical data that does not reflect current conditions)
        
        • False impression of accuracy: Assuming that quantified/assessed risks are precise or certain (e.g., ignoring the margin of error or the range of possible outcomes) (e.g., using value at risk without considering extreme events)
        
        • Complexity of mathematics: Using complicated or obscure methods that make it difficult for top management or boards to understand and evaluate risks based on expert knowledge, formulas, or models (e.g., using advanced formulas or models that require expert knowledge)
        
        Objective risk assessment
        
        based on factual data, evidence or analysis; more reliable and precise; used when data or information is abundant or certain
        
        measuring the probability or impact of equipment failure, employee absenteeism, market fluctuations, etc. on a rig; based on technical specifications, performance data, statistical models, etc.
        
        No one knows the risk events are going to happen due to
        
        the complexities and uncertainties of risk management and risk assessment in the petrochemical industry
        
        the low probability and high impact nature of the accident and its unpredictability
        
        there were internal control failures on the rig but clarify that they were not known to senior management due to information system limitations
        
        Solutions
        
        Assign responsibility to the rig management for enforcing safety controls and report by exception
        
        they were supposed to follow the established policies and procedures and inform Mrs Ahmed only if there were any significant deviations or problems
        
        • Reiterate the commitment to resolve the internal control issues and prevent future accidents
        
        framework for assessing risk
        
        • Risk is assessed by considering two variables for each identified risk: hazard (impact) and probability (likelihood) of the risk happening:
        
        • Hazard (impact) is the potential harm or loss that the risk can cause to the objectives or performance of the organisation
        
        Low:
        
        not pose a significant threat to the health, safety, environment, quality, or reputation of the organization or its stakeholders.
        
        may cause short-term delay in the project progress but not expose the lenders who are financing the project
        
        not mean that these risks should be ignored or neglected
        
        should still be monitored and controlled as appropriate, and their assessment should be reviewed periodically to account for any changes in the situation or context
        
        • Probability (likelihood) is the chance or frequency that the risk will occur or be realised
        
        High:
        
        definitely happens
        
        highly likely happens
        
        low to medium
        
        depending on...
        
        • Risk assessment 'map': a tool to plot the risks on a matrix of probability and impact and assign different risk management strategies
        
        • Accept or tolerate: low probability and low impact
        
        • Accept: Do nothing about the risk and bear the consequences if it happens (e.g., contingency plans, reserves)
        
        • Suitable for: Low likelihood and low impact risks (e.g., minor delays from traffic)
        
        1 more item...
        
        • Benefits: save resources or time, maintain efficiency or flexibility, or allow opportunities or benefits
        
        • Drawbacks: facing unexpected or undesirable outcomes, losing reputation or trust, or creating new risks (e.g., minor delays affect customer satisfaction or loyalty)
        
        • Transfer or share: high impact but low probability
        
        • Transfer: Pay someone else to take the risk or deal with the consequences (e.g., insurance, outsourcing)
        
        • Suitable for: Low likelihood but high impact risks (e.g., property damage from flooding)
        
        1 more item...
        
        Benefits: reduce the financial burden or responsibility of the organisation
        
        drawbacks: involve paying premiums or fees, losing control or quality, or creating new risks (e.g., outsourcing provider fails to deliver)
        
        • Reduce: low impact but high probability
        
        • Reduce: Implement controls or actions to prevent, minimize, or mitigate the risk (e.g., CCTV, training, backup systems)
        
        • Suitable for: High likelihood and low impact risks (e.g., shoplifting in a supermarket)
        
        1 more item...
        
        • Benefits: lower the probability or severity of negative outcomes
        
        • Drawbacks: involve spending resources or time, reducing efficiency or flexibility, or creating new risks (e.g., CCTV infringes privacy or security)
        
        • Avoid: high impact and high probability
        
        • Avoid: Stop doing the activity that causes the risk or change it to eliminate the risk (e.g., exit a market, use a different technology)
        
        • Suitable for: High likelihood and high impact risks (e.g., loss of human life from oil drilling)
        
        1 more item...
        
        • Benefits: eliminate the possibility of negative outcomes
        
        • Drawbacks: lose opportunities or benefits, changing objectives or strategies, or creating new risks (e.g., exiting a market reduces revenue or market share)
        
        • Proximate: more likely to occur in the near future, higher probability and more urgent strategies
        
        Risk strategy
        
        • Responds to risks by avoiding, transferring, or accepting them
        
        4 more items...
        
        • Risk management framework: TARA (transfer, avoid, reduce, accept)
        
        avoid
        
        4 more items...
        
        accept
        
        4 more items...
        
        reduce
        
        5 more items...
        
        • TARA: A model that suggests four possible responses based on the impact and likelihood of risks
        
        • The most material risks are those with high hazard and high probability, as they pose the greatest threat to the organisation
        
        • The least material risks are those with low hazard and low probability, as they pose the least threat to the organisation
        
        • The framework can be represented as a map of two intersecting continuums with each variable plotted along a continuum from low to high
        
        • The map can be divided into four quadrants to categorise the risks according to their relative hazard and probability
        
        • Assess three risks using the framework
        
        • Disruption and resistance by Stop-the-dam
        
        • Hazard: low, as it may cause short-term delay in the project progress but not expose the lenders who are financing the project
        
        • Probability: high, as it is definitely attempting to resist the project by tunnelling under the dam site and exposing human remains
        
        • Category: low hazard, high probability
        
        • Protest by First Nation
        
        • Hazard: low, as it is unlikely to disrupt the building of the dam or affect its operation
        
        • Probability: high, as it is highly likely to protest against the project on environmental and cultural grounds
        
        • Category: low hazard, high probability
        
        • Financing risks from banks
        
        • Hazard: medium to high, as it may cause working capital difficulties for R&M or refusal of loans from banks if they are exposed as lenders for the project
        
        • Probability: low to medium, depending on how easy it is to discover the lender's identity and whether they are willing to continue lending for the project
        
        • Category: medium to high hazard, low to medium probability
        
        Implications
        
        (1) Resource allocation depends on risk assessment.
        
        • Resource allocation is the process of assigning resources such as money, time, people, or equipment to different activities or projects based on their priority and need
        
        • Resource allocation should be aligned with the strategic objectives and goals of the organisation
        
        • Resource allocation should be optimised to maximise efficiency and effectiveness
        
        (2) Risk management strategies depend on risk assessment
        
        • Risk management strategies are the actions or plans that an organisation takes to deal with its risks
        
        • Risk management strategies should be tailored to the specific nature and context of each risk
        
        • Risk management strategies should aim to reduce, transfer, share, avoid, or accept risks depending on their assessment
        
        (3) Stakeholder expectations depend on risk assessment
        
        • Stakeholders are the individuals or groups that have an interest or stake in the organisation's activities or outcomes
        
        • Stakeholders include employees, customers, suppliers, regulators, investors, community members, and others
        
        Stakeholder responses to risk
        
        different stakeholder groups have different attitudes and reactions to risk-taking by the organisation, such as:
        
        5 more items...
        
        • Stakeholders expect the organisation to be responsible, transparent, accountable, and ethical in its risk assessment and management
        
        (4) Reputation and ethics depend on risk assessment
        
        • Reputation is the perception or opinion that stakeholders have about the organisation's performance, quality, reliability, trustworthiness, and social responsibility
        
        • Ethics are the principles or standards that guide the organisation's behaviour and decisions in relation to its stakeholders and society
        
        • Reputation and ethics can be enhanced or damaged by the organisation's risk assessment and management practices
        
        Strengths
        
        • Compliance with regulatory frameworks
        
        • Regulatory frameworks are the rules, laws, standards, or guidelines that govern the nuclear power industry
        
        • Regulatory frameworks aim to ensure safety, security, quality, environmental protection, and public health in the industry
        
        • HPC follows all applicable regulatory frameworks in its risk assessment and management processes
        
        • No serious incident since the 1970s
        
        • HPC has a long and successful history of operating nuclear power plants without any major accidents or incidents
        
        • HPC has invested heavily in safety measures, technology, training, and maintenance to prevent and mitigate any potential risks
        
        • HPC has learned from the experiences and best practices of other nuclear power operators around the world
        
        • Address the negative effects of inaccurate risk assessment
        
        • Fear, distrust and panic among stakeholders and critics
        
        • Inaccurate risk assessment can create a false sense of alarm or complacency among stakeholders and critics
        
        • Inaccurate risk assessment can undermine the credibility and confidence of the organisation and its management
        
        • Inaccurate risk assessment can trigger negative reactions or responses from stakeholders and critics that can harm the organisation's reputation and performance
        
        ALARP principle in risk assessment
        
        • ALARP: As Low As Reasonably Practicable
        
        • Meaning:
        
        Refers to ‘as low as reasonably practicable’ - a pragmatic approach to managing risks that seeks the most appropriate response to any risk by balancing cost and benefit
        
        reducing the risk to a level that is acceptable and achievable with reasonable effort and cost
        
        a principle that states that risks should be reduced to a level that is as low as reasonably practicable, meaning that the cost or effort of further reducing the risk is disproportionate to the benefit gained
        
        • Relation to impact and probability: balancing the benefits of reducing the risk (impact) against the costs of doing so (probability)
        
        • If impact is high and probability is low, ALARP may mean transferring or sharing the risk (e.g. buying insurance)
        
        • Transferring or sharing the risk: shifting the responsibility or burden of the risk to another party (e.g. insurer, partner, etc.)
        
        • Benefits: reducing the potential loss or liability in case of the risk occurrence
        
        • Costs: paying a premium or fee to the other party for taking the risk
        
        • If impact is low and probability is high, ALARP may mean reducing the risk (e.g. installing backup systems)
        
        • Reducing the risk: taking measures to lower the likelihood or severity of the risk (e.g. preventive, corrective, detective, etc.)
        
        • Benefits: minimizing the expected loss or damage from the risk occurrence
        
        • Costs: investing in resources or activities to implement the measures
        
        • If impact is high and probability is high, ALARP may mean avoiding the risk (e.g. changing the business strategy)
        
        • Avoiding the risk: eliminating the source or cause of the risk (e.g. discontinuing, withdrawing, canceling, etc.)
        
        • Benefits: avoiding the potential loss or damage from the risk occurrence
        
        • Costs: losing the potential gain or benefit from the risk source
        
        • If impact is low and probability is low, ALARP may mean accepting or tolerating the risk (e.g. ignoring minor errors)
        
        • Accepting or tolerating the risk: acknowledging and living with the risk (e.g. monitoring, reviewing, reporting, etc.)
        
        • Benefits: saving time and money by not taking any action
        
        • Costs: bearing the potential loss or damage from the risk occurrence
        
        • ALARP principle: risks should be as low as reasonably practicable
        
        • Explanation:
        
        • Risk management is a trade-off between the cost of control and level of perceived risk
        
        • Risks cannot be completely eliminated, but can be reduced to an acceptable level by investment in infrastructure, safety systems and support services
        
        • Acceptable level of risk depends on the assessment of the likelihood and impact of risk materialising and the cost of taking action to mitigate it
        
        • Residual risk needs to be subject to constant review and refinement due to the dynamic nature of the environment
        
        • Probability of occurrence cannot be zero, but can be reduced by maintaining controls and protections
        
        • Purpose and benefits: ALARP helps an organisation to:
        
        • Accept some level of risk: Recognise that risk is inevitable and unavoidable in any activity or decision, and that eliminating or avoiding all risks is neither possible nor desirable
        
        • Balance cost and benefit: Weigh the costs (e.g., money, time, resources) and benefits (e.g., safety, quality, performance) of reducing or controlling risks, and choose the optimal level of risk reduction or control that maximises the net benefit
        
        • Demonstrate due diligence: Show that reasonable steps have been taken to identify, assess, and manage risks in accordance with legal or ethical obligations or standards
        
        • Techniques: Different ways to apply and demonstrate ALARP
        
        • Risk matrix or heat map: A visual tool that shows the risks on a chart according to their impact and likelihood
        
        • Purpose and benefits: A risk matrix or heat map helps an organisation to:
        
        • Identify and prioritise risks: See the risks that could affect the organisation's objectives and rank them according to their importance
        
        • Assign responsibility and action: Show who is in charge of managing each risk and what steps are taken to prevent, reduce, or respond to it
        
        • Show risk tolerance boundary: Draw a line that reflects the organisation's risk appetite and separates the acceptable (ALARP) and unacceptable (above ALARP) risks
        
        • Cost-benefit analysis: A quantitative method that compares the costs and benefits of reducing or controlling risks, and calculates the optimal level of risk reduction or control that maximises the net benefit
        
        • Purpose and benefits: A cost-benefit analysis helps an organisation to:
        
        • Estimate costs and benefits: Quantify the costs (e.g., money, time, resources) and benefits (e.g., safety, quality, performance) of reducing or controlling risks, using relevant data and assumptions
        
        • Compare alternatives: Evaluate the costs and benefits of different options or scenarios for reducing or controlling risks, and rank them according to their net benefit
        
        • Choose the best option: Select the option or scenario that has the highest net benefit, meaning that the benefit of further reducing or controlling the risk is greater than the cost
        
        • Techniques: Different ways to measure or describe risks
        
        • Statistical techniques: Using mathematical methods to calculate or estimate risks (e.g., value at risk, regression analysis, simulation)
        
        • Sensitivity analysis: Testing how changes in one variable affect another variable (e.g., how changes in sales affect profit)
        
        • Accounting ratios: Using financial data to assess the performance or position of an organisation (e.g., margins, gearing, days, interest cover, current ratio)
        
        • Expected values: Using probabilities and outcomes to calculate a weighted average of possible results (e.g., expected profit or cost)
        
        • Risk maps: Showing risks in a visual way by plotting them on a chart according to their impact and likelihood
        
        • Purpose and benefits: Why and how a risk map is used for decision making and risk management
        
        • Identify and prioritise risks: See the risks that could affect the organisation's objectives and rank them according to their importance
        
        • Assign responsibility and action: Show who is in charge of managing each risk and what steps are taken to prevent, reduce, or respond to it
        
        • Show risk tolerance boundary: Draw a line that reflects the organisation's risk appetite and separates the acceptable and unacceptable risks
      - • Risk planning
        
        was unrealistic and rushed, with too many risks assigned to each director and a short deadline to implement actions.
        
        • Deciding which risks need most attention and allocating sufficient resources
      - • Risk monitoring:
        How to check and improve the risk management process
        
        Weaknesses
        
        was neglected, with no review dates or mechanisms to track changes in risks or actions.
        
        • Developing a risk register
        
        • Risk register: A document that lists and prioritises the main risks an organisation faces and how to deal with them
        
        • Purpose and benefits: Why and how a risk register is used for decision making and risk management
        
        • Identify and prioritise risks: List the risks that could affect the organisation's objectives and rank them according to their likelihood and impact
        
        • Assign responsibility and action: Specify who is in charge of managing each risk and what steps are taken to prevent, reduce, or respond to it
        
        • Show risk levels before and after control: Compare the risk levels with and without the control actions to evaluate their effectiveness and cost-benefit
        
        • Keep under review: Update the risk register regularly to reflect changes in the risk environment or the organisation's objectives
        
        • Separate risk registers: Some organisations may choose to maintain separate risk registers for strategic and operational risks to ensure they are considered by the appropriate level of management
        
        Solutions
        
        • Add review dates to the register to indicate when each risk should be revisited and updated based on new information or changes in the environment.
        
        • Review the risk register monthly with priority given to high-risk items or those due for review, and hold directors accountable for their actions.
        
        • Mention some other relevant risks that are not covered in the current risk register and suggest possible sources or examples of these risks, such as demographics, technology, costs, litigation, or recession
        
        risk audit
        
        External risk auditing
        
        involves identifying, assessing, reviewing and reporting on the risks that affect the organisation's objectives and performance.
        
        helps the organisation to improve its risk management practices and systems, as well as to enhance its stakeholder confidence and reputation.
        
        provide a fresh and unbiased perspective on the risks faced by the company and the effectiveness of its controls.
        
        avoid the conflicts and tensions among the board members who may have different views and interests on risk issues.
        
        provide objective and professional advice on how to improve the risk management framework and processes in the company.
        
        demonstrate compliance with best practices and regulatory requirements, as well as reassure external stakeholders such as shareholders, customers and regulators.
        
        an independent review and assessment of the risks, controls and safeguards in an organisation, conducted by outsiders, such as consultants or external auditors
        
        Benefits
        
        • Fresh and unbiased perspective: avoid familiarity threats and provide an objective and independent view of the risks and controls
        
        • Neutral and impartial approach: avoid conflicts and tensions among the board members and stakeholders who may have different interests or opinions on risk issues
        
        • Enhanced stakeholder confidence: demonstrate commitment to sound risk management, comply with best practices and regulatory requirements, and communicate risk profile and performance to shareholders, customers, regulators, etc.
        
        • Transfer of current thinking and best practice: benefit from the experience and knowledge of external auditors who have seen practice in many companies and can benchmark the company's performance against industry norms or standards
        
        Stages in a risk audit
        
        Risk identification
        
        Risk assessment
        
        Risk review
        
        Risk reporting
        
        Internal risk audit
        
        conducted by employees of the company, usually by the internal audit function
        
        • Risk management is monitored by Internal Audit
        
        • Monitoring: Reviewing the risk management process and adapting it if necessary
        
        • Techniques: Different ways to monitor and update risks
        
        • Risk indicators: Measures or signals that indicate changes in risks or their impact or likelihood, such as key performance indicators (KPIs), key risk indicators (KRIs), early warning indicators (EWIs), or trigger points
        
        • Purpose and benefits: Risk indicators help an organisation to:
        
        • Measure risk performance: Measure how well the organisation is managing its risks and achieving its objectives, using quantitative or qualitative data
        
        • Detect risk changes: Detect any changes in risks or their impact or likelihood, using trends or thresholds
        
        • Alert risk response: Alert the need for risk response or escalation, using signals or warnings
        
        • Risk review meetings: Meetings where stakeholders involved in or responsible for risk management discuss and report on risks and their status, issues, or actions
        
        • Purpose and benefits: Risk review meetings help an organisation to:
        
        • Share information and insights: Share information and insights on risks and their management among stakeholders, using reports or dashboards
        
        • Discuss issues and actions: Discuss any issues or actions related to risks and their management, such as problems, challenges, opportunities, or solutions
        
        • Coordinate and align efforts: Coordinate and align efforts for managing risks across different functions or levels of the organisation
        
        • Adapt if necessary: Making changes or improvements to the risk management process based on the review findings and feedback
        
        • Purpose and benefits: Adapting if necessary helps an organisation to:
        
        • Implement improvements: Implement changes or actions that enhance the risk management process and address any gaps or weaknesses identified in the review
        
        • Learn from experience: Learn from experience and feedback, and incorporate the lessons learned into the risk management process
        
        • Continuously improve: Continuously improve the risk management process and its outcomes, and strive for excellence
        
        • Techniques: Different ways to adapt the process
        
        • Action plan: A document that outlines the actions, responsibilities, resources, and timelines for implementing the improvements to the risk management process
        
        1 more item...
        
        • Change management: A process that ensures that changes to the risk management process are planned, implemented, and evaluated in a systematic and effective way
        
        1 more item...
        
        • Review the process: Assessing the effectiveness and efficiency of the risk management process and identifying areas for improvement
        
        • Purpose and benefits: Reviewing the process helps an organisation to:
        
        • Evaluate performance and compliance: Measure how well the organisation has managed its risks and achieved its objectives, and whether it has followed its policies and standards
        
        • Identify gaps or weaknesses: Detect any problems or issues with the risk identification, assessment, response, or reporting stages, and determine their causes and consequences
        
        • Recommend improvements: Suggest changes or actions to enhance the risk management process and address any gaps or weaknesses
        
        • Techniques: Different ways to review the process
        
        • Variance analysis: Comparing the actual outcomes of risks with the expected outcomes based on the risk assessment, and analysing the reasons for any differences
        
        • Purpose and benefits: Feedback survey helps an organisation to:
        
        • Gather opinions and perceptions: Gather opinions and perceptions from stakeholders on how well the risk management process worked and how satisfied they were with it
        
        • Identify strengths and weaknesses: Identify the strengths and weaknesses of the risk management process from different perspectives and experiences
        
        • Improve stakeholder engagement: Improve stakeholder engagement and communication by involving them in the review process and acknowledging their feedback
        
        • Feedback survey: Collecting feedback from stakeholders involved in or affected by the risk management process, such as managers, staff, auditors, customers, or suppliers
        
        • Dynamic nature of risks: Recognising that risks are constantly changing and require frequent monitoring and updating
        
        • Purpose and benefits: Recognising the dynamic nature of risks helps an organisation to:
        
        • Respond to changes or uncertainties: Respond to changes or uncertainties in the internal or external environment that affect the organisation's risks and objectives
        
        • Update risk profile: Update risk profile to reflect the current situation and conditions, and ensure that it is relevant and reliable
        
        • Maintain risk awareness: Maintain risk awareness among stakeholders by informing them of any changes or developments in risks
      - Responsibilities:
        Who is in charge of risk management
        
        • The board
        
        The board or the risk committee should
        
        • Ensure a system for risk management exists and is aligned with the risk policy.
        
        • Assess risks and review internal audit work on risk management.
        
        • Review the risk register and advise the board on risk issues.
        
        • Risk committee: A group of board members who oversee risk management
        
        has overall accountability for risk management
        
        set up a risk committee or delegate the responsibility to the audit committee.
        
        • Benefits:
        
        Ensure system exists;
        
        set risk policy;
        
        assess risks;
        
        review internal audit work
        
        review risk register;
        
        advise board
        
        • Who should be on it?:
        
        Executive directors (know the organisation well, care about risk, link pay to risk management, support listing plan) or
        
        non-executive directors (independent, objective, experienced, no baggage, no incentive to pursue risk)
        
        • The risk manager:
        A role that leads and supports risk management across the organisation
        
        Leading
        
        • Providing overall leadership, vision and direction for RM
        
        • Ensuring compliance with relevant codes, regulations, statutes, etc.
        
        Sarbanes Oxley for public companies
        
        specific rules for banks, oil, mining or tourism industries
        
        Leadership of enterprise risk management
        
        Establishing
        
        • Developing common risk management policies first before launching into detailed risk assessments (common RM competences, systems, culture, procedures, protocols, and patterns of behaviour, and risk language)
        
        promote among staff and managers to foster a positive risk awareness
        
        most important first step in RM
        
        • Implementing risk indicators (e.g. designing early warning systems)
        
        gained an understanding of the business, its strategies, controls and risk exposures before conducting any assessments.
        
        Promoting
        
        • Seeking opportunities for improvement or tightening of systems.
        
        some risks are necessary or desirable for achieving organisational goals, such as entrepreneurial risks.
        
        balancing the highest risks with opportunities instead of eliminate all of them.
        
        prioritising high-risk areas or projects for attention and action
        
        • Dealing with insurance companies
        
        to arrange appropriate coverage for insurable risks
        
        • Allocating resources based on risk
        
        • Resource allocation depends on risk assessment
        
        • Reporting with clear and comprehensive reporting information (the risks and their implications) not just advice on RM to management and risk committee as appropriate.
        
        informed decision making
        
        external reporting
        
        Not overstepping role of decision-making for senior management by advising on withdrawal from risky activities
      - Arguments against risk management in general:
        
        • There is a cost associated with all elements of risk management which must be borne by the company
        
        • There is a disruption to normal organisational practices and procedures as risk systems are complied with
        
        • There is a slowing (introducing friction to) the seizing of new business opportunities or the development of internal systems as they are scrutinised for risk
        
        • There are 'STOP' errors that can occur as a result of risk management systems where a practice or opportunity has been stopped on the grounds of its risk when it should have been allowed to proceed
      - • Arguments for risk management in H&Z:
        
        • It identifies those risks that could detract from the achievements of the company’s strategic objectives and prevents costly mistakes by advising against those actions that may lose the company value
        
        • It reassures investors and capital markets that the company is aware of and is in the process of managing its risks
        
        • It is necessary for compliance with codes, listing rules or statutory instruments where relevant
      - • Definition:
        
        • process: How to manage risk to support the strategy of an organisation
        
        • principles: identification, description, assessment, response, monitoring of risks
        
        Providing a holistic view of how risk is being managed throughout the organisation
      - COSO ERM framework
        
        • Description: A guide for managing risks across a whole enterprise using five connected components
        
        • Governance and culture:
        
        Board leadership on ethics, culture and core values
        
        • Strategy and objective-setting:
        
        Planning process that considers risk appetite and desired outcomes
        
        • Performance:
        
        Identification, assessment, prioritisation and response to risks in line with strategy
        
        • Review and revision:
        
        Feedback loop to evaluate and improve performance
        
        • Information, communication and reporting:
        
        Sharing and reporting of relevant information across the organisation
        
        • Purpose: to identify potential events that could harm an organisation and to manage risk within its defined risk appetite
        
        • Benefits: provides reasonable assurance that the business will achieve its strategic objectives; considers risk management in the context of business strategy; assigns responsibility for ERM to everyone in the organisation
        
        • Process: an iterative process which comprises eight discrete stages
        
        • Control/Internal environment:
        
        the general tone from the top which defines the company's culture and risk appetite
        
        set by the board and affected by line management
        
        • Objective setting:
        
        the process of setting goals that support the mission and are consistent with risk appetite
        
        • Event identification:
        
        the process of identifying internal and external events that affect the achievement of objectives, presenting opportunities or risks
        
        • Risk assessment:
        
        the process of assessing the likelihood and impact of risks and their interrelationships, as a basis for determining how they should be managed
        
        • Control activities:
        
        the policies and procedures that ensure that risk responses are effective
        
        • Information and communication:
        
        the communication of relevant risk information in a timely and understandable manner to enable people to carry out their responsibilities ; the information systems that enable managers and staff to carry out their responsibilities
        
        • Monitoring:
        
        the process of reviewing and modifying the ERM system as necessary to reflect the changing environment and risks
        
        • Risk response:
        
        the process of selecting appropriate +) actions to align risks with risk tolerance and appetite +) response to the individual risks assessed, such as avoiding, reducing, transferring or accepting the risk
        
        • COSO: an organisation that provides guidance on risk management and internal control
      - risk management technique
        
        • Contingency planning:
        
        the mitigation of reputation risk and regulatory risk by demonstrating speedy and effective action
        
        the coordination of emergency services in response to a serious incident to reduce the number of fatalities and injuries;
        
        • Performance information:
        
        the explanation of any significant variances to the transport ministry to motivate the board to manage business performance effectively
        
        the publishing of actual performance against pre-agreed targets every month to focus management attention on maintaining high standards;
        
        • Marketing:
        
        a commitment to offer value for money by depending on government subsidies to keep passenger fares competitive
        
        a policy of 'putting the customer's needs first' to reflect the importance of customer satisfaction and loyalty;
        
        • Enterprise risk management (ERM):
        
        a tool to provide reasonable assurance that the business will achieve its strategic objectives
        
        a way to identify and manage potential events that could harm the organisation;
        
        a framework to align the corporate objectives with the key performance indicators and targets;
        
        • Training sessions:
        
        standard operating procedures with safety as a priority
        
        regular and structured planned maintenance of trains, track and signalling equipment;
        
        compulsory awareness training for all operational staff to identify and prevent health and safety risks;
      - • Respond to risks:
        
        What to do about the risks (avoid, reduce, share, accept)
        
        • Respond to risks: Choose a suitable strategy to deal with risks
      - • Assurance mapping:
        
        • Definition:
        
        A mechanism for linking assurances from various sources to the risks that threaten the achievement of an organisation’s outcomes and objectives
        
        a process of identifying and evaluating the sources of assurance that an organisation has for managing its risks and achieving its objectives
        
        • Purpose and benefits:
        
        Assurance mapping helps an organisation to:
        
        • Ensure adequate and effective coverage: Avoid gaps or overlaps in assurance activities and ensure that all key risks are addressed by appropriate sources of assurance
        
        • Coordinate and align assurance providers: Clarify roles and responsibilities of different assurance providers and ensure that they work together in a consistent and complementary manner
        
        • Optimise assurance resources: Allocate and prioritise assurance resources based on the level and quality of assurance needed for each risk area
        
        • Enhance assurance reporting: Provide a clear and comprehensive overview of the assurance status and issues for each risk area and communicate them to relevant stakeholders
        
        • Techniques:
        
        Different ways to conduct and present assurance mapping
        
        • Four lines of defence: A common model that categorises assurance providers into four groups based on their level of independence and responsibility
        
        • First line of defence: Management controls and internal control measures that are implemented by operational managers and staff who own and manage the risks
        
        • Second line of defence: Financial control, security, risk management, quality, inspection, compliance, and other functions that provide oversight, guidance, support, and monitoring for the first line of defence
        
        • Third line of defence: Internal audit function that provides independent and objective assurance on the effectiveness of governance, risk management, and internal control systems
        
        • Fourth line of defence: External audit, regulators, and other external parties that provide independent and external assurance on the organisation's performance, compliance, or accountability
      - • Risk map or heat map:
        
        • Definition:
        
        A visual tool that shows the risks and their sources of assurance on a chart according to their impact and likelihood
        
        • Purpose and benefits:
        
        A risk map or heat map helps an organisation to:
        
        • Identify and prioritise risks: See the risks that could affect the organisation's objectives and rank them according to their importance
        
        • Assign responsibility and action: Show who is in charge of managing each risk and what steps are taken to prevent, reduce, or respond to it
        
        • Show risk tolerance boundary: Draw a line that reflects the organisation's risk appetite and separates the acceptable and unacceptable risks
        
        • Show sources of assurance: Indicate which sources of assurance are available or needed for each risk area
      - • Start again!:
        
        • Definition:Definition
        
        Repeating the risk management cycle with updated information and feedback
        
        Starting again is the final stage of the risk management cycle, where the organisation revisits the previous stages with updated information and feedback, and continues to manage its risks in an ongoing way
        
        • Purpose and benefits:
        
        Starting again helps an organisation to:
        
        • Maintain relevance and reliability: Maintain the relevance and reliability of the risk management process and its outputs, by ensuring that they reflect the current situation and conditions
        
        • Ensure continuity and consistency: Ensure the continuity and consistency of the risk management process and its outcomes, by following a standardised and systematic approach
        
        • Achieve objectives and excellence: Achieve the organisation's objectives and excellence in risk management, by continuously monitoring, reviewing, and improving the risk management process and its performance
        
        • Techniques:
        
        Different ways to start again
        
        • Risk register: A document that records the risks identified, assessed, responded to, monitored, reviewed, and updated by the organisation
        
        • Purpose and benefits: A risk register helps an organisation to:
        
        • Document risks: Document all the information related to risks and their management in a comprehensive and consistent way
        
        • Track risks: Track the status, progress, or changes of risks and their management over time
        
        • Report risks: Report on risks and their management to relevant stakeholders, using summary or detailed views
        
        • Risk management cycle: A model that shows the stages of risk management as a continuous cycle that repeats itself with updated information and feedback
        
        • Purpose and benefits: A risk management cycle helps an organisation to:
        
        • Visualise risk management: Visualise how risk management works as a dynamic and iterative process that involves multiple stages
        
        • Guide risk management: Guide how to perform each stage of risk management in a logical and sequential order
        
        • Improve risk management: Improve how each stage of risk management is performed based on updated information
    - - • Benefit:
        
        ensure that risk awareness is systematic, consistent, and effective across the organisation.
        
        Management has accurate and timely information on risks and can take appropriate actions or decisions
      - • Method:
        
        • Establishing a risk committee that oversees the risk management process and provides guidance and oversight to managers and staff on risk issues.
        
        • Establishing a risk auditing procedure that identifies all risks affecting the business, both internal and external, assesses their probability and impact, assigns a risk strategy (such as avoid, reduce, transfer, or accept), and monitors and reviews their status and changes.
        
        • Risk impact should not be the only criterion for avoiding risk
        
        • A risk with a high impact but a low probability may be acceptable
        
        • A risk with a low impact but a high probability may be unacceptable
        
        • Risk avoidance is not always the best option for managing risk
        
        • Risk management strategies depend on risk assessment
        
        • Establishing a reporting mechanism that communicates the results of the risk audit to relevant stakeholders and holds individual managers accountable for their behaviour in respect of risks. ; Developing and implementing risk reporting systems and tools, such as dashboards, scorecards, or suggestion boxes
        
        • Establishing metrics and performance indicators that monitor and feedback information on risks to management
        
        Publishing ERM policies and procedures and statements of compliance
        
        • Establishing a visible policy on risk awareness that defines the objectives, scope, roles, and responsibilities of risk management, and that is supported by all levels of management and staff.
- - - - • Materiality: the extent to which information can affect the decisions of users of that information; information is material if its omission or misstatement could influence the economic decisions of users
      - • Environmental performance affects the way that the company is viewed by some of its key stakeholders, such as the local community and investors, who can influence its reputation, resource supply, and market value
      - • Environmental risk is a structural risk resulting from the company's core activity of extracting and processing oil, which can have a major impact on one or more stakeholders and threaten a key resource (labour supply)
      - • Environmental risk is a source of potential losses from such things as emissions and hazardous leaks, pollution and some resource consumption issues, which can affect the company's returns, costs or both
      - • Environmental risk reporting can explain the extent and nature of the risk, the new risk controls put in place after the accident, and the previous environmental accident statistics, which can help shareholders to assess whether the risk profile of the business matches their own attitudes to or appetite for risk, to judge how the risk might affect company value and hence the potential volatility and attractiveness of the share, and to restore investor confidence after a confidence-threatening event
- - - - • Causes: global warming, greenhouse gas emissions, extreme weather events, etc.
      - • Consequences: increased planning delays, material costs, supply limitations, etc.; increased exposure to flood hazards, storm damages, etc.; reduced returns to investors, financial strength, etc.
      - • Impact: affects QH's strategic objectives of maintaining financial strength, supporting sustainable communities, and embedding environmental considerations into core competencies
      - • Mitigation: take measures to reduce greenhouse gas emissions and adapt to climate change effects
        
        • Monitor operational efficiency and direct environmental impact by measuring CO2 emissions and waste generated for each home
        
        • Pros: identifies areas for improvement and reduction of environmental footprint; demonstrates compliance and accountability to stakeholders
        
        • Cons: may require time and resources to monitor; may face technical or methodological challenges
        
        • Develop a climate change risk register to embed the management and mitigation of climate associated risk within QH's risk management process
        
        • Pros: ensures systematic identification, assessment, and response to climate related risks; enhances risk awareness and preparedness among employees
        
        • Cons: may require time and resources to develop and update; may face uncertainty or complexity of climate scenarios
        
        • Consider potential impacts of climate change throughout the land acquisition, planning and build processes and work with planning authorities and other statutory bodies to manage and mitigate these risks
        
        • Pros: reduces exposure and vulnerability to climate hazards such as flooding or storms; improves resilience and adaptation of products and processes
        
        • Cons: may require time and resources to consider and work with others; may face conflicts or trade-offs with other objectives or interests
        
        • Engage with the housing industry and the government to develop industry wide solutions to meet climate change requirements
        
        • Pros: contributes to the development and sustainability of the housing sector; creates collaboration and innovation among stakeholders
        
        • Cons: may require time and resources to engage with others; may face conflicts or disagreements with other parties
    - - • Scarcity of resources: Shortages of crops or materials due to drought or extreme weather
      - • Impact on business operations: Disruptions or damages to facilities or infrastructure due to storms or floods
      - • Damaged supply chains: Shortages or delays of products or shipments due to weather events in other countries
      - • Coastal erosion: Loss of coastal business, infrastructure, tourism, etc. due to rising sea levels
      - • Increased insurance costs: Higher premiums or difficulty obtaining insurance for businesses in high-risk areas
      - • Reputation damage: Loss of customer goodwill or trust for businesses that harm or neglect the environment
- - - - • Liquidity risk might be a significant risk to the organisation because:
        
        (2) Manufacturing has complex management systems due to a more complex business model; the variability and availability of inventory at different stages and the need to manage inventories at different levels raise liquidity issues not present in many other businesses.
        
        (3) The company has weaknesses that worsen its liquidity position as a manufacturer; its ineffective credit control department and its 20 day supplier payment policy increase the short-term cash pressure and the likelihood of liquidity risks.
        
        (1) Manufacturing needs higher working capital levels because it buys and sells physical inventory on credit; this increases both payables and receivables; it also requires inventory as raw materials, work-in-progress and finished goods; wages are paid throughout the process, but finished goods may take time to sell.
      - the risk of not having enough cash or liquid assets to meet short-term or long-term obligations, such as debt payments, withdrawals, or operational expenses.
        
        Due to the recession and political instability in Dubland, many businesses and individuals defaulted on their loans or withdrew their deposits from BigBank, reducing its cash inflow and increasing its cash outflow. This increased BigBank's liquidity risk and threatened its solvency and reputation.
      - i.e. the ratio of short-term assets to liabilities; it involves working capital and cash flow management; it depends on receivables, payables, cash and inventories control.
      - • Manage by monitoring and reporting liquidity ratios, having backup sources of financing, and complying with government regulations
        
        • Manage by monitoring and reporting liquidity ratios, such as current ratio, quick ratio, and cash ratio, to ensure adequate liquidity levels
        
        • Manage by having backup sources of financing, such as credit lines, overdrafts, or asset sales, to deal with unexpected cash shortages
        
        • Manage by complying with government regulations, such as minimum reserve requirements and liquidity coverage ratio, to ensure solvency and stability
    - - • A loss arising from exchange rate movements between the time of entering into an international trading transaction and the time of cash settlement
      - • Possible solution:
        
        • Hedge the exposure using methods such as forward contracts or money market hedges
      - • The risk of losing money from changes in currency values that affect the cost or revenue of transactions in different currencies
      - • The loss to shareholders can be from
        
        increased costs of buying goods from foreign suppliers
        
        reduced profits from selling goods in foreign markets
        
        risk management costs from hedging strategies or uncertainty from currency volatility
  - - - • Possible causes: drop in passenger numbers, rise in operating costs, cut in state subsidies, etc.
      - • Possible consequences: cash flow problems, solvency issues, bankruptcy, etc.
- - - - if a company faces a lawsuit or a regulatory violation, it may also suffer from negative publicity or stakeholder dissatisfaction, which can damage its reputation.
      - Conversely, if a company resolves its legal issues or complies with the law, it may also improve its reputation and public image.
    - - • Environmental risk can damage reputation (reputation risk) and harm sensitive situations, like human health or natural habitat.
      - • Reducing environmental risk by acquiring less harmful resources or fitting emission controls lowers the chances of both environmental and reputation damage; the opposite is also true: neglecting environmental risk increases reputation loss.
    - - i.e. the cancellation of the contract
      - i.e. the activities of the organisation
    - - • The technology failure was caused by serious and avoidable errors
      - • Frank Bub ordered a system that was not suitable for the intended purpose and could not handle the normal loading
      - • Frank Bub acted alone without following any purchasing procedure or control to ensure the quality of the system
      - • The system was not tested before it was fully implemented and the board did not oversee the project
      - • The errors reflect badly on the board and its appointments processes
      - • Frank Bub was in a senior position and his mistake may cast doubt on the competence of the rest of the board
      - • The board did not have a proper mechanism to monitor and assess such a large and important investment decision
      - • The board did not discuss or agree on the implementation procedures for the system that controls the main operations of the company
      - • Shareholders may not trust the board even if Frank Bub is removed
- - - - • Possible causes: negative publicity, media coverage, word-of-mouth, etc.
      - • Possible consequences: decline in customer loyalty, satisfaction, retention, etc.
- - - - potential harm or adverse health effect on passengers and employees due to high-speed rail travel in remote areas
        
        • Possible causes: human error, mechanical failure, environmental hazards, etc.
        
        • Possible consequences: injuries, deaths, disabilities, lawsuits, etc.
- - - - • Evaluate the adequacy of the activities for each risk
        
        • Operating in dangerous locations around the world: explain why current activities are adequate but mention a missing aspect of the risk, such as litigation
        
        Adequate current activities:
        (1) monitor and review activities in recognised dangerous locations, procedures to remove staff and volunteers at short notice
        (2) close relationship with security and safety services
        
        A missing aspect of the risk:
        (1) potential litigation from injury or death of staff or volunteers
  - - - such as loans, securities, or derivatives, due to market fluctuations, defaults, or frauds
    - - • Manage by communicating with shareholders, through regular reports and meetings, to inform them of the investment performance and strategy of the bank
      - • Manage by reviewing business model, to ensure that the bank's investments are aligned with its risk appetite and return objectives
      - • Manage by investing in more sustainable assets, such as government bonds, high-quality corporate bonds, or diversified equity portfolios, to reduce exposure to risky or volatile assets
    - - the risk of not being able to raise enough funds to cover the costs of the BCO's activities
      - Evaluate the adequacy of the activities for each risk
        
        explain why current activities are not sufficient and suggest more activities, such as promotion, ethics, and donor engagement
  - - - • Possible causes: fluctuations in demand, supply, price, interest rate, exchange rate, etc.
      - • Possible consequences: reduced revenue streams and profits or even loss
    - - • Impact on strategic aims:
        
        could affect profitability and investment in product development;
        
        could reduce product range and customer satisfaction;
        
        could harm customer relationships
      - • Strategic aims affected:
        
        developing the widest range of products for customers;
        
        developing and maintaining customer relationships
      - • Mitigating activities:
        
        buy key inputs forward;
        
        work with suppliers to choose optimal time and quantity for purchases;
        
        hedge commodity price risk
      - • Rationale:
        
        provide stable cost base;
        
        make optimum trading and pricing decisions;
        
        protect consumer from fluctuating prices
    - - Product market
        
        • Demand falls due to economic factors: Customers can no longer afford to travel or choose cheaper alternatives
    - - • Erodes investor confidence in the general governance of the company
      - • Affects share price and hence company value negatively
      - • Threatens existing management and makes the company a possible takeover target
      - • Adversely affects price-earnings and hence market confidence in the company's shares
      - • Makes it more difficult to raise funds from the stock market
- - - - could damage reputation and trust;
      - could challenge leadership, operations and supplier management;
      - could affect product quality and customer satisfaction;
      - could hinder market development
    - - developing and maintaining customer relationships;
      - developing new markets
    - - maintain rigorous security systems throughout supply chain;
      - implement robust process for product recall and consumer communication;
      - maintain strong relationships with suppliers;
      - audit ethical sourcing from cocoa farms
    - - guard against poor quality/defective supplies;
      - be open and honest with customers;
      - ensure ethical standards are met;
      - avoid negative publicity
- - - - could result in loss of competitive advantage or staff to competitors;
      - could result in loss of skills and performance excellence;
      - could affect product development and customer relationships
    - - developing and maintaining customer relationships;
      - developing the widest range of products for customers
    - - evaluate the balance of skills, knowledge and experience within the team;
      - keep staff informed of internal and external developments;
      - use strong staff appraisal systems and focus on staff development;
      - use regular training and skills development;
      - use strong recruitment processes, formalised succession planning and on-going individual training and development plans
    - - ensure role and capabilities are matched;
      - create loyalty and commitment of staff;
      - build on performance excellence;
      - be innovative in product development;
      - mitigate the risk of loss of key staff
  - - - • Causes: human error, mechanical failure, environmental factors, etc.
      - • Consequences: loss of life, skills, knowledge, etc.; loss of income, reputation, morale, etc.
      - • Avoidance: do not permit employees to travel for work purposes; use alternative methods of communication and collaboration such as electronic meetings
        
        • Pros: reduces exposure to travel accident risk; ensures safety and well-being of employees
        
        • Cons: may limit the choice and availability of work opportunities; may reduce the quality and effectiveness of communication and collaboration
        
        • Mitigation: take measures to reduce the impact or likelihood of travel accidents
      - • Travel policy: establish rules and guidelines for employee travel such as not permitting teams to travel together, looking for safer transport alternatives, eliminating unnecessary travel, etc.
        
        • Pros: reduces exposure to travel accident risk; ensures compliance and accountability of employees
        
        • Cons: may require time and resources to develop and enforce; may face resistance or exceptions from employees; may not prevent travel accidents from occurring
      - • Travel insurance: provide coverage or indemnity for losses or damages caused by travel accidents such as medical expenses, death benefits, disability benefits, etc.
        
        • Pros: reduces financial impact of travel accident risk; ensures compensation and support for employees and their families
        
        • Cons: may require premiums or deductibles from employees or employer; may face exclusions or restrictions from insurance company; may not cover non-financial impact of travel accidents
      - • Travel safety: provide training and information on how to prevent or respond to travel accidents such as emergency procedures, first aid, security measures, etc.
        
        • Pros: reduces likelihood and severity of travel accident risk; ensures preparedness and awareness of employees
        
        • Cons: may require time and resources to provide and update; may face variability or complexity of travel situations; may not guarantee safety or survival of employees
      - • Documentation management: ensure that all documentation is up-to-date and self-explanatory, so that it can be picked up easily by other employees if a travel accident occurs
        
        • Pros: reduces operational impact of travel accident risk; ensures continuity and quality of work processes and outputs
        
        • Cons: may require time and resources to create and maintain; may face confidentiality or accessibility issues; may not cover tacit or implicit knowledge of employees
  - - - • Monitor projected build programmes to plan labour requirements
        
        • Pros: ensures optimal allocation and utilization of labour resources; avoids overstaffing or understaffing
        
        • Cons: may require time and resources to monitor; may face uncertainty or variability of demand
      - • Operate in-house apprentice and training programmes to support the supply of skilled labour
        
        • Pros: enhances the skills and knowledge of existing and potential employees; improves employee retention and motivation
        
        • Cons: may require time and resources to operate; may face competition or poaching from other employers
      - • Participate in external initiatives to address industry-wide skills shortages with other house building companies and trade organisations
        
        • Pros: contributes to the development and sustainability of the house building sector; creates collaboration and cooperation among stakeholders
        
        • Cons: may require time and resources to participate; may face conflicts or disagreements with other parties
      - • Retain key staff through employee engagement surveys, performance management frameworks, career management initiatives and incentives
        
        • Pros: reduces employee turnover and loss of skills and knowledge; improves employee satisfaction and loyalty
        
        • Cons: may require time and resources to implement; may face challenges or resistance from employees or managers
      - • Maintain strong land holdings and undergo rigorous assessment for land purchases
        
        • Pros: ensures availability and suitability of land resources for current and future projects; maximizes returns on investment
        
        • Cons: may require significant capital and due diligence; may face regulatory or environmental issues
- - - - • Competition: explain why current activities are not adequate and suggest more activities, such as stakeholder awareness, customer/donor retention, and service innovation
  - - - could reduce demand for products, resulting in loss of competitive advantage, market share and sales;
      - could harm brand image and customer relationships;
      - could threaten sustainability in the market place
    - - growing and developing products/markets;
      - developing and maintaining strong customer relationships
    - - identify and develop new product ideas;
      - develop staff skills in hand-made chocolate products;
      - use multi-channel sales network;
      - work with new retail partners
    - - offer greater range of products;
      - build on performance excellence;
      - satisfy customer needs; widen sales network
- - - - • Possible causes: obsolescence, inefficiency, inadequacy, etc. of existing technology
      - • Possible consequences: increased costs, delays, disruptions, errors, etc.
- - - - • Pros: reduces exposure to supplier failure risk; ensures continuity and quality of software supply
      - • Cons: may limit the choice and availability of innovative software; may increase the cost and complexity of procurement
      - • Mitigation: take measures to reduce the impact or likelihood of supplier failure
    - - • Pros: secures software supply and functionality; protects consumer from software loss or damage
      - • Cons: may require legal fees and arrangements; may not cover updates or enhancements; may not guarantee compatibility or usability
    - - • Develop a long-term in-house software application that could replace Topaz's software; use it for other applications within WE
      - • Pros: creates independence and flexibility in software development; enhances innovation and performance
      - • Cons: may require time and resources to develop; may face technical or legal challenges; may not match Topaz's software quality or functionality
    - - • Pros: enables continuation and maintenance of software supply and functionality; leverages existing skills and knowledge
      - • Cons: may require additional training and support; may face technical or legal challenges; may not match Topaz's software quality or functionality
    - - • Pros: preserves software supply and functionality; eliminates competition and increases market share
      - • Cons: may require significant capital and due diligence; may face regulatory or ethical issues; may not guarantee software quality or functionality
    - - • Pros: ensures readiness and responsiveness to supplier failure risk; reduces uncertainty and disruption
      - • Cons: may require time and resources to prepare; may face implementation challenges; may not guarantee smooth transition or optimal outcome