Risk control strategies
Reasons for risk control
Managing probability and impact
An organisation may reduce its exposure to loss events by lowering the probability that a given event will occur or by mitigating the impact of any event that does occur
Loss prevention tools: reduce the probability of a loss event by targeting its causes. The causes of a loss event are usually linked to the actions or inactions of people, failures in processes and systems or external events. Loss events often require more than one cause to occur
Loss reduction tools target the effect of loss events. Loss events may have financial and non financial effects. In financial terms, they can affect the resources (physical assets and cash assets) of an organisation
Loss reduction tools reduce the financial effects of loss events by limiting the physical damage that is caused (such as by having a sprinkler system to put out a fire as quickly as possible), or by helping to fund the repair or replacement of lost assets, compensation payments or legal liability claims as cost effectively as possible. Insurance is one way in which the repair or replacement of lost assets and compensation and liability claims can be funded
In non financial terms, loss events may cause death and injury. Loss events may also affect the reputation of an organisation via lost customer goodwill or adverse media coverage - these can have an indirect financial value
The non-financial effects of loss events may be mitigated by shortening the duration of a loss event or by helping an organisation to recover quickly from events. Loss reduction tools may also help to prevent death or injury, such as the use of evacuation arrangements in the event of a fire
An organisation will employ a range of loss prevention and loss reduction tools to control particular loss events - in part this is due to the fact that events are the result of multiple causes and have multiple effects - it is rare for any one risk control tool to combine probability and impact reduction
Using controls for loss events to help seize opportunities
From a risk management perspective, risk control is focused on preventing the causes and reducing the effects of loss events
From a wider strategic management perspective, risk control may help an organisation to seize opportunities for higher levels of financial and non-financial performance, allowing it to achieve and sometimes exceed its objectives
Traditional loss prevention and loss reduction tools can help an organisation to seize opportunities by protecting its cash flows - an organisation needs cash to help it to exploit opportunities such as exploiting new technologies, markets or opportunities to develop new products
Mechanisms such as market research and strategic investments such as flexible manufacturing systems or IT systems can help organisations to seize new opportunities
The five T's of risk control
Tolerate
To tolerate a risk exposure means to take no formal action to control it
Risks may be tolerated where are they known and accepted by an organisation - this may be where a risk exposure is considered to be within an organisation's appetite for risk
An organisation may tolerate a risk where active controls are considered uneconomic or impractical or where the risk is necessary to support the achievement of organisational objectives - objectives such as the development of new products, process change or the implementation of new technology systems will always require a degree of risk
The issue is that risk should be accepted on an informed basis
Where risk exposures are tolerated, it is good practice for senior management to approve and periodically review the decision.
It is rare for a risk exposure to be tolerated indefinitely
Treat
Risk treatments are actions taken to manipulate an organisation's exposure to one or more risks, either to mitigate threats or to exploit opportunities.
Risk treatments include many of the loss prevention and loss reduction tools that can be used by an organisation
It can also mean the increase of risk by increasing exposure or lowering controls
Transfer
Risk transfer passes the impact of loss events to a third party. This may involve passing on:
the financial impacts of a loss event
the financial and non financial impacts of a loss event
Passing on only the financial impacts of a loss event is achieved via insurance or equivalent risk taking contracts. Insurance contracts provide either full or partial indemnity against pre-speciifed loss events in return for the payment of a consideration or premium
Passing on the financial and non-financial impacts of a loss event involves a contract with a different type of third party, usually a supplier or outsourced service provider.
Whenever an organisation uses an external supplier to provide goods and services, it is effectively transferring the risks associated with the production and supply of these goods and services to the third party
Terminate
Termination includes any action taken to stop an activity or leave a location that is creating a particular risk exposure or combination of exposures
For example, an organisation might decide to vacate premises with a high risk of flooding or it might decide to stop using an operational process that creates a risk of environmental pollution or new technology that has a high risk of failure
The decision to terminate a risk exposure is a very serious one - the only way to terminate an exposure is to terminate the activity or location that is creating the exposure
This could mean that an organisation passes up valuable opportunities and it may fail to achieve its objectives
The achievement of organisational objectives will always require activities that involve exposure to risk
The decision to terminate a risk exposure should only occur where no level of risk exposure is considered to be tolerable or where the risk exposure is considered to be untreatable or non-transferrable
Take the opportunity
Remembering that risks represent both opportunities and threats, the final option involves taking the available opportunity or opportunities
When taking an opportunity an organisation may still implement other types of controls (eg risk treatments and transfers) either to mitigate any associated threats or to increase the potential to exploit the opportunity
The option to 'take the opportunity' is present in activities such as corporate mergers, new product development and research and development
Such activities are risky and may involve both positive and negative ones
Risk treatment techniques
PCDD Hazard Risk Typology
Used to help classify the range of controls that can be used to control health and safety or environmental hazards
Preventive
Focus on addressing the cause of loss events and are a type of loss prevention tool
Preventative controls are designed to prevent things such as accidents, human error, misconduct or other sources of hazard or internal control fialure
Controls include
Staff training
PPE
Asset maintenance
Shredding confidentail documents
Security arrangements
Corrective
Helps to correct the adverse consequences of a hazard or similar loss event that has occurred
Corrective controls are a type of loss reduction tool
Corrective controls include mechanisms to learn from loss events that have occurred such as post event investigations into what went wrong and why
Controls include
Fire extinguishers
Displicinary procedures
Business continuity and recovery plans
Data recovery procedures
Occupational health arrangements
Directive
Controls that are used to enforce desirable outcomes
From a hazard perspective, this might include the design and implementation of health and safety policies and procedures
Might include all of an organisation's policies and procedures that are related to risk management, governance or compliance
Other directive controls might include codes of conduct, instructions from line managers, or the roles and responsibilities assigned to employees within their job description.
Directive controls address the cause of loss events and are a type of loss prevention tool
Detective
Controls help to indicate the onset of a hazard of subsequent loss event such as a fire or pollution
Detective controls may be used to highlight deficinies in preventive or directive controls that may influence their effectiveness
A detective control is a form of loss prevention tool where it helps to detect the causes of potential loss events and a loss reduction tool where it helps to detect the causes of potential loss events and a loss reduction tool where it helps to detect the occurrence of an actual loss event
By taking prompt action, an organisation may either help to correct the adverse effects of a loss event, or help to prevent future events by addressing weaknesses in preventive or directive controls
Detective controls
Fire and burglar alarms
Internal audits and compliance reviews
Tests of business continuity and disaster recovery plans
Health and safety inspections
Inventory checks, to confirm that all equipment is in place and is in good condition
Bank reconciliations to detect loss events such as fraud
Formal controls
Have one of the following characteristics
Have a physical presence
Documented within a policy or procedure
They involve tangible sanctions
Formal controls provide a clear and tangible mechanism for risk control
Informal controls
Social mechanisms of control
These controls are almost never documented and they do not have a physical presence
The sanctions for informal control violations are intangible meaning that they are hard to define or quanitfy
Information controls include the culture and risk culture of an organisation - they relate to the social norms, beliefs, values and perceptions that staff members and other stakeholders have concerning the control of risk
Tend to be human oriented and social in nature - they relate to how people communicate, exert power and influence over each other and work together
Sanctions tend to be intangible - individuals who do not comply with informal controls may that their peers are unfriendly, non-communicative or unhelpful rather than imposing tangible sanctions like disciplinary arrangements although repeat violations of informal controls may lead to formal sanctions
Informal controls are an important complement to formal controls. Informal controls help to ensure compliance and correct implementation of formal controls
In addition informal controls can act as a substitute for formal controls where there are weaknesses in the formal control environment such as where formal controls are absent or they are not working effectively
Common risk treatment controls
Action plans
Plans that are put in place to address identified weaknesses in the identification, assessment, monitoring or control of risk.
Formal
Directive
Audit and reviews
Internal audits and reviews designed to assess the effectiveness of an organisation's internal controls and its exposure to compliance risk
Formal
Directive
Communication
Mechanisms that help and encourage people to communicate with each other
These mechanisms may be formal (meetings and committees) and informal (a chat over lunch or coffee)
Communication helps people work together to identify and find ways to address the causes of loss events and their effects
Formal and informal
All
Due Diligence
A comprehensive appraisal of a business or third party prior to signing a contract. This almost always includes appraisal of financial performance and strength. It may also include reviewing business strategies and management capabilities
Formal
Detective
Tone and action from the top
The words and expressions that are used by senior management and directors in relation to areas such as openness, honesty, integrity, tolerance, compliance and ethical conduct. The tone set and actual behaviour displayed by senior management and directors can have a significant impact on employee attitudes and behaviours in these areas
Informal
Preventive
Directive
Risk financing
Treat
Risk financing may be employed to protect an organisations cash flows from the financial impacts of a loss event. An organisation can ensure that loss events do not affect its ability to meet its liabilities as they fall due by maintaining sufficient cash surpluses in the current year or capital on the balance sheet. Equally cash funds can be used to replace lost assets quickly minimising any business disruption effects.
Tolerate
An organisation may be able to tolerate loss events more easily where finance is available pre-loss or can be obtained post loss - to help restore lost assets
Where the decision is made to not replace assets, risk financing can be used to help clean up the loss - such as funding the costs of clearing a site where a fire has occurred
Transfer
Many forms of risk transfer involve a financial element. This is most obvious in the form of insurance
In the case of risk transfer via some other third party supplier or outsourced service provider, responsibility for financing risk events is transferred to this supplier/provider.
An organisation that has transferred risks to third parties/service providers including insurers, may decide to put financing mechanisms in place to help mitigate the risks associated with the failure of, or disruptions to, the continuity of a supplier/provider or in the case of an insurer, their refusal to pay a claim
Terminate
Even where a decision is made to terminate an activity that is considered to be high risk, risk financing may be needed.
There may be redundancy and asset disposal costs and it may be that the full extent of these costs is unknown at the time that the decision is taken to terminate
Retained risk financing
Retained risk financing involves retaining rather than transferring the financial effects of a loss event
Organisations that use retained risk financing make the decision to keep the financial impacts of one or more types of loss event within the legal and financial boundaries of the organisation
This means that these financial effects will affect one or more of the following
Organisational cash flows
Profit or surplus
The balance sheet, reducing assets or increasing liabilities
Retained risk financing is funded or unfunded. Funded means allocating a pot of funds before a loss has to be financed
Unfunded means not putting funding in place and relying on current cash flows or unallocated capital
Funded retained risk financing may be chosen because risk transfer (in the form of insurance or similar) that is not needed, not available or too expensive.
Unfunded risk financing may occur because
The potential for a given loss event has not been identified (a failure in risk identification)
The full effects of a loss event are not understood (a failure in risk assessment)
There is a failure in risk transfer such as where an insurer disputes a claim or refuses to pay out in full
An organisation decides that the financial effects of a loss event are small enough to not require funding
Funded retained risk financing can be implemented before (pre-event) or after (post event) the occurrence of a loss event. Funding may be implemented post event, where a loss event has occurred but the full effects of the loss event are not yet known or have not been fully realised
Funded risk financing tools may be combined to form layers of finance for losses of varying sizes. Unfunded risk financing and risk transfer provide further layers of finance.
Insurance risk transfer
An organisation will normally use an insurance intermediary, known as an insurance broker, to help them to design an insurance program, purchase insurance and to process claims
Organisational insurance purchases are complicated and a broker can help the organisation to achieve the best possible combination of cover and premium cost
Large organisations may have an insurance professional to help support the purchase of insurance contracts and to process claims.
Alternatively, the risk function or company secretary or governance professional may be involved in purchasing insurance
It is rare for an organisation to purchase full idenmnity insurance cover. To help reduce premium costs and to ensure that insurance is available, cover is limited to a maximum loss amount, known as the limit of indemnity or indemnity limit
There will be a limit at which taking a deductible is not cost effective in terms of premium discount
Controlling major loss events
Crisis management
Crisis management is the process by which an organisation deals with a disruptive and potentially unexpected event that threatens to harm the organisation, its stakeholders or the general public
The level of potential harm from a crisis is significant - examples of crisis events include major fires, chemical spills, death or injury of people, terrorist attacks, prolonged technology systems failures or data breaches
The process of crisis management is the same as for risk management. It involves the identification, assessment, monitoring and control of crisis risks
The tools used within the crisis management process are different
The fact that crisis events are rare and are more complex in terms of their causes and effects than most other loss events
To help identify and assess crisis events, an organisation can use information on crises that have been experienced by other organiations
The control of crisis events is built around the following areas, each of which represents a different stage in the development of a crisis
1. Signal detection: looking for early warning signs that a crisis could occur. This includes investigating near misses, IA findings and risk monitoring reports. It may also include looking at operational performance reports and external events in the wider world
2. Preparation and prevention: where steps are taken to prepare for the occurrence of potential crisis events (often identified via scenario analysis) and to prevent these events by looking to control their causes
3. Containment and damage control: where a loss event occurs that may or does not evolve into a crisis, steps must be taken to limit the adverse effects of this event. This may include implementing business continuity plans, communicating with key staff and stakeholders, working with the emergency services, or implementing a public relations plan to deal with any media interest
4. Business recovery: it can take a long time to recover from a crisis but this duration can be reduced with effective recovery arrangements. These arrangements include quickly replacing lost assets and ensuring that funds are available to support the recovery
5. Learning from the crisis: assuming that an organisation recovers from a crisis, it is imperative that lesson are learned from the experience to help prevent or reduce the effects of future crises. This might include implementing a post-event review of how the crisis was managed or finding ways to improve effectiveness of pre-crisis controls
Business continuity planning
Helps with containment and damage control and support business recovery
Business continuity plans may be produced for a whole organisation but it is more common to develop plans for specific functions, systems or premises
A business continuity plan outlines the actions that should be taken to minimise business disruption and to help recover from a major loss event as quickly as possible
The plan will show the order in which systems need to be recovered first and how quickly they must be recovered
Business continuity plans should explain the roles and responsibilities that people have to support recovery efforts and reporting lines
Business contuinty plans should be tested, usually annually. Testing ay be desk basked (a review of the documentation to ensure it is up to date) or a live test may be performed
Controlling third party risks
Where service contracts are entered into, there will be third party risk. The key risks are
Failure of the service provider to provide an acceptable quality of service
Disruptions to the continuity of service
Failure of the service provider (such as bankruptcy) meaning that the service can no longer be provided
Tools
Contact management: legal review of contracts prior to signing. Ongoing legal review of contracts o ensure that they are up to date and reflect the latest legal advice
Dual supply arrangements: Contracting with two or more suppliers ensures that there is continuity of supply in the event of supply disruption or failure
Due diligence: a comprehensive appraisal of a business or third party prior to signing a contract. This almost always includes an appraisal of financial performance and strength. It may also include reviewing business strategies and management capabilitites
Escrow agreement: an arrangement by which a service provider deposits an asset with a third person who in turn delivers the asset to the service receiver if specific contractual provisions are not met
Relationship management: Regular meetings between the organisation and its service providers. These meetings help to build a positive working relationship and avoid contractual disputes
Service level agreements: A documented commitment that exists between a service provider and a client. Particular aspects of the service (such as quality, availability and responsibilities) are agreed between the service and the service user. Where service levels are not maintained the service provider may be liable to provide a full or partial refund if the situation is not corrected promptly.