C24 Risk Governance Flashcards
Steps of risk management under ACC
It will be seen that these steps follow the approach of the actuarial control cycle.
The key steps are as follows:
identification (of risks that threaten the income or assets of an organisation, and of
possible controls)
classification (into groups, including allocation of ‘ownership’)
measurement (probability and severity)
control (mitigation to reduce the probability / severity / financial and other
consequences of a loss)
financing (determining the likely cost of each risk, including the cost effectiveness of
risk control options, and the availability of capital to cover retained risk)
monitoring (regular review and re-assessment of risks together with an overall
business review to identify new / previously omitted risks).
Describe risk identification stage of the process
- Risk identification is the recognition of risks that can threaten the income or assets of the provider.
- Determine whether risk is systematic or diversifiable
- Do preliminary identification of risk control processes, reduce occurrence or impact of event
What is essential for gaining a competitive advantage over other providers?
Identifying opportunities to exploit risks
This involves understanding market dynamics and assessing potential gains from taking calculated risks.
This is fundamental to the business model of these companies, as they manage and price risk to generate revenue.
Purpose of risk classification stage of the process
Classifying risks into groups aids in
1. Calculation of cost of risks
2. Value of diversification
Describe the risk measurement stage of the process
Risk measurement is:
1. Estimation of the probability of risk event occurring
2. Its likely severity
It gives:
1. The basis for evaluating and selecting the risk control methods
2. Whether the risk should be declined, transferred, mitigated or retained with or without controls
Describe risk control
Risk control involves:
1. Deciding whether to reject, fully accept, or partially accept each identified risk
2. Identify different possible mitigation options for each risk that requires mitigation
Four ways in which risk control measures can mitigate risks or their consequences
Risk control is the implementation of systems that aim to mitigate risks or consequences of risk events by:
- Reducing the probability of a risk occurring.
- Limiting financial consequences of a risk (i.e. losses if risk occurs and cost of risk mitigation, e.g. insurance)
- Limit severity of a risk that does occur, in particular reducing probability of catastrophic loss
- Reduce consequences of a risk that does occur, e.g. by ensuring business continuity following a risk event
Risk control measures should give a measurable reduction in either the likelihood of loss or the expected cost of that loss
What is Risk financing
Risk financing involves:
- determining the likely cost of each risk (including the cost of any mitigations and the expected losses and cost of capital arising from retained risk)
- ensuring the organisation has sufficient financial resources available to continue its objectives after a loss event occurs.
Describe the monitoring stage of the risk management process.
Risk monitoring is process of ensuring that risks continue to be managed
- review and re-assessment of all the risks previously
identified
- identify new or previously omitted risks
It is important to establish a clear management responsibility for each risk in order that monitoring and control procedures can be effective.
Objective of risk monitoring
The objectives of risk monitoring might be to:
● determine if the exposure to risk and/or the risk appetite of the organisation has changed over time
● identify new risks or changes in the nature of existing risks
● report on risks that have actually occurred and how they were managed
● assess whether the existing risk management process is effective
Nine things a provider aim to achieve through an effective risk management process
or Benefits of risk mgmt process
Through an effective risk management process a provider of financial benefits will be able to:
ARFGG AO IC
- Avoid surprises
- React more quickly to emerging risks
- Improve financial stability (ie earning volatility) and quality of their business
- Improve their growth and returns by exploiting risk opportunities
- Improve their growth and returns through better management and allocation of capital
- Identify their aggregate risk exposure and assess interdependencies (ie concentration of risk, diversification benefits, natural synergies)
- Identify opportunities arising from risk arbitrage
- Integrate risk into business processes ( eg pricing) and strategic decision making (eg. produce development, M&A)
- Give stakeholders in their business confidence that the business is well managed.
List five things an effective risk management process should involve to achieve its aims
The risk management process should:
incorporate all risks, both financial and non-financial
evaluate all relevant strategies for managing risk, both financial and non-financial
consider all relevant constraints, including political, social, regulatory and competitive
exploit the hedges and portfolio effects among the risks
exploit the financial and operational efficiencies within the strategies.
Define Systematic risk
Systematic risk is risk that
- affects an entire financial market or system, and not just specific participants
- is not possible to avoid systematic risk through diversification.
Define Diversifiable risk
Diversifiable risk arises from an individual component of a financial market or system.
Using an equity investment fund as an example, describe how whether a risk is systematic or diversifiable depends on the context.
Fall in domestic equity market – systemic or diversifiable? It depends on the context
- To an investment fund that is constrained only to invest in the domestic market, this risk cannot be diversified away and is systemic
- To a world-wide investment fund that can invest in many markets, the risk is diversifiable
Explain, giving examples, how a company might comprise a number of business units.
All but the simplest businesses comprise a number of business units. These units might:
carry out the same activity but in different locations
carry out different activities at the same location
carry out different activities at different locations
operate in different countries
operate in different markets
be separate companies in a group, which each have their own business units.
The largest multinational companies may comprise business units that carry out completely unrelated activities.
Discuss the management of risk at the business unit level
Managing Risk at Business Unit Level
- Parent company would determine its overall risk appetite and then divide it amongst the business units
- Each business unit would then manage its risks within the allocated risk appetite
- The key disadvantages of this approach are that it makes no allowance for the benefits of diversification or pooling of risk
Discuss the management of risk at the enterprise level
Enterprise Level Risk Management
- Establishing group risk management as a major activity at the enterprise level.
- Imposing similar risk assessment procedures on various business units.
- Allowing for pooling of risk, diversification achievable, and economies of scale.
- Considering the risks of the enterprise as a whole, rather than individual risks in isolation.
- Giving insight into areas with undiversified risk exposures where risks need to be transferred or capital set against them.
- Enabling the company to take advantage of opportunities to enhance value by understanding their risks better.
- Not just about reducing risk, but also about putting the company in a better position to take advantage of strategic risk-based opportunities.
Discuss how the employees of an organisation should be involved in risk governance
Staff Stakeholders in Risk Governance
* All staff members are stakeholders in risk governance.
* Employees should identify and mitigate business-exposure risks.
* Staff reports on risk should be noted and rewarded through appraisal system.
Describe the Chief Risk Officer Role in Large Companies
Chief Risk Officer Role in Large Companies
* Allocating risk budget to business units.
* Monitoring group exposure to risks.
* Documenting materialized risks and their impact
* Typically at enterprise level.
Describe the role of a risk manager
Business units typically have a risk manager.
- The risk manager role may be combined with another position based on unit size.
Responsibilities include:
- Utilizing the allocated risk budget fully.
- Data collection for risk assessment.
- Monitoring risks actively.
- Reporting on risks
Other stakeholders may have a strong interest in risk governance within an organisation.
Stakeholders in Risk Governance
- shareholders, regulators, and credit rating agencies.
Role of Shareholders
- Shareholders can influence risk governance.
- They may drive the development of the risk appetite statement.
Interest of Regulators and Credit Rating Agencies
- Concerned with the quality of risk governance.
- They may impose minimum standards for risk governance.
