Chapter 25 - Risk Governance

Question 1

Define and list aims of the risk management process

Answer 1

• Risk management can be described as the process of ensuring that the risks to which an organisation is exposed are the risks to which it thinks it is exposed and to which it is prepared to be exposed
• Key aim is to protect an organisation against adverse experience that could result in it being unable to meet its liabilities

Question 2

List the stages of the risk management process

Answer 2

1. Identification (of risks that threaten the income or assets of an organisation) 

2. Classification (into groups, including allocation of ‘ownership)
3. Measurement (probability and severity) 

4. Control (mitigation to reduce the probability / severity /financial consequence of a loss). 

5. Financing (determining the likely cost of each risk, including the cost effectiveness of risk control options, and the availability of capital to cover the risk) 

6. Monitoring (regular review and assessment of risks together with an overall business review to identify new / previously omitted risks)

Question 3

What is risk ID?

Answer 3

• Risk identification is the recognition of the risks that can threaten the income and assets of an organisation

Question 4

Why is risk ID hardest aspect?

Answer 4

• Risk identification is the hardest aspect of risk management because the risks to which an organisation is exposed are numerous and because risk ID needs to be comprehensive. The biggest risks to an organisation are those that are not identified

Question 5

What is risk classification and what are the benefits?

Answer 5

• Grouping the identified risks into categories
• i.e. financial vs non-financial (one example of risk taxonomy)
• Classifying risks into groups aids calculation of cost of risk and value of diversification
• Allocates a ‘risk owner’ to control processes for the risk

Question 6

What is risk measurement and how does it link to the risk control aspect?

Answer 6

• Estimation of the probability of a risk event occurring and its likely severity
i.e. probability x severity
• Normally carried out before and after any application of risk controls
• Measurement gives the basis for evaluating and selecting methods of risk control

Question 7

What are possible risk control measures (high level not specific)

Answer 7

o Decline/Avoid altogether
o Retain with or without controls
o Transfer (in part or full)
o Defer

Question 8

What are the benefits of risk control measures

Answer 8

o Reduce the probability of a risk occurring
(Eg introducing good safety procedures within a co to reduce the risk of a fire) 

o Limit the severity of the effects of a risk that does occur
(Eg having sprinkler systems and adequate fire extinguishers, so a fire that does occur can quickly be put out) 

o Limit the financial consequences of a risk that does occur
(Eg by a co having adequate insurance in place to meet the costs of a fire that does occur)
o Reduce the non-financial consequences of a risk that does occur
(e.g. plan to relocate in case fire destroys premises so as to be able to continue trading)

Question 9

What is risk financing?

Answer 9

• Involves:
o Determining the likely cost of each risk, as well as the cost of any mitigations and expected losses and cost of capital from retained risk
o Ensuring company has sufficient resources to continue objectives after loss occurs

Question 10

What components make up the cost of a risk?

Answer 10

o Cost of putting in place internal risk control measures
o Cost of transferring risk to another party e.g. insurance premium
o Expected cost of risk events occurring in respect of risks retained
o Cost of holding capital against adverse outcomes in relation to risks retained

Question 11

Define risk monitoring

Answer 11

• Risk monitoring is the regular review and re-assessment of all the risks previously identified, coupled with an overall business review to identify new or previously omitted risks

Question 12

Give the aims of risk monitoring

Answer 12

• Objectives of risk monitoring (DIRA):
o Determine if exposure to risk /risk appetite has changed over time
o Identify new risks or changes in nature of existing risks
o Report risks that have actually occurred and how they were managed
o Assess whether existing risk management process is effective

Question 13

What are the benefits of a risk management process

Answer 13

AIDD BIG P

• Avoid surprises
• Improve (Stephen Gerard Jurisich):
o stability and quality of business
o growth and returns by exploiting risk opportunities
o job security and staffing stability
• Detect risks earlier (when cheaper)
• Determine most cost-effective risk controls e.g. matching, transfers
• Better capital allocation to areas with higher risk-adjusted return
• Identify opportunities arising from natural synergies or risk arbitrage
• Give stakeholders confidence business is run well
• Price products to reflect risk

Question 14

Define systemic, systematic and diversifiable risks

Answer 14

• Systemic risk: a risk caused by an event at the firm level that is severe enough to cause instability in the financial system
• Systematic risk: risk that affects an entire financial market or system and cannot be diversified away
• Diversifiable risk: risk arising from an individual component of a financial market or system

Question 15

How can business units be differentiated?

Answer 15

• Carry out the same activity but in different locations
• Carry out different activities but in same location
• Carry out different activities in different locations
• Operate in different countries
• Operate in different markets
• Be separate companies in a group, which each have their own business units

Question 16

What are the advantages of ERM?

Answer 16

• Consider risks in a holistic and integrated manner rather than in isolation
o Risk management function established, risks of BUs identified and results combined into a risk assessment model at entity level
• Recognizes that risks are dynamic and considers interactions→ considers how risks diversify across business unit as well as pooling of risk
• Consider risks in a consistent structured way
• Considers upside as well as downside risks
o Reducing risk but also taking advantage of risk-based opportunities.
• Top-down but stresses risk management is everyone’s responsibility
• Stresses value creation – if understand risks better, can take educated risks to increase returns
• Fair and efficient capital allocation across business units
• Aligns with corporate strategy
• Gives insights into areas with undiversified risk exposures where risks need to be transferred or capital set against them

Question 17

What are the lines of defence with regards to ERM process

Answer 17

• Line management staff in BU (first line of defence) – accountable for measuring and managing risk in BUs on a daily basis (risk taxonomy, processes e.g. clean desk policy)
• Business unit manager – make use of risk budget, collect data, monitor and report
• CRF & CRO, risk management and compliance teams (second line of defence)
• Board and audit function (third line of defence) – accountable for effective governance of risk management process, setting risk management strategy, approving policies and ensuring ERM is effective

Question 18

What are the roles of the central risk function?

Answer 18

o Roles (M CABAG) :
 Monitor progress on risk management
 Compare risks being run by business to risk appetite
 Advise board on risk
 Be central point for staff to report new and enhanced risks
 Assess overall risks being run by business
 Give guidance to line managers about identification and management of risks with suggested risk responses

Question 19

What are the different relationships between BUs and risk management function?

Answer 19

Offence vs defence ‘accelerator and hand-brake’
Policy and policing
Partnership

Question 20

What are the issues with policy and policing?

Answer 20

FLOAB
o Friction between LM and RM as they struggle to understand each other’s viewpoints
o Little incentive for LM to report problems/policy violations
o Out of date policies since board members aren’t in touch with reality on ground
o Audit & compliance reviews do not occur continuously  fail to identify problems
o BU not given scope to use own judgement

Question 21

How does the partnership relationship with BU and RM work?

Answer 21

• RM staff integrated into BU and share some performance measures
• BU and RM work together in a client-consultant type relationship to manage risk
• BU must recognize benefit to long-term performance of risk management function
• RM must recognize importance of their role as meeting the needs of the BU
• Independence may lack – difficult for RM staff to have a corporate oversight role

Question 22

How does a company develop an ERM culture?

Answer 22

Risk management should be incorporated into business (line) management processes, such as business strategy, new product development, product pricing, business performance measurement and remuneration