Fundamentals of Risk Management

Question 1

Definition of risk and opportunity

Answer 1

A Risk is a adverse deviation that a particular result might have in relation to a target or the plan, also known as a downside risk.

An Opportunity is a potential favorable deviation of an actual result from its target.

An alternative understanding of the term risk includes both adverse and favorable deviations (up- and downside risk).

Question 2

Why should or must companies have a proper risk management ? Why should it be in the interest of the company?

Answer 2

The fundamental idea of risk management is to influence and monitor the risk situation of a company with the ultimate goal of ensuring the success and survival of the company.
Companies want to avoid the insolvency of the company. If they have a successful risk management it might help them to reduce becoming insolvent.
There are a lot of examples that shows that a non-existing or bad risk management can end in a bankruptcy of a company (Metallgesellschaft, Enron)

Question 3

How are external auditors involved in a company’s risk management? Please explain briefly.

Answer 3

German government is involved by given legal restrictions of risk management to the company’s (KonTraG, StaRUG).

Also BaFin controls the risk management and can impose Penalty’s.

Question 4

What steps does the operational risk management process distinguish? Please briefly describe the individual steps. What is special about the process?

Answer 4

Operational risk management is a dynamic, recurring process, not a one-time activity

1. Risk Identification: Identify the risk the company is facing based on a clear definition of risk and using a systematic approach.
2. Risk Assessment: Assess the relevance of the risks identified ( e.g. by measuring the quantifiable risks) and understand the factors driving them
3. Risk Response: Respond to relevant risks by
   -avoiding,
   -reducing,
   -limiting,
   -transferring or accepting risks
4. Risk Control(ling): Monitor relevant risk, provide information to internal and external addressees, organise and coordinate risk management activities