Module 4: Risk Treatment Flashcards
Where does risk treatment sit in the risk management cycle?
Risk treatment is the third step, after risk identification and risk assessment.
Risk identification involves the capture and documentation of risks.
Risk assessment requires some measurement of the risk and understanding of its impact.
Responsibility for Risk treatment is passed from the board (who own the risk management process) to those more closely involved in operational processes with a better understanding of the nature of risk.
It is not sufficient to have simply identify and quantify a risk. Something must be done. Risk treatment enhances a companies value and in turn will be considered a benefit to the investing community.
What are the principle sources of available data that provide source material for decision making on risk treatment options?
Risk registers Checklists Audit reports Questionnaires Surveys flowcharts Risk assessment workshop write ups MI
How does hopkin categorise risk?
Joplin categorises risks as: Operational (eg machinery breakdown) Physical Environmental Strategic Legal Technological Competition (eg new market entrant) Regulatory Financial/ economic Social Political Human (pandemic wiping out staff)
Who is typically accountable for determining and approving risk treatment options?
The Board is ultimately accountable for determining and approving risk treatment options. The boards role is to have oversight of all the risks that might threaten the successful achievement of the organisations objectives and to ensure that such risks are identified l, evaluated and effectively treated. In this respect the board relies on its execs and senior management to compile accurate MI on major threats and to make recommendations on treatment options.
What risks might an organisation routinely tolerate?
Inflation and interest rate changes
Weather risks
Foreign exchange and other financial risks
Staff sickness and redundancy
What financial instruments can be used to finance risk as part of risk treatment?
Credit derivatives - cover the risk of a default of a corporate or sovereign borrower.
Weather trades or swaps - usually trades between two parties. Each side will pay the other in the event of a risk swinging in a positive or negative direction. One or other of the parties will pay all or a proportion of the financial loss, this is unlike insurance where one party assumes the loss for a premium.
Property derivatives- hedges against value of estate falling or rising.
Freight derivatives- over the counter trades where a basket of indices is used which comprises numerous factors influencing freight costs, including inflation.
Why is it necessary to secure Board endorsement of risk controls?
This ensures compliance and best practice, maximum support, exoneration of operational staff and knowledgeable reaction by the board to risk events as they occur.
How should risk data be collated? Give an example of a suitable and consistent process.
Risk data should be collated from risk registers, workshops, questionnaires, interviews and in depth studies. The key requirements are consistency and accuracy of reporting and uniform collation of data.
Who is responsible for monitoring the effectiveness of risk controls?
At a practical level operational staff are responsible for monitoring and reporting to senior managers on a regular basis or when the need may arise. This information is then passed to the Board which has ultimate responsibility.
Give an example of a system of reporting that allows the Board to quickly assimilate the status of risk controls.
A tragic light system accompanied by summary and an appendix with non compliance highlighted. Short and ideally visually easy reporting is preferred.
What circumstances would cause a business to reevaluate its risk controls?
A business would want to reevaluate its approach to risk controls in the event of a major loss, a near miss, a change in business circumstances, an acquisition or merger, or business cessation expansion or change in direction.
What factors govern the process of evaluating a risk and matching it to a suitable treatment option?
Cost Resourcing requirements Availability Feasibility Legality
A number of risks are traditionally dealt with using tried and tested solutions making the decision process straightforward.
Describe two types of revolving risk that impact on many organisations today.
Changing demographics.
Social unrest.
Contagious diseases - Ebola.
Cyber threats.
What is a BIA?
The BCI guidelines define business impact analysis (BIA) as “the process of analysing activities and the effect that a business disruption might have on them”.
It is the analysis phase of BCM where activities are drilled down and the effects a business disruption would have on them are examined in detail. It is generally a phased process covering strategic, tactical and operational issues.
Give an example of when a firm might decide to outsource a risk control.
An organisation might choose to outsource a risk control when it does not have the necessary specialists skills and can engage experts in the field - either before or after an event
