Risk-control strategies Flashcards
1 key reason for risk control:
and a secondary reason:
- Reducing exposure by managing probability and impact
- Using controls to help seize opportunities
Tools that reduce the probability of a loss event occurring by targeting the causes are known as:
Loss-prevention tools
Tools that reduce the impact of a loss event by targeting the effects are known as:
Loss-reduction tools
5 examples of loss-prevention tools
- IT system firewall
- No-smoking policy
- Segregation of duties
- Door locks
- Driver safety training
5 examples of loss-reduction tools
- Data backup arrangements
- Fire extinguishers
- Whistleblowing arrangements
- Burglar alarm
- Motor insurance
Why might multiple loss-prevention tools and loss-reduction tools be employed to control a specific loss event?
In recognition of the fact that events are the result of multiple causes and have multiple effects
How do loss-prevention and loss-reduction tools help orgs seize opportunities?
By protecting cash flows and therefore freeing up more case to exploit new tech, markets, etc.
The four / five Ts of risk control are:
- Tolerate
- Treat
- Transfer
- Terminate
- Take the opportunity
The five Ts of risk control - Tolerate (4)
- Accepting a risk and taking no formal action to control it
- Often the selected route if the risk exposure is within risk appetite
- Risk may be tolerated if necessary controls are too expensive or impractical
- Risk exposure should not be tolerated indefinitely, so toleration should be periodically reviewed and approved
The five Ts of risk control - Treat (2)
- Actions taken to manipulate exposure, either to mitigate threats or exploit opportunities
- Includes loss-reduction or loss-prevention tools
The five Ts of risk control - Transfer (3)
- Passing on the impact of loss events to a third party, by passing on:
- the financial impacts; or
- the financial and non-financial impact
- Financial impacts can be passed on via insurance providing indemnity (or equivalent)
- Financial and non-financial impacts can be passed on via a contract with a third party where third part will also provide the good or service (think outsourcing rather than doing in-house)
The five Ts of risk control - Terminate (2)
- Action taken to stop activity that is creating exposure/s
- Serious decision as it means potentially passing up valuable opportunities that were taken in pursuit of objectives
The five Ts of risk control - Take the opportunity (2)
- Option that may be chosen in respect of upside risks
- After taking an opportunity, important to use other controls to mitigate risks that taking opportunity brings
4 areas within which risk controls can be categorised:
PCDD
- Preventive (loss-prevention)
- Corrective (loss-reduction)
- Directive - enforcing desirable outcomes (loss-prevention)
- Detective (loss-prevention)
3 examples of preventive risk controls
- Staff training
- PPE
- Security arrangements
3 examples of corrective risk controls
- Fire extinguishers
- Disciplinary procedures
- Data recovery procedures
3 examples of directive risk controls
- Design and implementation of policies and procedures, such as on H&S
- Codes of conduct
- Assignment of roles and responsibilities
3 examples of detective risk controls
- Fire and burglar alarms
- Internal audits and compliance reviews
- H&S inspections
Other than preventive, corrective, directive, detective, a second way to categorise risks:
Formal - provide clear and tangible mechanism for control
Informal - social mechanisms of control
3 examples of informal risk controls:
- Soft skills training
- Team building
- Tone and action from the top
What do risk financing mechanisms help to do?
Fund the financial consequences of loss events
4 Ts of risk control - Treat - Link to risk financing (2)
Mitigating impact of event by:
- Risk fin. employed to protect cashflows from fin. impacts by ensuring loss events do not affect ability to meet liabilities by maintaining sufficient cash surpluses
- Cash funds can be used to minimise disruption following loss event by replacing lost items/staff, etc.
4 Ts of risk control - Tolerate - Link to risk financing
Loss events are more easily tolerable where finance is available pre-loss or can be obtained post-loss
4 Ts of risk control - Transfer - Link to risk financing (2)
- Risk transfer usually involves financial element, such as paying for insurance
- Transfer of non-financial risk will typically decrease profit margin through outsourcing
