Risk Identification Techniques

Question 1

Names (i) six negative risks and (ii) one positive risk.

Answer 1

NEGATIVE RISK:
- Fire.
- Workplace accident.
- Creditor/debtor default on loan.
- Recession.
- Cyber attack.
- Sudden reduction in consumer demand.

POSITIVE RISK: Sudden increase in consumer demand.

Question 2

Name five risk identification techniques.

Answer 2

1. Checklists - specific or macroscopic.
2. Focus groups - multi-disciplinary working groups.
3. Analytical approaches.
4. Expert judgement - reliant upon skills and expertise of specialists.
5. Physical inspections.

Question 3

What are the advantages and disadvantages of inspections?

Answer 3

ADVANTAGES:
- Visit undertaken by professional with relevant and specialist knowledge.
- Outcomes will usually include formal inspection report, including specific improvement recommendation to reduce the probability and impact of lossses.

DISADVANTAGES:
- Inspection of faults visible on examined day.
- Expensive.
- 3rd party risks not fully assessable by inspector.
- RM is ultimately employees’ responsibility, not the inspector.
- Erroneous view that risks are transferable to inspector.

Question 4

What are six advantages and disadvantages of using checklists?

Answer 4

ADVANTAGES:
- Cheap and efficient way of gathering information.
- Simple and easy to use.
- Capable of gathering information from a variety of sources.
- Capable of being tailored to accommodate different scenarios and requirements.
- Useful for updating information on current usage and monitoring future trends.
- Helpful to ensure compliance with prevailing risk management regulations.

DISADVANTAGES:
- May be used by someone not skilled in subject checklist.
- May be used someone unfamiliar with checklist objectives and ultimate usage of outputs.
- Possible over-emphasis on mere ‘form-filling’, rather than the purpose of the checklist.
- Checklist may be ambiguous to user.
- May be completed too quickly, with insufficient thought.
- Risk that form-filler may have reasons for suppressing risk information.

Question 5

What are analytical approaches to risk identification (and name four approaches)?

Answer 5

1. Analytical approaches use various research and logic structuring methodologies to make risk identification more scientific and minimise human error.
2. Techniques include:
   - Delphi technique;
   - Root cause analysis;
   - SWIFT (structured ‘what-if’ tests); and
   - System and process mapping.

Question 6

What are the five key characteristics of the Structured What-If Technique (SWIFT)?

Answer 6

1. Optimal for identification of health and safety, and environmental risks.
2. No standardisation approach.
3. Flexible.
4. Supported by checklists for potential risk events.
5. Efficient - avoids lengthy discussion on areas where risks known to exist.

Question 7

What are the eight key steps of the Structure What-If Technique (SWIFT)?

Answer 7

1. Definition of purpose and scope.
2. Assembly of stakeholder team and identification of objectives.
3. Collation of information, interviews and observations.
4. Breakdown into tasks/elements and formulation of ‘what-if’ questions.
5. Performance of checklist review for additional questions.
6. Response to questions.
7. Determination of additional controls.
8. Reporting of findings.

Question 8

What are the key characteristics of the Delphi Technique?

Answer 8

1. Information-gathering exercise used to achieve consensus of experts on a risk subject.
2. Each expert participates anonymously, via a facilitator, who uses a questionnaire to solicit responses.
3. Responses are summarised and recirculated to experts for further comments.
4. Consensus may be achieved in a few or many rounds.

Question 9

What are the

Question 10

What are the four principles of a root cause analysis?

Answer 10

Emphasis on investigating root causes of a hypothetical or actual risk event, with the following characteristics:

1. Identifies causes of the relevant risk event.
2. Establishes the timeline from the normal operations to the risk event.
3. Distinguishes between immediate causes and root causes.
4. Usage of results to improve controls and help manage future events.

Question 11

What are the characteristics of a system and processing mapping / issue tree?

Answer 11

1. Mapping of organisational systems and processes into flow charts.
2. Distills a complex, singular risk event into simpler component issues via tree.
3. The identified component issues may then be used to identify mitigating actions.

Question 12

What are the six forms of emerging risk?

Answer 12

P-olitical: Government stability; taxation; regulation infrastructure.
E-conomic: Growth; inflation; monetary policy; employment rates.
S-ocial: Income distribution; demography; education; lifestyle factors.
T-echnological: International influences; tech. transfer; R&D; communication.
E-nvironmental: Restrictions; climate change; energy savings; workforce health.
L-egal: Regional laws; court system; health and safety; law enforcement.

Question 13

What does a SWOT analysis comprise?

Answer 13

1. SWOT = Strengths; Weaknesses; Opportunities; Threats.
2. Comprises a tabular analysis of an organisation’s INTERNAL strengths (helpful) and weaknesses (harmful), and its EXTERNAL opportunities (helpful) and threats (harmful).

Question 14

What risk reporting does the World Economic Forum produce?

Answer 14

1. Annual WEF Global Risk Report provides a briefing on current and emerging areas of risk.
2. Top 5 increasing risks identified in 2020:
   - Economic confrontations amongst major powers;
   - Domestic political polarisation;
   - Extreme heatwaves;
   - Destruction of natural ecosystems; and
   - Cyberattacks.

Question 15

What does a qualitative risk assessment comprise?

Answer 15

1. Data is classified according to magnitude (1<2<3 and so on).
2. No standard of measurement between classification - it is not possible to discern how much bigger ‘2’ is in comparison to ‘1’ and so forth.
3. Classification values may be ascribed to risk probability, impact and exposure.

Question 16

What does a quantitative risk assessment comprise?

Answer 16

1. Predicated upon principles of STATISTICAL ANALYSIS to compute DISTRIBUTIONS for RISK PROBABILITY and IMPACT, combining the same to yield an OBJECTIVE ASSESSMENT of RISK EXPOSURE.
2. Quantitative risk assessments use HISTORICAL DATA (backward-looking).

Question 17

What does a hybrid approach risk assessment comprise?

Answer 17

1. Combination of quantitative and qualititative risk assessment techniques, often used for low probability-high risk events.
2. Provides a comparatively CONSISTENT and OBJECTIVE METHOD for risk assessment.
3. No SIGNIFICANT DATA DEPENDENCY.
4. Two key forms:
   - STRESS TESTING; and
   - SCENARIO ANALYSIS.

Question 18

What does stress testing involve and name five variables typically used for these purposes?

Answer 18

1. Assesses impact that EXTREME MOVEMENTS in KEY FINANCIAL VARIABLES may have, in isolation or together, upon an organisation - useful to gauge FINANCIAL STRENGTH.
2. Key assessment variables comprise:
   - Fall in INCOME;
   - Rising INFLATION;
   - Rising or falling INTEREST RATES;
   - CASH FLOW fluctuations; and
   - Sudden increase in COSTS.

Question 19

What does scenario analysis involve?

Answer 19

1. Scenario = outline, mode or description of risk events.
2. Relevant risk managers or experts determine PLAUSIBLE but EXTREME SCENARIOS an assess the IMPACT on the organisation (if the scenario arose).
3. May assess a SINGLE VARIABLE SCENARIO (e.g. instance of fraud).
4. Possible to evaluate a MULTIPLE VARIABLE SCENARIO (e.g. systems failure at critical business time when a strategic transaction requires execution).

Question 20

How do simple and complex risk registers differ?

Answer 20

1. SIMPLE risk register comprises:
   - Risk description;
   - Risk categorisation;
   - Risk owner;
   - Probability / impact; and
   - Risk controls.
2. COMPLEX risk register comprises:
   - Qualitative probability and impact assessments of inherent and residual risks;
   - Any maximum exposure limit assigned for residual risk exposure;
   - Pottential causes of risk event;
   - Information on potential (non-)financial impacts of the risk event; and
   - Metrics used to monitor exposure to risk event.

Question 21

What are four forms of risk reporting?

Answer 21

1. Loss and near miss databases: Events that have/could have caused financial/non-financial loss.
2. Narrative reporting: Explanation of how a risk exposure is changing (typically where there is no numerical data).
3. Risk, control and performance indicators: Different indicators and reports may be applied to different management levels; may also use R-A-G status.
4. Risk dashboards and balanced scorecards: Comprise risk reports that combine various risk and control indicators (e.g. heat maps, risk event and near miss data) concerning specific elements:
   - Financial performance;
   - Operational efficiency;
   - Human resources; and
   - Compliance.