using the risk matrix a practical · pdf filepresentation purpose • at the end of this...
Post on 15-Mar-2018
216 Views
Preview:
TRANSCRIPT
Evans K. Luneta Assistant Director – Enterprise Risk Management, Bank of Zambia
@ the Radisson Blu Hotel, 28 August 2014, EMAIL: eluneta@boz.zm
1
USING THE RISK MATRIX – A PRACTICAL APPROACH A PRESENTATION
BY
22/08/2014 2
Definition of Key Risk Management
Concepts
Why Risk Management?
The Risk Management
Process
Risk Response Strategies
OUTLINE
Presentation Purpose
• At the end of this presentation, it is anticipated that Participants would:
22/08/2014 3
Know how to use the Risk Matrix (Heat Map) for decision making purposes
Appreciate the risk management process, in general
22 August 2014
This Section
DEFINITION OF KEY RISK MANAGEMENT CONCEPTS
Slide 5
Definition of Key Concepts Appetite, Risk: The amount of risk an entity is willing to
assume in the running of its business (or in pursuit of value) – (AS/NZS
4360:2004). It is determined and affected by Risk Attitude, which in turn is affected by perception.
Attitude, Risk: is a choice made by an individual or corporate
entity in the face of a particular risky situation, and is affected by a range of perceptual factors.
Comprises terms, such as:
Risk Averse: Uncomfortable with uncertainty, desire to avoid or reduce threats and exploit opportunities
to remove uncertainty. Would be unhappy with an uncertain outcome
Risk Seeking/taking: Comfortable with uncertainty, no desire to avoid or reduce threats or to exploit opportunities to remove uncertainty. Would be happy with an uncertain outcome
Risk Tolerant: Tolerant of uncertainty, no strong desire to respond to threats or opportunities in any way. Could tolerate an uncertain outcome if necessary
Risk Neutral: Uncomfortable with uncertainty in the long term so prepared to take whatever short-term actions are necessary to deliver a certain long-term outcome
Definition of Key Concepts
Control: an existing policy, guideline, procedure, manual, process, practice or any other action designed to reduce likelihood and impact of negative risks or enhance positive opportunities.
Risk: “The chance of something happening that will have an impact on
objectives” (AS/NZS 4360:2004). “The effect of uncertainty on objectives”
(ISO 31000:2009).
Always measured in terms of combination of likelihood (probability) and consequence (impact). Can be positive or negative risk. Risk therefore is inevitable in any business activity.
22 August 2014 Slide 7
Definition of Key Concepts (Cont’d).
Negative (Downside) Risk: probability that something bad might happen, e.g. falling ill, pandemic, flooding, terrorist attack, etc. (THREAT)
Positive (Upside) Risk: probability that actual events might turn out better than expected, e.g., sales volumes being higher than planned. (OPPORTUNITY)
Risk Management: the culture, processes and structures that are directed towards realising potential opportunities whilst minimising adverse effects. Risk management, therefore, is about minimising the threats posed by identifiable events, as well as, maximising benefits presented by future events.
Definition of Key Concepts (cont’d).
Risk Management Framework: The totality of the structures, methodology, procedures and definitions that an entity has chosen to use to implement its risk management process.
Risk Management Process: The systematic application of management policies, procedures and practices to the tasks of communicating, identifying, analysing, evaluating, treating, monitoring and reviewing risk.
Enterprise Risk Management (ERM): a structured and continuous process across the whole organisation for identifying, assessing, deciding on responses to and reporting on opportunities and threats that affect the achievement of its objectives (IIA, UK, 2004).
This Section
WHY RISK MANAGEMENT?
Strategic Risks
A B
Why Risk Management?
To identify, assess and manage business or strategic risks that could
hinder attainment of the desired Strategic Position B.
Risk Management –Drivers
Corporate Governance
RM Globalisation
Performance Improvement
Regulation
Operational Failures
Technology
Competition
Directing Management Focus
The case for Risk Management
More than ever before, the challenge for entities is to turn risk into reward in order to add value to the company. However, important issues to address include:
How to gather a holistic and accurate view of internal and
external risks impacting a company’s sustainability.
How to identify and treat risk portfolios and ensure that the internal control environment is well dimensioned.
12
The Case for Risk Management
How to accurately recognise threats and opportunities, and take appropriate measures to manage them.
How to embed risk management into business operations and corporate culture to enhance value.
13
This Section
THE RISK MANAGEMENT PROCESS
The Risk Management Process
Communicate and Consult
Monitor and Review
Establish
Context
Identify
the risks
Analyze the
risks
Evaluate
the risks
Treat the
risks
What are we
trying to achieve?
How do we keep them
under control?
Who should be involved in the
process?
Inherent Risk
(Potential)
Controls (Assessment of the
adequacy & effectiveness)
HE
ME
IE
Likelih
oo
d
and
Co
nse
qu
en
ce
Re
sidu
al Risk Exp
osu
re
Risk Action plans to improve controls in
order to reduce likelihood and consequence of risk.
=
AC
VL
P
UL
R
C
M
S
M
N
The Risk Assessment Process
L
M H VH VH
L M
H VH VH
VL
L M
H H
VL
VL
L M
M
VL
VL
L L M
17
The Risk Matrix – Allocation of risk control resources
Likelihood
(Probability)
Consequence (Impact)
Negligible Minor Significant Major Catastrophic
Almost certain L
M H VH VH
Very likely L M
H VH VH
Probable VL L M
H H
Unlikely VL VL L M
M
Rare VL VL L L M
1
2 5
4
3
18
The Risk Matrix POSITION 1: Rare & Negligible – Very Low Risks
Low likelihood of occurrence and low impact – No big deal!!! Requires minimal resources, since there is little or no ROI in controls (i.e. low
losses not worth of devoting huge resources to mitigate them)
POSITION 2: Almost Certain & Negligible – Low Risks
Interesting!! While the likelihood of occurrence is high (almost certain) the associated impact is low (negligible). If we assume a high likelihood is equivalent to frequent occurrences, the ‘low’ losses for individual risk events can over time add up to become ‘high’. If this is the case, BOX 2 can be a candidate for process improvement to find a way of reducing the frequency of occurrences.
The frequency of occurrence therefore should be taken into consideration in the
risk management decision making process in order to strengthen the risk control environment in the concerned business area.
The Risk Matrix POSITION 3: Probable & Significant – Medium Risks Type A
This should be addressed in any risk treatment programme The combined potential cost and likelihood of occurrence while not ‘high’, are still
significant enough that they should be addressed through allocation of adequate control resources to improve the process or operations.
POSITION 4: Rare & Catastrophic – Medium Risks Type B
Cause sleepless nights – ‘unknown-unknowns’!! Extreme/’black swans’/’long Tail’ events that are difficult to predict but are
capable of threatening the survival of a company. Present a huge challenge in deciding on proper allocation of control resources. Scenario planning Candidate for BCM Programme
The Risk Matrix
POSITION 5: Almost Certain & Catastrophic – High & Very High Risks
Don’t worry about these….. You are already out of business!! Departure Lounge! Requires most of the control resources (i.e., Establish a BCM Programme,
including Disaster Recovery (DR) mechanisms)
Practicality of a Risk Matrix
A risk matrix can be used to:
- determine whether or not a risk event needs treatment;
- determine priorities for risk treatment;
- link the risk rating with the level of management attention required;
- determine whether an activity should be undertaken, at all;
- determine whether an activity needs treatment;
- determine direction of risks;
- determine composite risk assessments for each activity and the overall institution; and
- assess the adequacy and effectiveness of the RM Framework.
The Risk Response Strategies Strategies for negative risks (threats):
Avoid. Discontinuing the activity, which gives rise to the risk (where this is practical);
Transfer. Instituting arrangements, such as, insurance, outsourcing, warranties, guarantees, BOOT, etc., that are aimed at shifting the burden of the risk to another party at a premium; and
Mitigate. Instituting corrective measures that are aimed at either adjusting the likelihood or the consequence so as to reduce the chances or the adverse impact of such negative outcomes.
The Risk Response Strategies
Strategies for positive risks (opportunities):
Exploit. Taking advantage of the prevailing conditions, resources,
and opportunities available in the operating environment;
Share. Sharing the risk by more than one stakeholder through mutual consent. Mechanisms include use of contracts, service level agreements, etc.; and
Enhance. Adjusting the likelihood of the opportunity to increase the chances of realising the beneficial outcomes and/or adjusting the consequences to increase the beneficial impact.
The Risk Response Strategies
Strategies for both threats and opportunities:
Accept. This strategy can either be passive or active. The most common active acceptance strategy is to establish a contingency reserve fund, including amounts of time, money, or resources to handle known or unknown threats or opportunities; and
Contingency planning. Develop contingency plans that would only be executed under certain predefined conditions, such as emergencies/disasters.
CONCLUSION
Conclusion
It is generally accepted that it is not possible to create a business that does not take risk. However, not all risks are desirable, as they may not generate returns, or those returns may be inadequate, or the risk simply does not fit in the corporate strategy.
Accordingly, the risk matrix is a simple yet powerful tool, which every manager should use to make appropriate and effective risk management decisions.
To this end, a risk matrix is a practical tool which every manager must know how to use and have in their decision making tool kit.
THANK YOU!
22/08/2014 27
top related