The risk management framework
Key takeaways
- Risk is the effect of uncertainty on objectives, and it can be negative (a threat) or positive (an opportunity).
- Risks are classified as strategic, operational, financial, compliance (legal) and reputational.
- The five risk strategies are avoid, reduce, transfer, accept and exploit; exploit is the one that applies only to an opportunity.
- The process runs from establishing the context through risk identification, analysis and evaluation to treatment, with monitoring and review, and communication and consultation, running throughout.
- Risk criteria, usually likelihood and impact scales, are agreed before risks are assessed so that every risk is judged on a consistent basis.
Risk is not always a threat, the same uncertainty that could produce a quality failure could equally produce an opportunity, so a mature quality management system treats risk management as a structured discipline, not just crisis avoidance.
Defining risk
Risk classification
Aims of risk management
- Protect and create value for the organisation
- Improve the quality of decision making under uncertainty
- Reduce the likelihood and impact of negative events
- Identify and capture opportunities as well as threats (see Defining risk)
- Support compliance with legal and regulatory requirements
Risk management statements
A risk management statement is the organisation's formal declaration of its commitment to managing risk, typically issued by top management, and sets the tone for how seriously risk management is taken throughout the organisation, the risk equivalent of a quality policy (see Quality Management System, on the classification of documents).
Policies and objectives
The risk management policy translates the statement into specific direction: what risk management is expected to achieve, how it fits with other management systems, and what is expected of staff at every level, from which measurable risk management objectives are then set.
Risk strategies
Processes and models
- Establishing the context
- Risk identification
- Risk analysis
- Risk evaluation
- Risk treatment (see the chapter on treating risks)
- Monitoring and review (see the chapter on monitoring and review), running throughout
- Communication and consultation (below), running throughout
Risk criteria
Risk criteria are the reference terms against which the significance of a risk is evaluated, typically expressed as likelihood and impact scales, agreed before risks are assessed so that different risks across the organisation are judged on a consistent basis rather than by individual judgement alone.
Roles, responsibilities and resources
- Top management: sets risk appetite and overall direction
- Risk owners: accountable for managing a specific identified risk
- Risk management function or coordinator: maintains the framework and processes
- All staff: identify and report risks encountered in their own work
Communication and consultation
Communication and consultation run throughout the risk management process, not as a single step, ensuring interested parties (see Quality Management System, on interested parties) understand the basis on which decisions are made and can contribute their own knowledge of risks the organisation might otherwise miss.
Implementation guidelines
- Integrate risk management into existing decision-making processes, not as a separate parallel activity
- Start with the most significant risks rather than attempting to cover everything at once
- Ensure top management visibly supports and participates in the framework
- Review and improve the framework itself over time, applying the same PDCA cycle used elsewhere
Self-check
(a) Define risk, and explain why it can be positive as well as negative. (3 marks)
(b) Name the five risk classifications and give one example of each. (5 marks)
(c) List the five risk strategies and state which one applies only to a positive risk (an opportunity). (6 marks)
(d) List the risk management process steps in order. (5 marks)
(e) Explain the purpose of risk criteria and why they are agreed in advance. (2 marks)
(f) A company decides to enter a new export market despite the currency risk involved, because the potential profit is judged to outweigh the risk. Which risk strategy does this illustrate? (2 marks)
Show worked answer
(a) Risk is the effect of uncertainty on objectives. It can be positive as well as negative because uncertainty can produce an opportunity (a positive risk) just as easily as a threat (a negative risk).
(b) Strategic risk (threatens high-level objectives); operational risk (day-to-day process or system failure); financial risk (cash flow, credit or market exposure); compliance risk (failing legal or regulatory requirements); reputational risk (damage to stakeholder perception).
(c) Avoid, reduce (mitigate), transfer (share), accept (retain), exploit. Exploit is the strategy that applies only to a positive risk, since it means deliberately increasing exposure to an opportunity.
(d) Establishing the context; risk identification; risk analysis; risk evaluation; risk treatment (with monitoring and review, and communication and consultation, running throughout).
(e) Risk criteria are the reference terms (typically likelihood and impact scales) against which the significance of a risk is evaluated. They are agreed in advance so that different risks across the organisation are judged on a consistent basis rather than by individual judgement alone.
(f) This illustrates the exploit strategy, since the company is deliberately taking on greater exposure to an opportunity it judges to be worthwhile, rather than avoiding, reducing, transferring or simply accepting the risk passively.
Exam tip
The five risk strategies (avoid, reduce, transfer, accept, exploit) are a favourite scenario question, note that 'exploit' is the one strategy that only applies to a positive risk (an opportunity), not a threat.