Fundamentals of Risk Management

Understanding, Evaluating and Implementing Effective Enterprise Risk Management

Clive Thompson, Paul Hopkin

• Publisher: Kogan Page
• Year: 2021
• Print ISBN: 9781398602861
• eBook ISBN: 9781398602878
• Edition: 6
• Topic: Business
• Subtopic: Insurance
• Index: Business

Effective risk management allows opportunities to be maximized and uncertainty to be minimized. This guide for emerging professionals provides a comprehensive understanding of risk management with tools, tips and tactics on how to offer expert insights and drive success in an ever-changing area, covering everything from Covid-19 and digitization to climate change. Fundamentals of Risk Managemen t is a detailed and comprehensive introduction to commercial and business risk for students and risk professionals. Completely aligned with ISO 31000 and the COSO ERM Framework, this book covers the key principles of risk management and how to deal with the different types of risk organizations face. The frameworks of business continuity planning, enterprise risk management, and project risk management are covered alongside an overview of international risk management standards and frameworks, strategy and policy.The revised sixth edition includes brand new content on trends such as cyber risk, black swan events and climate risk. It has been fully updated to place the emphasis on seeing risk as 'positive' rather than a 'constant threat', and establishes that risk is different in a digital/VUCA age. Additionally, it considers in detail the impact of the climate crisis and its effect on risk management activities. Further updates from the previous edition include brand new case studies on the failure of Arcadia, HBO's bankruptcy and Boohoo's issues with modern slavery, this book provides a full analysis of changes in contemporary risk areas including digital risk management, risk culture and appetite, supply chain and statutory risk reporting. Supporting online resources include lecture slides with figures, tables and key points from the book

Part One

Introduction to risk management

LEARNING OUTCOMES

Having studied this section readers will be able to:

• Summarize the origins and development of the discipline of risk management, including the various specialist areas and approaches.
• Produce and articulate a range of established definitions of risk and risk management, and describe the efficacy of these definitions.
• Identify the characteristics of a risk in order to provide a full risk description and justify the inclusion of each item.
• Summarize the options for the attachment of risks to various characteristics of an organization and describe the advantages of each approach.
• Identify the features of compliance risks, hazard risks, control risks and opportunity risks.
• Explain the characteristics and benefits of enterprise risk management.
• Summarize the principles (proportionate, aligned, comprehensive, embedded and dynamic) and aims of risk management and its importance to strategy, tactics, operations and compliance.
• Describe the key outputs of risk management in terms of mandatory obligations, assurance, decision making and effective and efficient core processes.
• State the key features of the best-established risk management standards, including ISO 31000, the COSO ERM cube and the IRM standard.
• Describe the scope and importance of establishing the context as the first stage in the risk management process.
• Explain the importance of the relationship between the external context, internal context and the risk management context.
• Describe the key stages in the risk management process and the main components of a risk management framework.

Further reading

• Bernstein, P (1998) Against the Gods: The remarkable story of risk, Wiley, Hoboken, NJ
• Grenfell Tower Inquiry (2019) Phase 1 report, www.grenfelltowerinquiry.org.uk/phase-1-report
• Institute of Risk Management (2010) A Structured Approach to Enterprise Risk Management (ERM) and the Requirements of ISO 31000, IRM, London
• ISO (2009) ISO Guide 73:2009 Risk Management – Vocabulary, www.iso.org/standard/44651.html
• ISO (2018) International Standard ISO 31000:2018 Risk Management – Guidelines, www.iso.org/standard/65694.html
• Kloman, F (2009) A short history of risk management, Risk Journal, https://riskjournal.blogspot.com/2009/02/short-history-of-risk-management.html
• Pullan, P and Murray-Webster, R (2011) A Short Guide to Facilitating Risk Management, Gower Publishing, Aldershot

CASE STUDIES

The reader can review the following examples to illustrate further the areas discussed in Part One and throughout this book.

Ocado: Risk management process

Ocado is a delivery only internet-based grocery company based in the UK which also sells the intellectual property it has derived from its innovative software to other grocery companies, predominantly outside the UK. The Group’s annual report and accounts discuss risks, strategy, stakeholders, ethics and compliance, all of which form part of the discussion in this book. It provides a clear discussion of how their world of grocery retail is changing with digital enhancements.

The outline of their risk management framework states:

Ocado’s risk management process is designed to improve the likelihood of delivering our business objectives, protect the interests of our key stakeholders, enhance the quality of our decision making, and assist in the safeguarding of our assets, including people, finances, property and reputation.

They further clarify that ‘The Board is responsible for the review and approval of the risk management framework and for the identification of Ocado’s key strategic and emerging risks.’

They explain that their risk management process:

is designed to identify key risks and to provide assurance that these risks are understood and managed in line with the agreed risk appetite. The risk appetite is reviewed by the Board as part of its annual strategy review. The risk management process is aligned to our strategy and each principal risk and uncertainty is considered in the context of how it relates to the achievement of the Group’s strategic objectives.

The main significant risks they identify in this report include:

• the impact of Covid-19 on the Group;
• UK withdrawal from the European Union;
• technology;
• emerging risk such as climate change and the impact of this on our business.

Edited extracts from: Ocado Group plc (2020) Reimagining Shopping: Annual Report and Accounts for the 52 weeks ended 29 November 2020, www.ocadogroup.com/investors/annual-report

Lenovo Group: Significant risks and mitigations

Lenovo Group is a Chinese multinational company with global headquarters in Beijing and operational headquarters in the USA. It is listed on the Hong Kong Stock Exchange, and has 63,000 employees. It delivers technology solutions and is worth studying in light of the fast-moving applications it is developing and the environment in which it operates.

The following table is an edited extract of how they communicate through the annual report to discuss the key risks that they consider to be of significance, with some illustrations of the mitigation or controls that they apply.

Table 1.1

Skip table

Risk description	Key risk mitigations
Business risk
Market competition: they operate in ‘an industry which faces rapid changes in market trends, consumer preferences and constantly evolving technological advances in hardware performance, software features and functionality’.	In addition to monitoring market trends they discuss their ‘3S strategy (smart IoT, smart infrastructure and smart verticals) [to] protect and drive profitability’.
Cyber attack and security risk
‘The Group may be impacted negatively if it sustains cyber-attacks and other data security breaches that disrupt its ope...

Table of contents

• List of figures
• List of tables
• List of case studies
• Foreword by Stephen Sidebottom
• Acknowledgements
• Introduction
• Part One Introduction to risk management
• 01 What risk is and why it is important
• 02 Risk is an opportunity as well as a threat
• 03 Managing risk: The background, principles and aims of risk management
• 04 Risk management standards
• 05 Risk management in context
• Part Two Enterprise risk management
• 06 Enterprise risk management
• 07 Implementing enterprise risk management
• 08 The context for ERM
• 09 Setting objectives for ERM
• Part Three Assessment and analysis
• 10 Assessing risks: Considerations, causes and consequences
• 11 Classifying risks
• 12 Analysing risks: The dimensions of risk
• 13 Controlling the downside of risk
• 14 Maximizing the upside of risk
• Part Four Risk response
• 15 Managing and responding to risk
• 16 Risk treatment controls for hazard risks
• 17 Ongoing monitoring and review
• 18 Insurance and risk transfer
• 19 Surviving shocks and disruption: ERM, BCP and resilience
• Part Five Organizational environment
• 20 Business and the risk environment
• 21 The organization's business model, visions and values
• 22 How risk management adds value
• Part Six Risk strategy and culture
• 23 Risk architecture and strategy
• 24 Roles, responsibilities and documentation
• 25 Culture and behaviours
• 26 Risk appetite and tolerance
• 27 Risk training and communication
• 28 Risk practitioner competencies
• Part Seven Corporate governance and risk management
• 29 Introducing corporate governance
• 30 Stakeholders, ethics and corporate social responsibility
• 31 Different approaches to risk management
• Part Eight Risk assurance and reporting
• 32 The control environment
• 33 Internal audit activities
• 34 Risk assurance techniques
• 35 Reporting on risk management
• Appendix A: Abbreviations and acronyms
• Appendix B: Glossary of terms
• Index