Trainingmanualdoc2894
Upcoming SlideShare
Loading in...5
×
 

Like this? Share it with your network

Share

Trainingmanualdoc2894

on

  • 1,495 views

 

Statistics

Views

Total Views
1,495
Views on SlideShare
1,495
Embed Views
0

Actions

Likes
0
Downloads
43
Comments
0

0 Embeds 0

No embeds

Accessibility

Categories

Upload Details

Uploaded via as Microsoft Word

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

Trainingmanualdoc2894 Document Transcript

  • 1. RISKMANAGEMENT FORSMALL TOURISM BUSINESSES Training Manual
  • 2. Risk Management for Small Tourism BusinessesThis risk management training manual presents a systematic andcomprehensive approach to reducing the negative impacts from bothinternal and external events that may affect small tourism businesses.Specifically, this risk management training seeks to: - identify and develop processes to minimise the exposure and vulnerability of small tourism businesses to risks and hazards - enhance the capacity of small tourism businesses to undertake proactive risk and crisis management for timely response and recovery. Developed by Scott Cunliffe Written By Yetta Gurtner and Damian Morgan
  • 3. Conditions of UseSTCRC Copyright Statement and Conditions of Use hereDISCLAIMERThe STCRC endeavours to ensure the accuracy of all information contained herein andotherwise supplied. Advice or opinions given by STCRC in this publication or during thecourse of the relevant training provided by STCRC, represents the best judgement of STCRCbut (and to the extent permitted by law) STCRC accepts no liability for any claims ordamages whether caused by its negligence (or that of any of its agents or consultants) orotherwise. Advice should be obtained from qualified sources to address particular issues.
  • 4. An Introduction to theSustainable Tourism Cooperative Research Centre (STCRC)The Sustainable Tourism Cooperative Research Centre (STCRC) is established under theAustralian Government’s Cooperative Research Centres Program. STCRC is the world’sleading scientific institution delivering research to support the sustainability of travel andtourism - one of the world’s largest and fastest growing industries.The STCRC is a not-for-profit company owned by its industry, government and universitypartners.STCRC input…
  • 5. AcknowledgementsThe authors wish to thank all those who assisted in the production of this publication andassociated workshop material. Many people and agencies have freely given their time toprovide practical advice, support, and offer constructive criticism. If the following list is inany way incomplete, please be assured that it represents an oversight rather than a lack ofappreciation.APEC International Centre for Sustainable Tourism - Ian KeanCentre for Disaster Studies - Dr. Scott Cunliffe, Dr David KingEmergency Management Australia – Mike TarrantQueensland Tourist Industry Council - Daniel GschwindSustainable Tourism Cooperative Research Centre – Prof. Leo JagoSustainable Tourism Services - Stewart MooreTourism Tropical North Queensland – John McIntyreStraun & Associates - David BiermanOther Partners • Emergency Management Australia • Queensland Tourism Industry Council • Sustainable Tourism Services • Centre for Disaster Studies, James Cook University • Tourism Research Unit, Monash University
  • 6. Risk Management for Small Tourism Business One-Day WorkshopContents Page Foreword 1 A Brief Overview of the Workshop 2 Workshop Outline 4 Introduction to Risk Management for Tourism 6 Understanding Risk and Risk Management for Tourism 7 The Risk Management Process 16 The Business Context and Risks 20 Collaboration and Communication 21 Step 1. Establish the Business Context 26 Step 2. Identify the Risks 29 Risk Assessment and Treatment 33 Assessing the Risks 34 Step 3. Analyse the Risks 36 Step 4. Evaluate the Risks 40 Implementation 46 Step 5. Treat the Risks 46 The Risk Management Plan 50 Crisis Management 51 Crisis Management Planning 52 Appendix 1. Acronyms 64 2. References 65 3. Glossary 67
  • 7. 4. Authors 78
  • 8. Risk Management for Small Tourism BusinessesForewordThis training manual provides practical knowledge, understanding and skills for small tourismbusinesses to implement effective risk and crisis management.Tourism represents a highly complex, dynamic and competitive business environment. Toremain profitable, small enterprise must be able to successfully negotiate risks and challengeson a daily basis. Similarly, businesses need to be equally prepared for any unexpected crisisthat may affect business viability. A logical and systematic approach to risk and crisismanagement will reduce the impacts and losses associated with any adverse event.In the past decade, domestic and international tourism has endured a variety of environmental,political, and economic, challenges and disasters. While the global tourism industrydemonstrates remarkable resilience, the most significant impacts from these events aregenerally experienced at a local or regional level. Affected tourism businesses often struggleto maintain a profitable level of operation and market confidence. With few small tourismbusinesses adequately prepared to manage preventable risks and adversity, sound riskmanagement guidelines for small businesses and operators within the Australian tourismsector is considered a practical necessity.The information presented in this training program is referenced from a range of prominentrisk management publications and documentation including; Australian/New ZealandStandard for Risk Management (AS/NZS4630:2004), Small Business Standard(HB221:2004), Queensland Government Risk Training and various manuals produced byEmergency Management Australia. Practical feedback and guidance was also providedthroughout the development process by a broad-based tourism industry reference group andrisk management professionals.Risk Management Training for Tourism 8© COPYRIGHT STCRC
  • 9. Risk Management for Small Tourism BusinessesA Brief Overview of the WorkshopPurpose and ScopeRisk Management for Small Tourism Businesses is a practical risk management trainingprogramme for small Australian businesses (typically employing less than 20 people) engagedin tourism enterprise. This training package is designed specifically to equip participants withthe necessary knowledge, skills and confidence to coordinate effective risk managementpractice appropriate to the business environment.Overall learning objectives:The objectives of the workshop and training are: - to increase awareness and appreciation of the nature of risks and crises relevant to small tourism businesses; - to develop understanding and familiarity with the process of systematic risk management; - to promote active communication, networks and partnerships, and; - to enhance the capacity of small tourism business to effectively identify, mitigate and respond to adverse risk eventsTraining methodsThis manual has been developed to support and be used in conjunction with a one day riskmanagement training workshop. Additional materials include a resource book and websitematerial available at:http://www.The workshop is designed to blend formal instruction with practical activities, guidingparticipants through each step of the risk management process. Participants are encouraged totake notes and will be expected to apply their learning during discussions and group tasks.While these discussion sessions are intended to examine circumstances relevant to the smalltourism business environment, participants are under no obligation to discuss matters thatmay be commercially sensitive or confidential to any business and its practices.The outline and schedule for the workshop component is presented in the following pages ofthis manual.Risk Management Training for Tourism 9© COPYRIGHT STCRC
  • 10. Risk Management for Small Tourism BusinessesParticipant RequirementsTo fully benefit from this risk management training programme, participants areexpected to read this manual prior to attending the one day workshop.This preliminary task will require a commitment of two to three hours prior to the workshop.It is not expected that the information and processes will be fully understood at this stage.There will be ample opportunities throughout the workshop to discuss questions identifiedduring this preliminary reading.Guide to Symbols Practical exercise Risk Management Documentation (Reproduced in Practical Resource Guide)Risk Management Training for Tourism 10© COPYRIGHT STCRC
  • 11. Risk Management for Small Tourism Businesses Risk Management for Small Tourism Businesses Workshop – OutlineSESSION ONE 0830-1000INTRODUCTION TO RISK MANAGEMENT FOR TOURISM Understanding Risk and Risk Management for Tourism Defining Risk Risk Management Practice for Small Tourism Business Risk Management within day-to-day business operations Risk Management for the Tourism Industry Potential Risk to Tourism and Tourism Enterprise Activity ONE - Risk Recognition Activity TWO - Current Risk Arrangements Risk Management - The Process The Australian Risk Management Standard AS/NZS 4360 The Risk Management Process Planning to Manage Risks Defining Responsibility Producing a Risk Management Plan MORNING TEA 1000-1030SESSION TWO 1030-1200BUSINESS CONTEXT AND RISKS Communication and Consultation in Risk Management Identifying Stakeholders A Communications Plan Tourism Communications and Stakeholders Activity THREE - Key Stakeholders and Contacts Step1. Establish the Business Context Understanding the Context Defining Business Objectives Critical Environmental Factors Stakeholder Identification and Analysis Risk Measurement Criteria Step 2. Identify the Risks Understanding Risk Risk Identification Elements at Risk Scoping Vulnerability Risk Statements LUNCH TIME 1200-1300Risk Management Training for Tourism 11© COPYRIGHT STCRC
  • 12. Risk Management for Small Tourism BusinessesSESSION THREE 1300-1430RISK ASSESSMENT AND TREATMENT Assessing the Risks Conducting a Risk Assessment Step 3. Risk Analysis Information Gathering Review of Current Control Measures Likelihood of Occurrence Consequences of Occurrence Calculating the Level of Risk Step 4. Evaluate the Risks The Evaluation Process Tolerable and Unacceptable Risks Prioritising for Risk Treatment Activity FOUR – Developing a Risk Register Implementation Step 5. Treat Risks Risk Treatment Options Assessing and Developing Treatment Options Developing a Risk Treatment Schedule/Action Plan Implementation The Risk Management Plan Monitoring and Review AFTERNOON TEA 1430-1500SESSION FOUR 1500-1630CRISIS MANAGEMENT Crisis Management Planning Defining Crisis Understanding Crisis Management Crisis Management and Tourism Business Continuity Resource Identification The Four “Rs” of Crisis Management – A Practical Approach Crisis Communications (Containment) and Reporting Recovery and Marketing Developing a Crisis Management Plan for Small Tourism Business Activity FIVE – Proactive Crisis Management PlanningQUESTIONS AND DISCUSSION 1630-1700 END WORKSHOP 1700Risk Management Training for Tourism 12© COPYRIGHT STCRC
  • 13. Risk Management for Small Tourism Businesses SESSION ONE INTRODUCTION TO RISK MANAGEMENT FOR TOURISM Understanding Risk and Risk Management for Tourism Defining Risk Risk Management Practice for Small Tourism Business Risk Management within day-to-day business operations Risk Management for the Tourism Industry Potential Risks to Tourism and Tourism Enterprise Activity ONE - Risk Recognition Activity TWO - Current Risk Arrangements Risk Management - The Process The Australian Risk Management Standard AS/NZS 4360 The Risk Management Process Planning to Mange Risks A Risk Management Policy Statement Defining Responsibility Producing a Risk Management PlanRisk Management Training for Tourism 13© COPYRIGHT STCRC
  • 14. Risk Management for Small Tourism BusinessesINTRODUCTION TO RISK MANAGEMENT FOR TOURISMUNDERSTANDING RISK AND RISK MANAGEMENT FOR TOURISMMost people are familiar with the notion of risk. Individuals and businesses make choices anddecisions relating to risk on a daily basis. The risk may be associated with a planned tour, abusiness acquisition or the most advantageous way to arrange a display. The intent is toachieve the desired aims or objectives without things going wrong. Good decision making inthe face of risk is generally improved where accurate information, understanding, andexpertise is available.Risk management by small tourism businesses is a practical and systematic approach tomaking good decisions about risk. Based on a logical sequence of steps, it is a process ofstrategic planning and management that helps to identify, analyse, evaluate and treat potentialrisks. In practice, effective risk management should be a collective endeavour that isunderstood and exercised by all relevant personnel. To develop and coordinate such a systemof risk management in any business environment first requires an understanding andfamiliarity with the concept of risk.Defining risk Risk most commonly refers to the prospect of loss. This loss is usually some form of unwanted outcome or undesirable consequence from a specific action or occurrence.Risk is an intangible term generally associated with the dangers and uncertainties of life. In abusiness context, risk typically refers to the prospect of loss. More specifically, risk isassociated with circumstances that potentially result in a loss of business viability and/orprofitability.Like any enterprise, small tourism businesses face a diverse range of risks and uncertainty.Some of these risks affect multiple tourism businesses, such as: dramatic interest ratefluctuation; extremes of weather and climate, changes to legislation or variation in touristarrival numbers. Other risks like property theft, staff injury, or loss of customers might impacton a single or limited number of tourism businesses.Figure 1. The relationship between risk and a risk eventRisk Management Training for Tourism 14© COPYRIGHT STCRC
  • 15. Risk Management for Small Tourism Businesses Risk Event Cause RISK ConsequenceRisk is commonly connected with a cause and a consequence. The cause may representdirect physical exposure, dynamic pressures, unsafe conditions or defective business practice.Risk refers to the specific hazard or potential danger that has been identified. In this sequence,consequence relates to any impacts or affects if the risk eventuates. The entire succession, asillustrated in Figure 1., is known as the risk event. A risk event might refer to a businessactivity, a person’s behaviour or communications, an incident, or an environmentalphenomenon.Risk as a core principle in risk managementWith sufficient information regarding both cause and consequences it is considered possibleto measure the risk associated with a particular risk event. In this context, risk is gauged as aprediction or forecast (based on a likelihood estimate) of a given consequence (this iselaborated in Session 3). Judging the risk of an event assists in choosing appropriatebehaviours or actions to prevent or minimise potential loss. Effective risk recognition andanalysis constitutes the essence of good risk management decision making.Risk management practice for small tourism businesses When faced with risk events, effective risk management practices increase the likelihood of small tourism businesses reaching commercial goals and objectives.Planning risk managementBusiness planning is the process of developing strategies to achieve business goals andobjectives. Strategic business planning also involves a degree of assessment regarding risksassociated with future events. Such a level of planning typically incorporates flexible andadaptable strategies to address a range of potential situations or outcomes. Most successfulbusinesses acknowledge that any time taken to devise effective and comprehensive businessplans eventually pays for itself.Benefits of risk managementTaking a systematic and planned approach to manage risk provides numerous operationalRisk Management Training for Tourism 15© COPYRIGHT STCRC
  • 16. Risk Management for Small Tourism Businessesadvantages for any business: - estimating risk helps the business to understand the causes and consequences of a particular event; - well devised risk management plans prevent or reduce the severity and duration of a risk event . This can save both time and money; - a clear set of procedures assists in the timely identification and coordination of resources. This process helps minimise potential loss of life and property; - prepared and coordinated contingency plans enhance customer relationships ; and, - prepared communication strategies control the flow of critical information during and following the risk event. This prevents the release of incorrect or damaging information to stakeholders or the public.Effective risk management equates to both common sense and good business practice. Itprotects business profitability, promotes operational viability, complies with legal and socialresponsibilities, and, provides improved access to insurance. Risk management can alsopresents additional opportunities such as improved staff management and enhancedrelationships with customers and associated organisations.Costs of not managing riskAny comprehensive risk management process requires an investment of time, money, trainingand resources. Even so, risk management must be practiced, in some form, by all businesses.Routine safety practices, security procedures, contract negotiation and legal compliance allrepresent common risk management practices.Good risk management planning is designed to enhance existing capabilities and find the bestmethod to minimise the cost of risk to the business. To be effective, risk management shouldbecome thoroughly embedded within the business culture, practices and systems. Theconsequences of not being prepared for risk include: - endangering the health and safety of employees, customers, volunteers and participants; - damaging the business’s reputation, credibility and status; - undermining public and consumer confidence in the business; - jeopardising revenues and the business’s financial position; and, - damaging a business’s plant, equipment or the environment.Research and experience consistently demonstrates that the costs of not being prepared forsignificant hazards can prove devastating to business enterprise, income, resources and evenhuman lives.Risk management for the tourism industryEven though tourism may comprise a diverse range of products, activities, experiences andRisk Management Training for Tourism 16© COPYRIGHT STCRC
  • 17. Risk Management for Small Tourism Businesseslocations, it is essentially a service-based industry. Successful tourism enterprise is premisedon maintaining customer satisfaction, positive image and reputation, and confidence, inexisting levels of safety and security. Unfortunately for individual tourism businesses,offering a quality, safe and responsible operating environment does not always guaranteecontinued custom and profits. Due to the erratic nature of risk perception and association, thepoor service or adverse conditions of other businesses and destinations have the potential toaffect local enterprise. Tourism has consistently proven to be highly sensitive to externalshocks and threats. Table 1 demonstrates the diversity of potential risks to tourism andindividual tourism enterprises.While the steps required for risk management in the tourism industry are essentially the sameas for any other industry, the highly connected and interdependent structure of tourismpresents the individual business with some unique challenges and risks. To maintainsustainability and prosperity, small tourism businesses require both an intimate familiaritywith the specific business environment and its linkages to the wider tourism industry andcommunity.Risk Management Training for Tourism 17© COPYRIGHT STCRC
  • 18. Risk Management for Small Tourism BusinessesTable 1. Potential Risks to Tourism and Tourism Enterprise(Adapted from AS/NZS 4360) RISK CATEGORY/TYPE EXAMPLES Diseases Contagion affecting humans, plants and/or animals Economic Currency fluctuations, interest rates, share market Psychological/Emotional Negative image/perceptions, rumour, bad Association publicity, association with adversity, visitor dissatisfaction, unfavourable travel advisories Environmental Noise contamination, pollution, loss of biodiversity, erosion Financial Contractual risks, misappropriation of funds, fraud, fines Human Riots, strikes, sabotage, error, terrorism, violence, war Natural hazards Climatic conditions, earthquakes, bushfires, vermin, volcanic activity, tsunami Occupational health and Inadequate safety measures, poor safety safety management, deficient sanitation, low water quality Product liability Design error, substandard quality control, inadequate testing Property damage Fire, water damage, earthquakes, contamination, human error Professional liability Wrong advice, negligence, design error, misrepresentation Public liability Public access, egress and safety Security Cash arrangements, vandalism, theft, misappropriation of information, illegal entry, crime Technological Innovation, obsolescence, explosions, accidents and dependabilityRisk Management Training for Tourism 18© COPYRIGHT STCRC
  • 19. Risk Management for Small Tourism Businesses Activity ONE - Risk RecognitionObjective:To recognise the number and variety of risks that may potentially affect small tourismbusiness operations.Having developed a familiarity with the generic concept of risk, risk events and therelationship of risk management to small tourism business, such risks should be understoodwithin a more practical context.Risk events can clearly have a wide impact across an entire tourism sector, a geographicregion, or may be confined to a particular business. Regardless of magnitude, to remain viablea small tourism business must learn to successfully negotiate and manage such risks. Beforeconsidering a more formalised approach to the risk management process, it is important toidentify and appreciate some of the key risks to a small tourism enterprise.Task:Given the table of Potential Risks to Tourism and Tourism Enterprise provided (Table 1),consider some of the common (and less common) types of risks faced by small tourismbusinesses. In small groups (3-4) share and discuss what you consider to be some of the mainrisks (or risk events) that may affect profitability or viability in your business environment.Also include risks that are currently managed or controlled.Group findings will be shared with the other workshop participants to develop a wide-ranginglist of relevant risks.On the basis of this workshop discussion use the table below to outline five risk events thatpose a significant and/or likely threat to current business operations (try including risks youdid not think of yourself). Identify any existing control or mitigation strategies in the leftcolumn.Risk event (be as specific as possible) Control/loss mitigation strategy1.2.3.4.5.Notes:Risk Management Training for Tourism 19© COPYRIGHT STCRC
  • 20. Risk Management for Small Tourism Businesses________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________Risk Management Training for Tourism 20© COPYRIGHT STCRC
  • 21. Risk Management for Small Tourism Businesses Activity TWO - Current Risk ArrangementsObjective:To determine the scope of current business risk management practice and develop familiaritywith the idea of actively thinking about, planning for and managing risk.Every business practices some form of risk management. This can include mandatorycompliance with occupational health and safety legislation, routine security procedures, orinsurance carried in the event of damage to property or personal injury. The types of risksfaced by individual tourism businesses and the methods used to manage them, however, canvary greatly. The range of significant or influential business factors include: - The nature of the business; - Size and scope of business operations; - The type and number of partnerships with other organisations; - Level of risk awareness and perceptions among owners, managers and employees; - Attitude to risk events held by owners, managers and employees; - Knowledge of suitable options to control risks and minimise loss; and, - Availability of finance and access to resources.Your task:From the list you developed in Activity One, examine your notes on current measures ofcontrol and mitigation for each risk event. Identify and list below alternative approaches orways in which such strategies may be improved.Risk event Current control or loss Suggested improvement or mitigation strategy alternative strategies1.2.3.4.5.The merits and constraints to such risk control and mitigation strategies will be discussed bythe workshop group.Risk Management Training for Tourism 21© COPYRIGHT STCRC
  • 22. Risk Management for Small Tourism BusinessesNotes:________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________Risk Management Training for Tourism 22© COPYRIGHT STCRC
  • 23. Risk Management for Small Tourism BusinessesRISK MANAGEMENT - THE PROCESSWhile there are a variety of international approaches to formal risk management, most employsimilar elements and/or processes. In Australia, the pre-eminent guide is AS/NZS 4360. Thistraining manual remains consistent with this Australian standard.The Australian Risk Management Standard AS/NZS 4360The Australian Risk Management Standard AS/NZS 4360 and associated handbook HB436were developed in response to a perceived need for practical assistance in applying riskmanagement in public and private sector organisations. Providing a logical and systematicguide for managing risks, it has become one of the most popular Standards in publication, andhas since been adopted by the Australian Government, Emergency Management Australia anda range of large public and multinational companies.The Risk Management ProcessConsistent with AS/NZS 4360, the risk management process can be outlined as a series ofiterative steps, completed for each risk management development cycle. At each progressivestep it is important to communicate, consult, monitor and review decisions made. To assist inunderstanding and continuous improvement, the process should also be carefully recorded anddocumented throughout. Risk management is a continuous process within business, requiringregular reviews and updates to reflect changing circumstances.The five key steps and associated tasks to this process are:Step One – Establish the context or current situationProfiles the situation and key variables associated with a business internal and externaloperational environment.Step Two – Identify the risksCreates an inventory of risk events that may directly or indirectly influence businessprofitability and/or viability (when, where, how, why).Step Three – Analyse the RisksGathers information about the risk event and current risk control strategies to determinelikelihood and consequences.Step Four – Evaluate the RisksCompares analysed risk events to provide a guide to action.Step Five – Treat the RisksDevelops cost efficient and effective risk event control measures and risk mitigationstrategies.Risk Management Training for Tourism 23© COPYRIGHT STCRC
  • 24. Risk Management for Small Tourism BusinessesFigure 2. The Risk Management Process (Adapted from AS/NZS 4360) STEP 1. STEP 5. ESTABLISH TREAT THE THE RISKS CONTEXT COMMUNICATE CONSULT DOCUMENT MONITOR STEP 4. REVIEW STEP 2. EVALUATE IDENTIFY THE THE RISKS RISKS STEP 3. ANALYSE THE RISKSRisk Management Training for Tourism 24© COPYRIGHT STCRC
  • 25. Risk Management for Small Tourism BusinessesPlanning to Manage RisksRather than waiting for something to happen, risk management is designed to be proactive -effective planning and implementation can prevent avoidable damages and loss.A Risk Management Policy StatementFormal commitment to a systematic risk management process is often established andcommunicated to relevant stakeholders in a Risk Management Policy Statement. Intendedto be incorporated with a business’s general management strategies this document brieflyoutlines: - the intention/rational of the policy; - scope, issues and resources available; - details of implementation; and, - linkages with other business strategies.Figure 3. illustrates the integration of key elements within a general risk management policy.Defining ResponsibilityAlthough developing and implementing an effective risk management plan should be acollaborative and consultative effort, the duty is often assigned to a specific person or riskmanagement team. Specific functions and responsibilities may be officially documented in aRisk Management Responsibility Statement. Tasks generally include awareness raising,preparation, coordination, implementation, management and accountability. Additionally thisrole or document outlines risk management responsibilities and functions (including amonitoring and audit statement)Producing a Risk Management PlanThe final product of a systematic risk management planning process is the establishment aRisk Management Plan. This plan will contain (but is not confined to): - a statement of the business risk management policy - an outline of risk management responsibilities and functions (including a monitoring and audit statement) - a communication plan/strategy - a description of the business context, objectives, risk environment and criteria - a risk register of risks identified and assessed - a treatment plan for major risksEach component of a basic risk management plan will be identified and elaborated during thistraining program. While this manual and workshop only provide the foundation fordeveloping a systematic risk management process, templates, references and generic contentguides for associated documentation have also been reproduced in the supplementaryRisk Management Training for Tourism 25© COPYRIGHT STCRC
  • 26. Risk Management for Small Tourism BusinessesPractical Resource Guide.Risk Management Training for Tourism 26© COPYRIGHT STCRC
  • 27. Risk Management for Small Tourism BusinessesFigure 3. General Risk Management Policy (adapted from Wilkes and Moore 2003 and HB ) Overall Policy Statement Overall Policy Statement Overview and intention of general business risk management policy Overview and intention of general business risk management policy Objectives Issues and Scope Resources Objective/rationale of the policy Range of policy issues/extent of risks that Risk management coordinator/team/roles statement need to be managed Cost/source of required finance Relationship to future development plans Level of support and expertise Link Acceptable Risk Linkage with business/strategic plan Level of acceptable risk likelihood and consequences for business Documentation Review and Monitoring Level of documentation/format Communicate the Policy Responsibility for monitoring/ Storage/distribution/accessibility/ Communication of policy statement audit/review/reporting confidentiality Integration of risk management policy Schedule review/revision of policy Date/authorship/approval/circulation Education/awareness/motivation Key performance indicatorsRisk Management Training for Tourism 27© COPYRIGHT STCRC
  • 28. Risk Management for Small Tourism Businesses SESSION TWO THE BUSINESS CONTEXT AND RISKS Communication and Consultation Communication and Consultation in Risk Management Identifying Stakeholders A Communications Plan Tourism Communications and Stakeholders Activity THREE – Key Stakeholders and Contacts Step 1. - Establish the Business Context Understanding the Context Defining Business Objectives Critical Environmental Factors Stakeholder Identification and Analysis Risk Measurement Criteria Step 2. Identify the Risks Understanding Risk Risk Identification Elements at Risk Scoping Vulnerability Risk StatementsRisk Management Training for Tourism 28© COPYRIGHT STCRC
  • 29. Risk Management for Small Tourism BusinessesTHE BUSINESS CONTEXT AND RISKSCOMMUNICATION AND CONSULTATIONCommunication and Consultation in Risk Management Communication is the provision and/or exchange of information between individuals (e.g. annual report, press statement) Consultation is a process of informed communication or discussion between individuals prior to making a decision, (e.g., staff meeting, supplier negotiation, industry convention)The essence of good risk management is decisions and action. Regardless of the size of thebusiness or organisation, there are a range of individuals who influence, or are affected by anydecisions on risk management. Familiar tourism stakeholders include employees, customers,industry partners, destination marketers, suppliers and/or service providers. Whenconsidering risk, stakeholders will often hold various and divergent values, experiences,knowledge, beliefs, assumptions, needs, concerns and opinions. This necessitates opencommunication and consultation throughout the risk management process.Communication and consultation implies a level of discussion or engagement withstakeholders, rather than a singular “top down” decision making approach. Activestakeholder participation assists in a broader identification and understanding of risk, andprovides a valuable resource base of information and expertise. The conscious appreciationof all potential risks assists a business to develop suitable and effective risk control strategies.Identifying stakeholders Stakeholders are those people and organisations who may affect, be affected by or perceive themselves to be affected by, a decision, activity or riskThe tourism industry is highly integrated and interdependent. Stakeholders affected by therisk management plan should be communicated with or consulted about risk related decisionsand actions. The method used to consult and communicate will vary according to the type ofRisk Management Training for Tourism 29© COPYRIGHT STCRC
  • 30. Risk Management for Small Tourism Businessesdecision, stakeholders affected, and stage or step of the risk management plan.Communication between management and business employees should include a series of faceto face meetings to devise and review the risk management plan. Customers need to beadvised of any specific risk or danger involving the business. Secondary suppliers or partnersmay be simply provided with written information detailing the action to be taken by thebusiness when faced with a particular risk event. Any risk management plan should also besubject to professional scrutiny to ensure compliance with legal responsibilities and insurancerequirements.While tourism remains a competitive business, selected risk partnerships or alliances can beadvantageous in risk management. To maintain business operations or finance recoverymarketing campaigns in adverse situations it is not uncommon for a group of small tourismbusinesses to combine available resources. Partnering with peak industry bodies andemergency management services also provides direct access to extensive practical knowledgeand expertise. Other external stakeholders that can be prominent in risk management includelocal government, legal advisors, community/special interest groups and the general public.In addition to such relationships, media management arrangements (public relations) areconsidered crucial in effective tourism risk communication and consultation. The media,including radio, print, television, internet (and any promotional literature), represents asignificant risk management stakeholder. Businesses should establish an ongoing workingrelationship with local and regional media networks. It is also important to identify andmaintain a designated media spokesperson for the business. This facilitates the distribution oftimely, accurate and credible information to media sources.Table 2 illustrates the number and diversity of stakeholders that may be influential in atourism business risk management and communication process. The double-headed arrowssignify that communication should be a two-way process.A Communications PlanAn efficient communication and consultation process entails the development of a riskcommunication plan relevant to internal and external stakeholders. The approach taken canbe informal or documented in great detail; however, it must be able to address risk eventissues and the response process. Additionally, small tourism businesses must be adequatelyprepared to counter any perceived risks or indirect negative associations.A typical communication plan will include the following elements:1. The purpose or goal for the communication.2. The specific target audience and designated spokesperson3. The communication strategy (including timings(4. Methods to evaluate the effectiveness of the strategyRisk Management Training for Tourism 30© COPYRIGHT STCRC
  • 31. Risk Management for Small Tourism BusinessesFigure 4. Tourism Communication and Stakeholders INTERNAL COMMUNICATIONS Clients Employees Management (tourists, visitors, (full-time, part-time, (owners, investors, residents) casual staff, administration, volunteers and operators) families) TOURISM BUSINESS Suppliers and Media Financial and Contractors (mass media, Insurance (goods and services) promotion and Organisations marketing) Local Government Local and Private Sector Community/Public and Source Markets Industry Emergency Other Partners/Tourism Services (legislative/ Organisations (Local, State, regulatory authorities, Commonwealth) government) EXTERNAL COMMUNICATIONSRisk Management Training for Tourism 31© COPYRIGHT STCRC
  • 32. Risk Management for Small Tourism Businesses Activity Three - Key Stakeholders and ContactsObjective:To identify the key stakeholders and contacts necessary to establish good risk managementpractice in your business.Depending on the size and nature of the business, certain individuals or organisations may beconsidered more relevant to shaping the specific risk management process. These keystakeholders are normally those that are regarded as essential to maintain business operationsand profits – under any conditions.Task:Based on current business operations, and the communications diagram provided (Figure 4.),identify and list at least 3* of the internal and external stakeholders that you would considermost significant in: a) identifying the risks and potential solutions at your business (Risk Identification) b) assisting to treat and minimise risks (Risk Mitigation/Treatment) c) aiding response and recovery from a significant event (Response and Recovery) Internal Stakeholder External Stakeholder (specific individual, position/role (specific individual, position/role or representative body) or representative body)Risk Identification(who can help identify relevantrisks and possible solutions)Risk Mitigation/Treatment(who can help prevent or reducethe risks identified )Response and Recovery(who can help your businessrespond and recover faster if a riskevent occurs)*some stakeholders may be relevant in more than one categoryGiven that such stakeholders will normally form the foundation of your risk and crisiscommunication plan, the workshop group will discuss ways to expand existing relationshipsand networks to promote or enhance a comprehensive risk consultation process.Risk Management Training for Tourism 32© COPYRIGHT STCRC
  • 33. Risk Management for Small Tourism BusinessesNotes:________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________Risk Management Training for Tourism 33© COPYRIGHT STCRC
  • 34. Risk Management for Small Tourism BusinessesSTEP 1. ESTABLISH THE BUSINESS CONTEXTUnderstanding the ContextEffective risk management must consider what is at risk. The first logical step in a riskmanagement process is to define the context or the environment in which the businessoperates.The context is essentially a background description of the business and its activities. Itprovides a basic understanding or awareness of business operations. The major elements fordescribing the context are the business core activities; business objectives; critical businessfactors; stakeholder identification; and the risk measurement criteria.Core business activitiesBusinesses are typically engaged in a range of core activities. Examples from the tourismindustry include providing accommodation, planning group tours, or the sale of souvenirs.Depending on the extent of business operations it may be necessary for risk managers todefine a risk context for each activity.Defining business objectivesBusiness objectives specify key business outcomes. As anticipated aims or goals, outcomesshould relate directly to the core business activities. Many businesses will find that thesedetails may already be outlined in existing documents such as the business plans, budget orstrategic plans.Critical factors of the business operational environmentA range of factors operating inside and outside the business influence its success, viabilityand profitability. Such factors may be arranged under the broad categories of business, social,economic, legal, technical or environmental. Some factors will be linked to the internalbusiness environment (e.g., staffing, operating procedures and service quality). Whilebroader external factors such as political instability, competition or legislative changes arenot directly controlled by the business, their influence must be considered in comprehensiverisk management planning.Stakeholder identification and analysisConsistent with the development of an effective business communications strategy(previously discussed) risk management identifies relevant stakeholder needs, concerns andopinions. Such a process promotes and facilitates broader acceptance of risk managementdecisions.Risk Management Training for Tourism 34© COPYRIGHT STCRC
  • 35. Risk Management for Small Tourism BusinessesRisk Measurement CriteriaBusinesses should develop a set of standards that establish the acceptable (and unacceptable)level of risk (these are often expressed as statements). These criteria create a base line fordefining likelihood (how often) and associated consequences that are deemed acceptable forthe specific business.Likelihood criteria may consider : - risk frequency (chance and rate of occurrence) - degree of risk escalation i.e. acceptable level of adverse consequences if appropriate action isn’t taken or the cumulative effect of multiple events - manageability e.g. existing capability resources, readiness, skills and knowledge - uncertain or latent riskParticular risk consequences or scenarios can be used to outline acceptable/unacceptablethresholds. Examples include: - human and social factors e.g. fatalities and serious injuries, loss of income, loss of livelihoods - economic factors e.g. damage to facilities or critical infrastructure, business disruption, loss of staff, loss of markets and business opportunities - environmental factors e.g. damage to cultural and heritage sites, damage to ecological sites, pollution - legal factors e.g. litigation relating to statute, regulatory, insurance and common law - tourism industry factors, e.g. loss of image and reputation eg. loss of customer satisfaction, negative publicity/associationRisk measurement criteria can represent a set of minimum acceptable standards or beexpressed as critical performance measures.For example:The risk of serious injury or death is not acceptableActivity will be discontinued in temperatures of 38 degrees Celsius and above.The tour activity will have no harmful impacts on the National ParkRisk Management Training for Tourism 35© COPYRIGHT STCRC
  • 36. Risk Management for Small Tourism BusinessesEstablish the Context – Sample Template (adapted from Queensland Government: 2005) Description of activity (What is the activity I want to risk-manage?) Objectives (What outcomes do I expect from this activity?) Critical Factors Business (What are the critical factors related to the activity?) Political Social/ Cultural Economic/ Financial Legal/ Regulatory Competitive Infrastructure/ Technology Environmental Other Stakeholders (Who are the stakeholders in the activity?) Internal External Risk evaluation criteria (What are the key risk criteria for identifying whether a risk is acceptable or not?)Risk Management Training for Tourism 36© COPYRIGHT STCRC
  • 37. Risk Management for Small Tourism BusinessesSTEP 2. IDENTIFY THE RISKSUnderstanding Risk PerspectivesThe way risk is understood directly influences the decision making process. For manyreasons, people will understand and interpret the same risk in different ways. Commonvariations relate to: individual risk perceptions; attitudes regarding voluntary and involuntaryrisks; and, a personal appreciation of what is acceptable risk.Risk Perceptions and TourismMost tourism businesses and activities are subject to a range of obvious risks that threaten tocompromise life, property and environment. These are common hazards or behaviours whichmay be limited, regulated or controlled to some degree. Yet as an industry dependant onpositive image, reputation and consumer confidence, tourism has proven to be particularlysensitive to risk perception. Risk perception is the appraisal of a risk situation based onintuitive judgement, personal experience and acquired information. To remain profitableand competitive, tourism risk management decisions and actions must account for significantthreats and intangible risks, such as rumour, risk association and misinformation. Mass mediacan play a substantial role in either escalating or reducing public risk perceptions.Voluntary and Involuntary RisksAlthough public acknowledgement of risks may seem contrary to the relaxed, carefree cultureassociated with travel and tourism, there is a moral and legal obligation for businesses toinform clients and stakeholders of known risks. Responsible risk management furtherendeavours to minimise unnecessary or involuntary exposure to possible danger. Airlinesafety messages, adventure tourism standards, and hazard awareness signage each represent asystem of voluntary and informed risk.Acceptable and Unacceptable RisksAn acceptable risk is one in which an informed decision has been made to accept thelikelihood and consequences of a particular risk. In some cases, benefits or opportunitiespresented by a particular risk (e.g., borrowing capital for a new business venture) are judgedto outweigh the potential losses. From a business perspective an unacceptable risk is anyevent or latent risk that can have significant adverse impacts, demanding a degree ofmanagement or mitigation.Risk IdentificationHaving established the context, relevant business factors and key objectives, the next stage inthe risk management process is to identify and describe the risks. Risk identification has fourmain components: source of risk; risk information; risk elements; and vulnerabilityassessment.This process should be as thorough as possible because any risk that is not identified duringthis stage can later pose a significant threat to the business.Risk Management Training for Tourism 37© COPYRIGHT STCRC
  • 38. Risk Management for Small Tourism BusinessesSource of Risks A hazard is the origin or source of riskEvery conceivable risk has an identifiable source and cause (a what and why). Significantrisk events can usually be traced back to a specific hazard. To identify risks to a business’sactivities and objectives, it is necessary to examine all situations or conditions where there isa potential for loss, harm and negative impacts.Identification of potential risk eventsTo develop a thorough list of business risks requires detailed knowledge and familiarity withthe business activities being reviewed. This essentially represents a description of what canhappen to the business and how. The method of identifying risks may vary depending on thenature of activities, types of risks, context and purpose of the risk management process.Common approaches include: - past experience (individual, stakeholder, regional, government, industry etc) - historical records (previous incidents, hazard zoning, newspapers, journals etc) - direct observation, audit and physical inspection - scenario planning (hazard mapping, develop and analyse specific scenarios etc) - brainstorming (interviewing, group and/or stakeholder discussions etc), - checklists (relevant research, publications, insurance policies etc) - flowcharts (graphical representations) - expert analysis (professional consultants, industry specialists, professional organisations etc)Depending on the specific nature or type of risk under deliberation it may also be necessary toinvestigate certain variables related to the risk event such as: - spatial distribution (the area that a hazard may impact, extent and scope); - temporal distribution (warning time, frequency, likelihood, time of day/week/year/season, duration); - intensity (how big, fast, powerful); and, - manageability (what can be done about it/mitigation/associated costs).Risk Elements An element at risk is something that is valued within/by the business 38Risk Management Training for Tourism or© COPYRIGHT STCRC which is associated with the source of risk. community This includes people, property, public perception or the environment
  • 39. Risk Management for Small Tourism BusinessesPerceptions or opinions on the elements at risk in any business and its environment can varyfrom stakeholder to stakeholder. In identifying potential risk impacts and implications it isimportant to investigate and examine all available perspectives. From a small tourismbusiness perspective significant elements may include personnel/clientele, criticalinfrastructure, services or facilities, and reputation.Vulnerability AssessmentA vulnerability assessment identifies current measures or controls that have beenimplemented to mitigate any risk event and associated impacts. As a scoping exercise itassists to determine the chance of being affected by a particular hazard, existing capabilities,and provides an understanding the current capacity to recover from resulting adversity. Thisshould consider risks that may by endemic to the business and impacts from external events.Risk StatementsThe collective aim of the risk identification process is the generation of credible and realisticrisk statements which describe risk events relative to the business context. A risk statementreveals the interaction between an identified risk source and the elements at risk.Example:Source of Risk Risk Event Elements at RiskEnvironment Direct impact of > Category Staff, Clients, Plant, 3 tropical cyclone Destination/Environment(Natural Hazard Exposure)Human behaviour Customer slips on stairs of Client (may also impact on business business insurance and legal(OH&S) policies)Although not all risk variables can be controlled, early identification provides the opportunityto appreciate and manage any potential impacts.Risk Management Training for Tourism 39© COPYRIGHT STCRC
  • 40. Risk Management for Small Tourism BusinessesRisk Identification – Sample Template (adapted from Queensland Government: 2005) Source of Risk Risk Event/ Statement (How can a risk arise?) (What can happen - event that may impact on the desired objectives?) Human behaviour Health/medical Psychological/Emotional Association Technology and technical issues Economic Occupational health and safety/Regulations Legal (Liability) Product/Professional/Public Political Property and equipment Safety/Security Environmental/Physical Financial/market/competitio n Natural eventsRisk Management Training for Tourism 40© COPYRIGHT STCRC
  • 41. Risk Management for Small Tourism Businesses SESSION THREE RISK ASSESSMENT AND TREATMENT Assessing the Risks Conducting a Risk Assessment Step 3. Analyse the Risks Information Gathering Review of Current Control Measures Likelihood of Occurrence Consequences of Occurrence Calculating the Level of Risk Step 4. Evaluate the Risks The Evaluation Process Tolerable and Unacceptable Risks Prioritising for Risk Treatment Activity FOUR – Developing a Risk Register Implementation Step 5. Treat the Risks Risk Treatment Options Assessing and Developing Treatment Options Developing a Risk Treatment Schedule/ Action Plan Implementation The Risk Management Plan Monitoring and ReviewRisk Management Training for Tourism 41© COPYRIGHT STCRC
  • 42. Risk Management for Small Tourism BusinessesRISK ASSESSMENT AND TREATMENTASSESSING THE RISKSConducting a Risk AssessmentRisk assessment is the central component of risk management. This endeavour requires thateach identified risk event is analysed and evaluated in relation to likelihood (frequency orprobability) and consequence (the impacts). Reviewing any control measures that may be inplace, this process helps to systematically separate minor acceptable risks from the majorrisks that must be managed.Methods used for risk assessment vary in rigour and sophistication. The most suitable orappropriate type depends on a variety of factors including the nature of the risk, theinformation available, and accessible resources. Regardless of the method adopted, effectiverisk assessment relies on sound judgement, common sense and the application of valid andlogical techniques. To assist in common understanding and management accountability theapproach used should be clearly documented throughout.Risk assessment essentially guides the business decisions on the most appropriate and costeffective way of dealing with an identified risk. Within a formal risk management process itis conducted in two stages: - risk analysis - risk evaluationFigure 5. illustrates the process of risk analysis, risk evaluation and subsequent decisionmaking towards effective risk treatment.Risk Management Training for Tourism 42© COPYRIGHT STCRC
  • 43. Risk Management for Small Tourism BusinessesFigure 5. Risk assessment as a guide to treatment decisions(Adapted from AS/NZS 4360) RISK ANALYSIS Establishes likelihood and consequences of a risk event RISK EVALUATION Deliberates calculated level of risk RISK Communicate TOLERABLE/ NOT Consult ACCEPTABLE Document ACCEPTABLE RISK Monitor Review TREAT RISK Decides most appropriate and cost effective treatment methodRisk Management Training for Tourism 43© COPYRIGHT STCRC
  • 44. Risk Management for Small Tourism BusinessesSTEP 3. ANALYSE THE RISKSEffective analysis of each identifiable risk comprises of several elements: informationgathering; review of current control measures; likelihood of occurrence; consequence ofoccurrence; and, calculating the level of riskInformation gatheringTo make an accurate assessment of either likelihood or consequences requires detailedinformation and appreciation of the potential risk event. Relevant data sources can includepublished literature from industry associations, insurers, government authorities and theinternet. Additional information may be accessible from company records, managerexperience and appropriate industry expertise. Critically appraised on criteria such asaccuracy, validity, applicability, relevance and currency (is it up to date?), all availableinformation should be considered.Review of current control measures A control measure is an existing process, policy, device, practice or other action that acts to minimise negative risk or enhance positive opportunitiesHaving previously identified existing controls and capabilities for each risk event, it isnecessary to review these to evaluate effectiveness. Current control measures may reduce theoverall degree of risk; however, there may still be sufficient risk remaining which needs to bemanaged.For example, a business’s control measures for customer property theft may include theprovision of personal safety deposit boxes and public security cameras. There is still a riskremaining that the customer may lose items or have unsecured items stolen. If the incidenceremains particularly high, this can have direct implications on corporate responsibility,customer satisfaction and reputation.Likelihood of occurrenceUsing the best accessible information sources and an appreciation of the current controlmeasures, likelihood of occurrence represents a judgement of probability and/or frequency ofthe specified risk event. Approaches used to determine such likelihood can vary however in asmall business environment it may be based on a simple scale describing the frequency ofoccurrence (to or within the business) over a term outlined by the risk management plan (e.g.,five years).Risk Management Training for Tourism 44© COPYRIGHT STCRC
  • 45. Risk Management for Small Tourism BusinessesExample of a likelihood scale:Likelihood of the risk event occurring to or within the business in the next five years:Designation LikelihoodLow the risk event is not expected to occur.Medium the risk event might occurHigh the risk event is more than likely (or expected) to occurConsequences of occurrenceSimilar to a likelihood estimate, the potential consequences to the business must also becalculated. Consequences can take many forms including personal injury, financial loss, legalaction, business disruption and/or physical and environmental damage. When assessing theconsequences of a risk event, all forms of loss should be considered.Example of a consequence scale:Consequence of the risk event occurring to or within the business in the next five years(specifically relating to business profitability and viability):Designation ConsequenceMinor the risk event will have little or no influence on business profitability and will not threaten business viabilityModerate the risk event will reduce business profitability and/or weaken business viabilitySevere the risk event will eliminate business profitability and/or make the business non-viableCalculating the level of riskUsing scales appropriate to the business and risk context, the level of risk reflects theintersection between the likelihood and the consequence ratings.Example of matrix diagram to calculate level of risk: Consequences Minor Moderate SevereLikelihood 6 5 4 Low (minor) (low) (moderate) 5 3 2 Medium (low) (considerable) (high) 4 2 1 High (moderate) (high) (extreme)Risk Management Training for Tourism 45© COPYRIGHT STCRC
  • 46. Risk Management for Small Tourism BusinessesWith the calculated risk level expressed as a either a descriptor or number, such analysis canassist to determine the importance of further action.For example:Level Designation Level of Action Required 1 Extreme Immediate action required 2 High urgent action required 3 Considerable high priority action required 4 Moderate low priority action required 5 Low non urgent action required 6 Minor routine action requiredAny documentation that details the method of analysis for each business risk should alsoexplain (or refer to) the basis and rational for the likelihood and consequence judgements.Risk Management Training for Tourism 46© COPYRIGHT STCRC
  • 47. Risk Management for Small Tourism BusinessesRisk Analysis – Sample Template (adapted from Queensland Government: 2005)Risk Event(identified risk)Information source(relevant data sources regarding therisk event)Existing control measuresLikelihood of risk occurring(low, medium, high)Justification of Likelihood(based on what information?)Consequences of risk event(minor, moderate, major)Justification of Consequences(based on what information?)Level of Risk(minor, low, moderate, considerable,high, extreme)Risk Management Training for Tourism 47© COPYRIGHT STCRC
  • 48. Risk Management for Small Tourism BusinessesSTEP 4. EVALUATE THE RISKSBased on the outcomes of risk analysis, risk evaluation assists to make the necessarydecisions about which risks need treatment; and, the treatment priority.As the final stage of risk assessment, such evaluation considers the calculated risk levelagainst the risk criteria generated in Step 1. Establish the Context (refer page XX). Thisprocess determines whether the risk is acceptable within the defined business context. Giventhat each risk should now be better understood, it may be necessary to review the initialcriteria or thresholds to check their continued relevance.The Evaluation ProcessEven with the best available information, analysis and guiding criteria, risk evaluationremains a value judgement that requires familiarity with the business context. Significantfactors to consider include the overall importance of the activity to the business, the degree ofactive control over the risk, both potential and actual losses associated with the risk, and therelative opportunities the risk presents. Though it is important to remain as objective aspossible, such decisions should involve stakeholder communication and consultation.The evaluation process will probably reveal that not all risks indicate clear negativeconsequences. Expanding or developing a new niche market may be considered a commercialrisk yet successful treatment options can actually enhance the range of positive opportunities.Similarly, while a degree of property damage can increase insurance premiums it may alsopermit structural improvement and equipment upgrades. Effective evaluation requiresbalancing the costs, benefits and opportunities against potential adverse consequences/losses.Cost Benefits AnalysisIn the typical business environment findings of the risk assessment process may be presentedas quantifiable cost/benefits estimates or in similar financial terms. Resource allocation ortreatment is generally not warranted if the cost of implementing control measure outweighsany expected loss. Alternatively if the calculated risk is less than the potential opportunitiesrepresented by the risk even the activity requires further consideration.Tolerable and Unacceptable RisksAt its simplest, risk evaluation results in two lists or tables representing the followinginformation: - a rationale of risks and associated costs that are considered tolerable to the business, and, - risks which require some form of active intervention or treatment.Each list or table should indicate the calculated risk level for further monitoring and review.Risk Management Training for Tourism 48© COPYRIGHT STCRC
  • 49. Risk Management for Small Tourism BusinessesPrioritising for Risk TreatmentAs no business has limitless resources, risk evaluation should assign the priority or urgency ofany further risk management action. Such prioritisation is generally derived from contrastingthe level of calculated risk with the business’s key objectives and criteria.The outcome constitutes a practical guide that ranks the businesses precedence for developingand implementing risk treatment measures.Risk Management Training for Tourism 49© COPYRIGHT STCRC
  • 50. Risk Management for Small Tourism BusinessesRisk Evaluation Form – Sample TemplateACCEPTABLE RISKS: UNACCEPTABLE RISKS: Risk Event Level of Reason for acceptance (identified risk) Calculated (specific rationale) RiskRisk Management Training for Tourism 50© COPYRIGHT STCRC
  • 51. Risk Management for Small Tourism Businesses Risk Event Level of Priority/Action Order (identified risk) Calculated (rank or list from highest to Risk lowest)Risk Management Training for Tourism 51© COPYRIGHT STCRC
  • 52. Risk Management for Small Tourism Businesses Activity FOUR - Developing a Risk RegisterObjective:To develop familiarity with the practice of risk assessment and documenting the riskmanagement process.Consistent with a logical and systematic approach to risk management it is important toclearly document the results of any risk identification, analysis and evaluation processes. Theoutcome of these steps are often summarised in a risk management plan using a risk register.While the format and content can vary, a basic risk register will record: - a description of each risk identified (source/cause and impacts) - an outline of existing controls - likelihood - consequence - level of risk - priority/action orderTask:In small workgroups (3-4), select three generic risk events prepared in Activity 1. Using thesample risk register, transfer the details of both the identified risks and common controlmeasures.With these details and your groups combined industry experience and knowledge as the onlyavailable information, estimate the likelihood and consequences of these events to calculatethe level of risk for a “typical” small tourism business (use the scales and matrix provided -page 37). Document these results in the risk register.Assuming that cost vs. benefits is the only significant risk criteria, evaluate whether such risksare acceptable, and prioritise. Complete these details in the risk register.Final group findings will be shared and discussed with other workshop participants.Risk Management Training for Tourism 52© COPYRIGHT STCRC
  • 53. Risk Management for Small Tourism BusinessesNotes:________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________Risk Management Training for Tourism 53© COPYRIGHT STCRC
  • 54. Risk Management for Small Tourism BusinessesRisk Register – Sample Template Risk Event Existing Control Likelihood Consequence Level of Risk Priority/ (identified risk) (control measures/mitigation strategy) Action OrderRisk Management Training for Tourism 54© COPYRIGHT STCRC
  • 55. Risk Management for Small Tourism BusinessesIMPLEMENTATIONSTEP FIVE: Treat the RisksThe primary purpose of treating risks is to reduce the likelihood and consequences of any riskevent considered unacceptable within the business context. Based on a known operationalenvironment of restricted resources, finance, latitude and time, it is necessary to choose,prioritise and implement the most appropriate mix of risk treatments. As the last formal stepin the risk management cycle this involves: identifying and assessing options; developing andimplementing treatment plans; and analysing and evaluating residual riskIn planning to treat any risk, care should be taken to ensure that the risks to others are notinadvertently increased.Risk Treatment OptionsTo address any risk there are a variety of options available: - avoid the risk - control/change/reduce the risk - transfer/share the risk - accept/tolerate/retain the riskRisk Avoidance:An informed decision to discontinue, not proceed with a planned activity, or choosing analternative way to achieve the objectivesRisk Control:The provision of policies, standards, and procedures, to eliminate, avoid or minimise adverserisks facing the business (reducing the likelihood/consequences of the risk). This may involvea variety of structural measures and changes, however is predominantly achieved throughpractical operational and managerial solutions.Specific strategies to reduce the likelihood of risk include; quality assurance, training,supervising, testing, inspection/audit and process controls, and preventative maintenance.Reducing risk consequences may entail; planning for contingencies, minimising exposure tosources of risk, putting physical barriers in place and activity relocation.Risk Management Training for Tourism 55© COPYRIGHT STCRC
  • 56. Risk Management for Small Tourism BusinessesRisk Transfer/Sharing:Shifting/sharing the responsibility or burden for loss to another party through legislation,subcontracting, outsourcing, partnerships, insurance, or other means. While this is a commonbusiness practice it should be premised on a platform of mutual consent and awareness ofresponsibility and capacity.Although many businesses rely heavily on insurance, particular care should be taken inunderstanding the scope of any policy and obligations. Insurance rarely covers all types ofloss (eg loss of reputation and/or customer satisfaction) and often involves specificcompliance standards and waivers.Risk Retention:Intentionally or unintentionally retaining the responsibility for loss within the business. Thisgenerally occurs when a risk can not be avoided, controlled and/or transferred, or relates to arisk that has not been clearly identified.Risks that are retained by any business should be monitored and reviewed to determine howto cover costs in the event of associated losses. Common practice involves the establishmentof emergency/contingency funds to cover such potential losses.Assessing and developing treatment optionsSelection of the best or most appropriate mix of risk treatment options for any business shouldbe conducted on the basis of cost/benefits, effectiveness and sustainability. A variety oflegislation and Standards already exist to guide and assist in the development of some specificstrategies, yet each option must be reviewed for suitability. Such decision making requires acomprehensive understanding and review of the business context, objectives and the rootcauses of the risk event (how and why it arises).Considering the established risk criteria this process requires an informed judgement thatfurther deliberates issues of: - equity – fair distribution of risks and benefits - timing – when/how soon the treatment benefits may be realized - leverage – will treatment lead to benefits in other areas - cost – how cost effective (direct/indirect/tangible/intangible) - administrative efficiency – is it easy to implement within the businesses current operating structure - resource requirements - continuity of effects- continuous/short term /sustainability - stakeholder acceptability - socio-economic/environmental impacts - compatibility with business objectives, legal duty, social/corporate obligationsRisk Management Training for Tourism 56© COPYRIGHT STCRC
  • 57. Risk Management for Small Tourism BusinessesTreatment options and selected strategies should be realistic and feasible. Ideal proposalsmay not be possible and may result in tradeoffs or a combination of the most appropriateapproaches. To rationalize such choices to relevant stakeholders there needs to be a clearindication that the range of benefits justifies the cost of implementing the treatment.Residual RiskConsistent with risks that are considered acceptable or retained by the business, risk treatmentcan not eliminate every conceivable risk or consequence. Residual risk refers to the level ofrisk remaining once treatment options have been implemented. While it is important toconsistently monitor and review such risk levels many business develop specific contingencyor crisis plans to minimise any associated impacts (elaborated in Session 4).Developing a Risk Treatment Schedule/Action PlanA risk treatment plan details how the selected treatment options will be implemented,maintained and reviewed. While format and design may vary, for each unacceptable riskevent it should clearly communicate: - the nature of the risk event (source and elements at risk) - treatment approach/strategy and justification (based on the risk priority, likelihood, consequences and level) - performance measures/indicators - responsibilities, resources and timeframesImplementationImplementation and integration of a risk treatment plan relies on commitment and familiaritywith the business operating structure and practices. It is common practice to get signedmanagerial approval on any treatment plan before changing or initiating any new strategies.Where risk is inherent in established or routine behaviours it may also be necessary tostimulate changes in personnel attitudes and motivation. While stakeholder communicationand consultation throughout the risk management process may have increased general riskawareness and understanding, treatment strategies still need to appear logical and practical.The business risk management coordinator or team needs to ensure that all relevant details aredocumented within a risk management plan and that identified treatment strategies arerealised, on time and within budget.Risk Management Training for Tourism 57© COPYRIGHT STCRC
  • 58. Risk Management for Small Tourism BusinessesRisk Treatment Plan – Sample Template (adapted from Queensland Government 2005)Risk event/statement(what can happen)Source of Risk(how can the risk arise)Priority(priority relative to other risks)Likelihood(low, medium ,high)Consequences(minor, moderate, major)Level of Risk(minor, low, moderate, considerable, high, extreme)Risk Treatment(specific strategy or approach toavoid/control/transfer/retain risk)Responsibility(who will implement, monitor, review)Resources required(human, physical, financial/budget resources toimplement)Performance measure(indicators/audit of efficacy, reliability andavailability)Timetable(when treatment approach will beimplemented/reviewed/revised)Risk Management Training for Tourism 58© COPYRIGHT STCRC
  • 59. Risk Management for Small Tourism BusinessesTHE RISK MANAGEMENT PLANIn following a formalised risk management process as outlined, it is possible to develop alogical and practical risk management plan for any small tourism business. The level ofdocumentation generated will reflect the complexity of the business and associated riskactivities and issues. To facilitate communication, accountability and transparency aneffective risk management plan should at least contain: - A General Risk Management Policy/Statement - A Risk Management Responsibility Statement - A Communications Plan - A Risk Register - A Risk Treatment Action Plan/ScheduleConsistently, all documentation must be clearly marked with the date created, author, andscheduled review date.Although considered an integral developmental and awareness exercise, good riskmanagement does not end with the production of a paper based risk management plan.Effective risk management is a continuous process that should become part of a businessesculture and practice. It needs to be adequately rationalised and accepted by all keystakeholders. Experience consistently demonstrates that one of the primary causes of planfailure (or the non-implementation of a plan) is that the objectives, intent, and details of theplan are poorly understood.Monitoring and ReviewRegardless of the level of detail or intent, it is unlikely that any initial risk management planwill be perfect or enduring. It is essential to constantly monitor and evaluate the risks,environmental context and significant factors. Practical risk management integrates aschedule to regularly review the nature and scope of identified problems and the associatedlevel of risk. Reflecting a continuous process or cycle of risk management this furtherencourages a review the business context, identifies new risks, reviews existing risks and anyassociated problems/constraints, evaluates risk levels, and determines related risk treatmentoptions.Practice, experience and actual loss will gradually necessitate changes in any plan and provideinformation on alternative approaches to the risk faced by the business. While riskmanagement demands a degree of flexibility and adaptability, a constant and formalisedapproach ensures that the process remains both comprehensive and systematic.Risk Management Training for Tourism 59© COPYRIGHT STCRC
  • 60. Risk Management for Small Tourism Businesses SESSION FOUR CRISIS MANAGEMENT Crisis Management Planning Defining Crisis Understanding Crisis Management Crisis Management for Tourism Business Continuity Resource Identification The Four “Rs” of Crisis Management – A Practical Approach Crisis Communications (Containment) and Reporting Recovery and Marketing Developing a Crisis Management Plan for Small Tourism Business Activity Five – Proactive Crisis Management PlanningRisk Management Training for Tourism 60© COPYRIGHT STCRC
  • 61. Risk Management for Small Tourism BusinessesCRISIS MANAGEMENTCRISIS MANAGEMENT PLANNINGDefining Crisis A crisis is any situation that has the potential to affect long-term confidence in an organisation or a product, or which may interfere with its ability to continue operating normally.While risk management is essentially about anticipating and minimising risks to the business,crises occur when an unforeseen or unavoidable event does occur. It is an abnormal threatthat may result from the direct impact of an emergency or disaster or be self-induced due topoor safety conditions, limited capacity or even bad publicity. Consequences of crisis may beshort, medium or long term and affect individuals, a solitary business, a community, aregional area and even entire nations. Depending on the scale and visibility of the incident, itmay also precipitate significant stakeholder, public and/or media uncertainty.Regardless of the source, the initial crisis period is typically rapid onset, high pressure anddemands urgent consideration. In management terms a crisis is often described as a“turning-point” where good practice and decision-making can influence a positive outcome,and, where limited attention or poorly conceived reactions generally have negativeconsequences.Understanding crisis management Crisis management is the overall coordination of an organizations response to a crisis, in an effective, timely manner, with the goal of avoiding or minimizing damage to the organizations profitability, reputation, or ability to operate.Given the number and variety of risks to tourism enterprise, it is impossible to eliminate everyrisk factor. Many external situations such as natural hazards, terrorist threats and civil unrestare beyond direct business or industry control. Alternatively as a consequence of the riskassessment and treatment process there may have been residual risks. While effective riskmanagement strategies may have implemented structural changes to limit physical damage, orinstitutional procedures to improve public relations and security, some crises are inevitable.Crisis management planning assists businesses to be better prepared for uncertainty.Risk Management Training for Tourism 61© COPYRIGHT STCRC
  • 62. Risk Management for Small Tourism BusinessesIt is a common-sense procedure that: - identifies the strengths and weakness of the organisation, - designs related contingency plans, and - understands how key stakeholders and the media are likely to react.A comprehensive crisis management process establishes the mechanisms for immediate andappropriate management response as soon as a potential crisis is detected. With the rightstructures, practices and leadership skills it is possible to prevent a threatening situation fromescalating into a significant and sustained crisis. In the advent of adversity it assists tomitigate the losses, facilitates business continuity/resumption and aids a rapid recovery ofconsumer confidence. While the uncertainty of any event requires an element of flexibility,proactive planning develops the conviction to remain professional and focused.Crisis Management for Tourism The basic premise behind a tourism crisis management plan is to: i) develop an integrated plan that will assist individual operators to reduce, or respond to, the impacts of shocks that result in a downturn in regional, domestic and/or international travel in the short, medium or long-term ii) put processes in place, which can be initiated in a timely and effective manner in the event of a significant shockIt has been well established that tourism is a highly vulnerable and highly competitiveindustry. As a discretionary activity consumers can post-pone, cancel or substitute plannedactivities and destinations, resulting in lost revenues. To remain successful, businesses musthave the ability to recover quickly and effectively from any bad situation. The WorldTourism Organisation identified the following areas as central to the development and processof tourism crisis management: - safety and security - communication - promotion and marketing researchSafety and SecurityAs a service oriented industry, tourism businesses have both a moral and legal obligation tolook after the safety and security of staff and consumers. Measures to protect life and propertyshould be an ethical and commercial imperative before, during and after a crisis.Risk Management Training for Tourism 62© COPYRIGHT STCRC
  • 63. Risk Management for Small Tourism BusinessesCommunicationWhile the media often plays a significant role in crisis situations, effective communicationstrategies should include the interchange of any information within and beyond the individualorganisation. Misleading information can be limited through the prior identification ofappropriate contacts, authorities, stakeholders, resources and equipment.Promotion and Marketing ResearchMost tourism businesses are already familiar with the concepts of promotion and marketing.Successful enterprise requires a business to know and understand their market, and strives tostimulate increased interest. Marketing and promotion is perhaps even more significant inpost-crisis recovery strategies and should be adapted to reflect changed conditions andcircumstances.Business Continuity Business continuity is the uninterrupted availability of all key resources supporting essential business functionsAny adverse situation that interrupts the normal course of business operation at a corporatelocation equates to lost revenues and/or expenditure. The problem may originate from withinthe business or can be induced by external events. Familiar circumstances include: - staff loss (poor morale, strikes, transport difficulties, health pandemic, injuries and fatalities); - building/property damage (flooding, fire, broken pipe works, accidents, natural disasters); - utilities failure (power, water, communications, sanitation); - IT failure (corruption, virus, theft of data, malicious access). - commercial failure (loss of consumer confidence, limited custom, damaged reputation, changed market/product, competition)While businesses are under no legal or financial obligation to plan for their own commercialsurvival, it is considered good business sense to develop a business continuity plan (BCP).In identifying key business resources and critical infrastructure, the aim of such planningis to protect, maintain and directly source alternative solutions as the impact of a crisisdictates. Considered an important dynamic in effective risk and crisis management planning,BCP assists individual businesses to restore functions, resume operational capacity andrecover quickly following significant disruption.Resource IdentificationTo maximise efficiency in any potential crisis situation, business operators should be specificRisk Management Training for Tourism 63© COPYRIGHT STCRC
  • 64. Risk Management for Small Tourism Businessesin their knowledge of the elements at risk, and identifiable resources. Significant resourcesmay be categorised as human, material, and/or financial.Human resources refer to: - specific roles or key personnel e.g. owner, management, administrator, crisis management coordinator, employees, stakeholder - an inventory of skills e.g. level of expertise, experience, capabilities, training, education, awareness - external parties/agencies e.g. suppliers, vendors, channel partners, investor, law enforcement, fire department, utilities, emergency services, media, consumers, non government organisation, volunteersPhysical and Material resources refer to: - information/data e.g. essential records, market research, personnel files, computer hard drives (originals and back-up copies) - facilities/assets e.g. buildings, property, vehicles, equipment, infrastructure - contingency needs e.g. evacuation transport, safe shelter, emergency supplies, emergency operations centre, emergency communication and administration equipment/facilitiesFinancial resources refer to: - capital, bank accounts and loans - emergency cash/funds - insurance arrangements - recovery marketing/promotion budgetAlthough most managers would be familiar with the resources required in normal operationalconditions, a current and comprehensive resource inventory assists strategic crisis responseand rapid business recovery.The Four “Rs” of Crisis Management – a practical approachFor many businesses, crisis management begins at the onset of a crisis. It represents anecessary reaction to a significant negative event. While some manage to survive or outlastany associated downturn in custom and revenue, few small businesses have the financialreserves to cope with sustained adversity. Lack of preparation and planning can result inunnecessary loss of life and property, delays and duplication of effort. Additionally, poormanagement decisions often lead to a loss of consumer confidence. Given the importance ofrapid recovery and positive perception to tourism enterprise, good crisis management isimplemented well before any crisis occurs. A comprehensive approach to crisis management can be broken down into four distinctphases (the Four “Rs”): - ReductionRisk Management Training for Tourism 64© COPYRIGHT STCRC
  • 65. Risk Management for Small Tourism Businesses - Readiness - Response - RecoveryCommunication, consultation, monitoring and review should be a continuous endeavour.ReductionConsistent with the risk management process, reduction involves understanding the threats tobusiness operations. In detecting the early warning signals of any potential crisis, a businessseeks to prevent or limit the damages.Crisis reduction or mitigation is best achieved through proactive awareness, education,advice and cooperation. At the business level it involves conducting a comprehensive riskassessment, developing a crisis action plan and the delegation of a responsiblecoordinator/team. Crisis contingency (“what if…” plans) and appropriate crisis guidelinesneed to be detailed and available for immediate implementation. Communication networkswith stakeholders and external organisations such as government, security agencies,emergency services and the media should also be well established.ReadinessReadiness refers to the strategic (who, what, when) and tactical (how, where) component ofthe crisis management process. In enhancing general risk awareness, developing plans andtraining prior to a crisis, it generates the capabilities that managers and staff need to bepsychologically and physiologically prepared for the impact and stresses that crisis willimpose.Having pre-determined elements such as individual roles and responsibilities (particularly fordecision making and cooperation with external agencies), a notification system, medialiaisons and a comprehensive resource inventory, reduces uncertainty in crisis situations. Asa potential crisis is detected, readiness enables a more coordinated and focused responseeffort.ResponseIn circumstances where a potential crisis can not be prevented or averted, response is theexecution of operational (on-site) and communications plans. In crisis management terms itrefers to the processes in place for timely and effective response. As a reputation based,service-oriented industry tourism crisis response strategies must have sufficient considerationof both the basic human requirements and any possible special needs. Visitors are oftenconsidered at greater risk due to their assumed behaviour and lack of local familiarity (eg.limited hazard awareness, language complications, marginalisation).Figure 6. The Crisis Management ProcessRisk Management Training for Tourism 65© COPYRIGHT STCRC
  • 66. Risk Management for Small Tourism Businesses REDUCTION READINESS COMMUNICATE CONSULT CRISIS DOCUMENT MONITOR REVIEW RECOVERY RESPONSERisk Management Training for Tourism 66© COPYRIGHT STCRC
  • 67. Risk Management for Small Tourism BusinessesIn the immediate aftermath of a crisis event, response involves the activation of contingencyplans and continuity (BCP). Depending on the crisis, initial operational emphasis should beon the protection of lives and property and communication strategies reassuring stakeholdersand the public.Short term safety considerations include: saving lives, preventing further damage/reducingeffects, emergency medical services, patient care, evacuation transport and establishing afunctional emergency operations centre. A crisis management coordinator or team wouldassess event impacts, identify and prioritise actions, and essentially retain control of businessactivities and functions.Communications strategies may involve: activating the crisis response team, alerting relevantstakeholders within 30mins, establishing the crisis communication system, incorporating andmanaging volunteers, further evacuation of dangerous areas and providing familyassistance/support. Media specific and public relations strategies may warrant press briefings,establishing an identifiable, credible spokesperson, and posting an emergency web site.As the emergency or danger period recedes, financial contingencies should address issues ofrepair costs, income, employment, and the potential length or duration of any businessclosure.RecoveryWhile the traditional focus of recovery is a rapid return of business facilities, operation andtrade, this period should also be used as an opportunity to improve on pre-crisis conditions.Wherever possible, physical, environmental, and institutional reconstruction should integrategreater crisis resilience measures. Affected tourism businesses should enhance the networksand alliances to cooperatively rebuild image and consumer confidence. Strategic marketingtactics will need to address any prevailing concerns, while re-branding and promotion salesshould not undermine long term business viability and profitability. Emotional andpsychological support of victims is considered as important as physical and economicrecovery.As a comprehensive process, recovery is not finished once a level business normalisation hasbeen achieved. An essential part of crisis management is to review and evaluate the crisisexperience for lessons learnt. Identified deficiencies should be addressed and existingdocumentation and procedures amended to reflect this improved level of understanding.Risk Management Training for Tourism 67© COPYRIGHT STCRC
  • 68. Risk Management for Small Tourism BusinessesCrisis Communications (Containment) and ReportingExtensive tourism and business industry experience illustrates that good communication isessential for rapid crisis recovery. Lack of information or incorrect information at a time ofpublic uncertainty or confusion can have long term negative affects on consumer confidence.Effective crisis communications: - fully explains the true extent of the crisis - puts the issue into perspective - reassures the observers about the appropriate measures taken to control and address the situation.Developing a crisis communication plan assists in generating an appropriate and consideredpublic response in high pressure or stressful circumstances. Crisis communication templates,industry and stakeholder notification lists, generic media statements and “dark” websites (pre-designed and ready to be activated with appropriate crisis details) can all assist with mediamanagement and responsible promotion following a significant event.Recovery and MarketingPromotion, advertising and marketing post-crisis is an important part of the recovery process.Rebuilding a damaged or negative tourism image must be primarily founded on sensitivityand understanding. Depending on the extent of physical damage and operational capacity, itrequires strategic and effective management of media coverage and visitors perceptions.While tourism remains a competitive business, industry and government solidarity andmarketing alliances can help present a consistent message and reduce the individual financialburden of destination promotion and re-branding. Although heavy discounting may seem aviable option to recoup prospective commerce, extensive experience suggests that incentiveand value adding (eg bonus nights, upgrades, tours or meals) prove far more sustainable in thelong term. Recovery also presents an opportunity to identify key customers and source newor alternative markets.Developing a Crisis Management Plan for Small Tourism BusinessGiven the infinite variables that constitute an individual tourism enterprise and its contextualenvironment every crisis situation is unique. An adverse event can vary in - nature (cause), - intensity, - duration, - impact, - recovery time, and, - may effect a single business, particular sector or entire community/country.Risk Management Training for Tourism 68© COPYRIGHT STCRC
  • 69. Risk Management for Small Tourism BusinessesThe potential consequences of any crisis are highly unpredictable and highly differential.While risk and contingency plans consider specific events or circumstances, a simple crisismanagement plan adopts a more generic “all-hazards” approach. It works on basic elementsor principles that are common to most crisis situations such as a period before, a “triggeringevent” a response and a period after. Although strategic actions may be implemented duringcertain phases of a crisis, the key to effective crisis management is proactively developing theskills, resources, networks, and understanding so that response actions support continuedbusiness viability and profitability.Risk Management Training for Tourism 69© COPYRIGHT STCRC
  • 70. Risk Management for Small Tourism BusinessesFigure 7. A Generic Guide to Tourism Crisis Management(Adapted from Sharpley 2004:286) Phase RequirementREDUCTION Prevention/Avoidance/ MitigationPRE-EVENT ⋅ Development of a business crisis management (“action”) plan (review regularly) ⋅ Establish crisis management coordinator/team ⋅ Set up communication channels with appropriate agencies, organisations, stakeholders, media ⋅ Identification/anticipation of potential crisis ⋅ Implement contingency plans to prevent/mitigate crisis event ⋅ Distribution of business crisis management planREADINESS PreparednessPOTENTIAL CRISIS ⋅ Mobilise protection/evacuation plans ⋅ Issue warning/appropriate caution to tourists/tour companies regarding business and/or destination circumstances ⋅ Activate crisis management team ⋅ Relocate critical resourcesRESPONSE Response/ProtectionEMERGENCY ⋅ Establish a communication centre ⋅ Activate rescue/evacuation procedures ⋅ Provide emergency accommodation/food etc ⋅ Ensure provision of health/medical services/supportINTERMEDIATE Containment ⋅ Damage audit/initial repair ⋅ Communication strategy (based on): - accurate/authoritative/regular media statements - objective analysis of the situation - transparency/full disclosure - emphasise positive points - provide background information – crisis context regionally/ nationally, historical precedence etc - ensure appropriateness of safety and security measures and associated travel advisories ⋅ Initiate insurance claims processRECOVERY Reconstruction/Restoration/ResolutionPOST-EVENT ⋅ Investment in new facilities/infrastructure where relevant ⋅ Rebuild image and confidence in business/destination (cooperative effort) - appropriate marketing strategy (eg. research, re-branding, value adding, incentive adding, marketing solidarity alliances) - investment in targeted promotion - media information that stresses tourist safety and positiveRisk Management Training for Tourism 70© COPYRIGHT STCRC
  • 71. Risk Management for Small Tourism Businesses experiences Activity FIVE - Proactive Crisis Management PlanningObjective: To develop familiarity and confidence with the practice of proactive crisis management planning.Task:In small groups (3-4) select a typical local natural hazard (ie cyclone, flood, fire, heatwave,hail etc) that is likely to have a significant impact on any small tourism business. Using thedirect impact of such a hazard as the crisis scenario, identify the basic strategies and resourcesthat a small tourism business would require to respond and recover in an appropriate andtimely manner. If time permits prioritise the importance of each action.Elements to consider includeHazard: Safety and Security Communications Promotion/Marketing (life, property and (internal and external) (research, investment, environment) and publicity)ReductionReadinessResponseRecoveryRisk Management Training for Tourism 71© COPYRIGHT STCRC
  • 72. Risk Management for Small Tourism BusinessesNotes:________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________Risk Management Training for Tourism 72© COPYRIGHT STCRC
  • 73. APPENDIX
  • 74. Risk Management for Small Tourism BusinessesAcronymsABS – Australia Bureau of StatisticsAICST – APEC International Centre for Sustainable TourismAPEC – Asia-Pacific Economic CooperationAS/NZS – Australian Standard/New Zealand StandardCDS – Australian Centre for Disaster StudiesCM – Crisis ManagementEMA – Emergency Management AustraliaISDR – International Strategy for Disaster ReductionJCU – James Cook UniversityNTO – National Tourism OrganisationPATA – Pacific Asia Travel AssociationPPRR – Prevention, Preparedness, Response, RecoveryQTIC – Queensland Tourist Industry CouncilRM – Risk ManagementRRRR – Reduction, Readiness, Response, RecoverySAI – Global – Standards Australia InternationalSTCRC – Sustainable Tourism Cooperative Research CentreSTS – Sustainable Tourism ServicesTQ – Tourism QueenslandWTO – World Tourism OrganisationRisk Management Training for Tourism 74© COPYRIGHT STCRC
  • 75. Risk Management for Small Tourism BusinessesReferencesAustralian Bureau of Statistics (2006) Small Business in Australia.http://abs.gov.au/AUSSTATS/abs@.nsf/DOSSbyTopic/297DB51F08B97920CA256BD000281897?Open Document August 1, 2006Encarta Online Dictionary (2006) MSN Encarta Onlinehttp://encarta.msn.com/encnet/features/dictionary/dictionaryhome.aspx July 12, 2006Emergency Management Australia (1998) Australian Emergency Management Glossary.Emergency Management Australia.Emergency Management Australia (2004) Emergency Risk Management ApplicationsGuide. Emergency Management Australia.ISDR. International Strategy for Disaster Reduction (2004) Terminology: Basic terms ofdisaster risk reduction. http://www.unisdr.org/eng/library/lib-terminology-eng.htm August 4,2006Pacific Asia Travel Association (2003) Crisis: It Won’t Happen to Us. Pacific Asia TravelAssociation: BangkokQueensland Government (2005) Risk Management. http://www.riskmanagement.qld.gov.au/August 28, 2006Sharpley, R (2004) International tourism: the management of crisis. In Pender, L. andSharpley, R.(Eds.) (2005)The Management of Tourism. Sage: London. pp.275-287Standards Association of Australia. Standards Association of Australia: NSWAS/NZS 4360: 2004 Risk Management.HB 221:2004 Business ContinuityHB 90.1-2000 : The Small Business Handbook - Guide to ISO 9001:2000HB 436 Risk Management Guidelines – Companion to AS/NZS 4360:2004Wilks, J. and Moore, S. (2004) Tourism Risk Management for the Asia Pacific Region: AnAuthoritative Guide to Managing Crises and Disasters. Commonwealth of Australia:Australia.WHO/EHA (2002). Disasters and Emergencies. Definitions.Available:www.who.int/disasters/repo/7656.pdf. 23 January 2004WTO. World Tourism Organisation (2003). Crisis Guidelines for the Tourism Industry.Available:http://www.worldtourism.org/market_research/Crisis%20and%20Disaster%20Management%20Guidelines.pdf. 03 July, 2003.Zamecka, A. and Buchanan, G. (1999) Disaster Risk Management. Queensland DepartmentRisk Management Training for Tourism 75© COPYRIGHT STCRC
  • 76. Risk Management for Small Tourism Businessesof Emergency Services: Queensland.Risk Management Training for Tourism 76© COPYRIGHT STCRC
  • 77. Risk Management for Small Tourism BusinessesGlossaryRisk Management Terms and DefinitionsThreats and shocks to tourism enterprise may develop from the internal operationalenvironment or an external event. Consequently a comprehensive risk management processfor tourism businesses should involve managing risk at the organisational level andcontributing to the emergency risk management (ERM) process within the community.The following terms and definitions are intended to cover both forms of risk management,and are drawn predominantly from the Australian Risk Management Standard AS/NZS4360:2004, and Emergency Management Australia. To facilitate consistency andcollaboration between organisations and external agencies/stakeholders, nationally andinternationally standardised definitions have been used where available.Acceptable Risk:The level of risk that is sufficiently low that society is comfortable with it. Society does notgenerally consider expenditure in further reducing such risk justifiable (EMA 1998)All Hazards Approach:Dealing with all types of emergencies or disasters and civil defence using the same set ofmanagement arrangements. (EMA 1998)AS/NZS 4360:The Australian/New Zealand Standard for risk management.Business Continuity:Business continuity is ‘the uninterrupted availability of all key resources supporting essentialbusiness functions’ (HB90.1 2000).Capacity:A combination of all the strengths and resources available within a community, society ororganization that can reduce the level of risk, or the effects of a disaster.Capacity may include physical, institutional, social or economic means as well as skilledpersonal or collective attributes such as leadership and management. Capacity may also bedescribed as capability. (ISDR 2004)Risk Management Training for Tourism 77© COPYRIGHT STCRC
  • 78. Risk Management for Small Tourism BusinessesCapacity Building:Efforts aimed to develop human skills or societal infrastructures within a community ororganization needed to reduce the level of risk.In extended understanding, capacity building also includes development of institutional,financial, political and other resources, such as technology at different levels and sectors ofthe society. (ISDR 2004)Communication:The process of conveying information. It requires someone to generate the message andsomeone to receive it. It is important to all phases of the risk management process (Zameckaand Buchanan 1999)Community:A group with a commonality of association and generally defined by location, sharedexperience or function (EMA 1998)Consequence:Outcome or impact of an event. (EMA 2004)Control:An existing process, policy, device, practice or other action that acts to minimise negative riskor enhance positive opportunities. (EMA 2004)Coping Capacity:The means by which people or organizations use available resources and abilities to faceadverse consequences that could lead to a disaster.In general, this involves managing resources, both in normal times as well as during crises oradverse conditions. The strengthening of coping capacities usually builds resilience towithstand the effects of natural and human-induced hazards. (ISDR 2004)Crisis:Any situation that has the potential to affect long-term confidence in an organisation or aproduct, or which may interfere with its ability to continue operating normal. (PATA 2003)Crisis Management:The overall coordination of an organizations response to a crisis, in an effective, timelymanner, with the goal of avoiding or minimizing damage to the organizations profitability,reputation, or ability to operate. (www.it.jhu.edu/etso/dr/industry/glossary.html)Risk Management Training for Tourism 78© COPYRIGHT STCRC
  • 79. Risk Management for Small Tourism BusinessesData:Known facts used for inference or reckoning. Data is acquired by measurement or collection(Zamecka and Buchanan 1999)Disaster:A serious disruption to community life which threatens or causes death or injury in thatcommunity and/or damage to property which is beyond the day-to-day capacity of theprescribed statutory authorities and which requires special mobilisation and organisation ofresources other than those normally available to those authorities (EMA 1998)Elements at risk:The population, buildings, and civil engineering works, economic activities, public servicesand infrastructure etc. exposed to sources of risk (EMA 2004)Emergency:An event, actual or imminent, which endangers or threatens to endanger life, property or theenvironment, and which requires a significant and coordinated response (EMA 1998)Emergency Management:A range of measures to manage risks to communities and the environment. The organisationof management and resources for dealing with all aspects of emergencies. (EMA 1998)Environment:Conditions or influences comprising social, physical, biological and built elements, whichsurround or interact with a community (EMA 1998)Event:An incident or situation, which occurs in a particular place during a particular interval of time(EMA 1998)Frequency:A measure of likelihood expressed as the number of occurrences of an event in a given time(EMA 1998)Hazard:A source of potential harm (EMA 2004)Information:Risk Management Training for Tourism 79© COPYRIGHT STCRC
  • 80. Risk Management for Small Tourism BusinessesKnowledge, characteristics and features derived by analysis of data. (Zamecka and Buchanan1999)Level of Risk:An expression of the severity of a risk derived from consideration of likelihood andconsequence (Zamecka and Buchanan 1999)Likelihood:Used as a general description of the probability or frequency (EMA 2004)Lifelines:The public facilities and systems that provide basic life support services such as water,energy, sanitation, communications and transportation. Systems or networks that provideservices on which the well-being of the community depends. (EMA 1998)Loss:Any negative consequence or adverse affect, financial or otherwise (EMA 1998)Mitigation:Measures taken in advance of a disaster aimed at decreasing or eliminating its impact onsociety and environment (EMA 1998)Monitor:To check, supervise, observe critically or measure the progress of an activity action or systemon a regular basis in order to identify change from the performance level required or expected(EMA 2004)Organisation:Group of people and facilities with an arrangement or responsibilities, authorities andrelationships (EMA 2004)PPRR:An abbreviation for prevention, preparedness, response and recovery (comprehensiveapproach) (EMA 1998)Preparedness/Readiness:Risk Management Training for Tourism 80© COPYRIGHT STCRC
  • 81. Risk Management for Small Tourism BusinessesArrangements to ensure that, should an emergency occur, all those resources and serviceswhich are needed to cope with the effects can be efficiently mobilised and deployed (EMA1998)Prevention/Reduction:Regulatory and physical measures to ensure that emergencies are prevented or their effectsmitigated (EMA 1998)Probability:The likelihood of a specific outcome, measured by the ratio of specific outcomes to the totalnumber of possible outcomes (EMA 1998)Public Awareness:The processes of informing the community as to the nature of the hazard and the actionsneeded to save lives and property prior to and in the event of a disaster (EMA 1998)RRRR:An abbreviation for readiness, reduction, response, recovery (comprehensive approach)Readiness/Preparedness:Arrangements to ensure that, should an emergency occur, all those resources and serviceswhich are needed to cope with the effects can be efficiently mobilised and deployed (EMA1998)Recovery:The coordinated process of supporting emergency-affected communities in the reconstructionof the physical infrastructure and restoration of emotional, economic and physical well-being.(EMA 1998)Reconstruction:The full resumption of socio-economic activities plus preventative measures (WHO/EHA2002)Reduction/Prevention:Regulatory and physical measures to ensure that emergencies are prevented or their effectsmitigated (EMA 1998)Rehabilitation:Risk Management Training for Tourism 81© COPYRIGHT STCRC
  • 82. Risk Management for Small Tourism BusinessesThe operations and decisions taken after a disaster with a view to restoring a strickencommunity to its former living conditions, whilst encouraging and facilitating the necessaryadjustments to the changes caused by the disaster (EMA 1998)Relief:The provision of immediate shelter, life support and human needs of persons affected by, orresponding to, an emergency. It includes the establishment, management and provision ofserviced to emergency relief centres (EMA 1998)Residual Risk:The remaining level of risk after risk treatment measures have been taken (EMA 1998)Resilience:A measure of how quickly a system recovers from failures (EMA 2004)Resources:All personnel and equipment available, or potentially available for incident tasks (EMA 1998)Response:Actions taken in anticipation of, during, and immediately after, an emergency to ensure itseffects are minimised and that people affected are given immediate relief and support (EMA1998)Risk:The chance of something happening that will have an impact on objectives (EMA 2004)Risk Acceptance:An informed decision to accept the likelihood and consequences of a particular risk (EMA1998)Risk Analysis:A systematic use of available information to determine how often specified events may occurand the magnitude of their likely consequences (EMA 1998)Risk Assessment:Risk Management Training for Tourism 82© COPYRIGHT STCRC
  • 83. Risk Management for Small Tourism BusinessesThe process used to determine risk management priorities by evaluating and comparing thelevel of risk against predetermined standards, target risk levels or other criteria (EMA 1998)Risk Avoidance:An informed decision not to become involved in a risk situation. (EMA 1998)Risk Communication:Interactive processes involving the exchange of information and opinion about risk amongindividuals, groups, and institutions (EMA 1998)Risk Control:That part of risk management which involves the provision of policies, standards andprocedures to eliminate, avoid or minimise adverse risks facing an enterprise (EMA 1998)Risk Criteria:Standards by which the results of risk assessments can be assessed. They relate quantitativerisk estimates to qualitative value judgements about the significance of the risks (EMA 1998)Risk Estimation:The process used to produce a measure of the level of risk being analysed (EMA 1998)Risk Evaluation:The process in which judgements are made on the tolerability of the risk on the basis of riskanalysis and taking into account factors such as socio-economic and environmental aspects(EMA 1998)Risk Identification:The process of determining what can happen, why and how. (EMA 1998)Risk Management:The culture, processes and structures that are directed towards realising potentialopportunities whilst managing adverse effects (EMA 2004)Risk Management Process:The systematic application of management policies, procedures and practices to the tasks ofidentifying, analysing, evaluating, treating, monitoring and reviewing risk. (EMA 2004)Risk Reduction:Risk Management Training for Tourism 83© COPYRIGHT STCRC
  • 84. Risk Management for Small Tourism BusinessesA selective application of appropriate techniques and management principles to reduce eitherlikelihood of an occurrence or its consequences, or both (EMA 1998)Risk Register:A listing of risk statements describing sources of risk and elements at risk assignedconsequences, likelihoods and levels of risk (EMA 2004)Risk Retention:Intentionally or unintentionally retaining the responsibility for loss, or financial burden of losswithin the organisation (EMA 1998)Risk Sharing:Sharing with another party the burden of loss, or benefit of gain from a particular risk(ASNZS4360)Risk Transfer:Shifting the responsibility or burden for loss to another party through legislation, contract,insurance or other means. Risk transfer can also refer to shifting a physical risk or part thereofelsewhere. (EMA 1998)Risk Treatment:Selection and implementation of appropriate options for dealing with risk (EMA 1998)Small and Medium Enterprise:Enterprise that is, independently owned and operated, closely controlled by owners/managers(who also contribute most, if not all of, the operating capital) and, where the principaldecision-making functions rest with the owners/managers.As a functional qualification based on the number of employees; small businesses employ lessthan 20 people, while medium businesses employ 20 or more people, but less than 200employees. (adapted from ABS 2006)Stakeholders:Those people and organisations who may affect, be affected by or perceive themselves to beaffected by, a decision, activity or risk (EMA 2004)Strategy:Risk Management Training for Tourism 84© COPYRIGHT STCRC
  • 85. Risk Management for Small Tourism BusinessesA carefully devised plan of action to achieve a goal (Encarta Dictionary 2006)Structural/Non structural measures:Structural measures refer to any physical construction to reduce or avoid possible impacts ofhazards, which include engineering measures and construction of hazard-resistant andprotective structures and infrastructure.Non-structural measures refer to policies, awareness, knowledge development, publiccommitment, and methods and operating practices, including participatory mechanisms andthe provision of information, which can reduce risk and related impacts.(ISDR 2004)Susceptibility:The potential to be affected by loss (EMA 2004)Sustainable development:Development in the present that does not destroy the resources needed for future development(EMA 1998)Tourism:Tourism comprises the activities of persons travelling to and staying in places outside theirusual environment for not more than one consecutive year for leisure, business and otherpurposes not related to the exercise of an activity remunerated from within the place visited(WTO 2002).Tourism Risk Management:The systematic application of management policies, procedures and practices to the tasks ofidentifying, analysing, evaluating, treating, monitoring and reviewing risks that may affecttourism enterprise.Tourism Crisis Management:The systematic application of management policies, procedures and practices to help retainthe confidence of travellers and the travel industry, and to minimize the impact of a crisis on abusiness/destination.Treatment Options:Measures which modify the characteristics of hazards, communities and environments.(Zamecka and Buchanan 1999)Vulnerability:The degree of susceptibility and resilience of the community and environment to hazardsRisk Management Training for Tourism 85© COPYRIGHT STCRC
  • 86. Risk Management for Small Tourism Businesses(EMA 1998)Risk Management Training for Tourism 86© COPYRIGHT STCRC
  • 87. Risk Management for Small Tourism BusinessesAuthorsYetta Gurtner:Yetta is a PhD Candidate and researcher with the Centre of Disaster Studies, in the School ofEarth and Environmental Sciences, James Cook University, Townsville. Her current thesisproject investigates an integrated approach to crisis management and recovery in tourist-reliant destinations, based on the case studies of Bali and Phuket. Yetta’s primary researchinterests include establishing a holistic understanding of the impacts tourism in developingnations and the facilitation of community based disaster management. Email:yetta.gurtner@jcu.edu.auDamian Morgan:Damian Morgan is a lecturer with the Department of Management, Monash University. He isalso a member of the Monash University Tourism Research Unit where his research interestconcerns outdoor tourism and recreation risk management. Damian has held a range ofadministrative, management and sports instruction positions in the tourism and hospitalityindustries. He is completing a PhD in surf beach use and safety with the Monash UniversityAccident Research Centre.The authors are particularly indebted to Dr. Scott Cunliffe and Dr. DavidKing at the Centre for Disaster Studies, James Cook University, for theinitial project conception, proposal and development.Risk Management Training for Tourism 87© COPYRIGHT STCRC
  • 88. Risk Management for Small Tourism BusinessesAuthorsYetta Gurtner:Yetta is a PhD Candidate and researcher with the Centre of Disaster Studies, in the School ofEarth and Environmental Sciences, James Cook University, Townsville. Her current thesisproject investigates an integrated approach to crisis management and recovery in tourist-reliant destinations, based on the case studies of Bali and Phuket. Yetta’s primary researchinterests include establishing a holistic understanding of the impacts tourism in developingnations and the facilitation of community based disaster management. Email:yetta.gurtner@jcu.edu.auDamian Morgan:Damian Morgan is a lecturer with the Department of Management, Monash University. He isalso a member of the Monash University Tourism Research Unit where his research interestconcerns outdoor tourism and recreation risk management. Damian has held a range ofadministrative, management and sports instruction positions in the tourism and hospitalityindustries. He is completing a PhD in surf beach use and safety with the Monash UniversityAccident Research Centre.The authors are particularly indebted to Dr. Scott Cunliffe and Dr. DavidKing at the Centre for Disaster Studies, James Cook University, for theinitial project conception, proposal and development.Risk Management Training for Tourism 87© COPYRIGHT STCRC
  • 89. Risk Management for Small Tourism BusinessesAuthorsYetta Gurtner:Yetta is a PhD Candidate and researcher with the Centre of Disaster Studies, in the School ofEarth and Environmental Sciences, James Cook University, Townsville. Her current thesisproject investigates an integrated approach to crisis management and recovery in tourist-reliant destinations, based on the case studies of Bali and Phuket. Yetta’s primary researchinterests include establishing a holistic understanding of the impacts tourism in developingnations and the facilitation of community based disaster management. Email:yetta.gurtner@jcu.edu.auDamian Morgan:Damian Morgan is a lecturer with the Department of Management, Monash University. He isalso a member of the Monash University Tourism Research Unit where his research interestconcerns outdoor tourism and recreation risk management. Damian has held a range ofadministrative, management and sports instruction positions in the tourism and hospitalityindustries. He is completing a PhD in surf beach use and safety with the Monash UniversityAccident Research Centre.The authors are particularly indebted to Dr. Scott Cunliffe and Dr. DavidKing at the Centre for Disaster Studies, James Cook University, for theinitial project conception, proposal and development.Risk Management Training for Tourism 87© COPYRIGHT STCRC